Multi-Domain SP

[Ran]

Thanks for the quick answer Peter. my responses embedded


On Mon, Mar 11, 2013 at 1:01 PM, Peter Schober
<peter.schober at univie.ac.at>wrote:

> * Ran <ran at sheinberg.net> [2013-03-11 11:46]:
> > For different reasons, we need to make the call to the SP from
> > another URL and this is proving to be quite difficult.
> >
> > For example, currently we make the request with:
> >
> https://original.example.com/Shibboleth.sso/Login?target=https://original.example.com&entityID=https://idp.address.com/idp/shibboleth
> >
> > Now we ALSO need to make the call with the new Host:
> >
> https://new-host.example.com/Shibboleth.sso/Login?target=https://new-host.example.com&entityID=https://idp.address.com/idp/shibboleth
>
> Does "make the call" mean "need to protect resources on a different
> name-based virtual host"?
>
> (From where protocol requests are made is mostly irrelevant, esp those
> above; you can also issue SAML authentication requests to the IdP in
> the name of the SP from any other host, unless the IdP insists these
> to be signed by the SP.)
>
> > Just to clarify - this error seems to be common among people who use
> > SSL Offloading on the Load Balancer but did not configure Apache to
> > believe it is working in HTTPS, this is not my case, as everything
> > is working until I try to add the second URL.
>
> There can be several reasons for that error of which a scheme mismatch
> (https vs http) is only one.
>
> > SHIBBOLETH2.XML:
>
> Since you're using Apache httpd there's nothing in the SP you'd *need*
> to change, in the most common case (so using overrides wouldn't be my
> first choice). Instead you could simply configure the second virtual
> host correctly in Apache httpd, by setting ServerName.
>

-- Didn't I do that? can you point out what's wrong in the snippet from
httpd.conf?


> For response messages from the IdP to be able to be recieved correctly
> you'd then put additional protocol endpoints (ACS URLs etc) for the
> new vhost into the same EntityDescriptor for the existing SP. Done.
>
> -- Didn't I do that as well? added
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
https://new-host.example.com/Shibboleth.sso/SAML2/POST" index="1"/>
In the SP's metadata file that is located on the IdP.
What's missing?

> These are the guides I followed:
> > https://wiki.cam.ac.uk/raven/Virtual_hosting_issues_with_Shibboleth
> > http://www.edugate.ie/content/shibboleth-sp-multidomain-environment
>
> I'm not gonna read and comment on those now. If you have questions
> regarding any 3rd-party documentation you'd better contact the authors
> of those.
>
> Cheers,
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130311/b22abc1b/attachment.html