Multi-Domain SP

[Peter Schober]

* Ran <ran at sheinberg.net> [2013-03-11 12:44]:
> > Since you're using Apache httpd there's nothing in the SP you'd *need*
> > to change, in the most common case (so using overrides wouldn't be my
> > first choice). Instead you could simply configure the second virtual
> > host correctly in Apache httpd, by setting ServerName.
> 
> -- Didn't I do that? can you point out what's wrong in the snippet from
> httpd.conf?

Yes, but you also set an application id (I'd try without
ApplicationOverrides first) so remoev that. And there were the changes
to shibboleth2.xml (which I said you don't need.)

> > For response messages from the IdP to be able to be recieved correctly
> > you'd then put additional protocol endpoints (ACS URLs etc) for the
> > new vhost into the same EntityDescriptor for the existing SP. Done.
> >
> > -- Didn't I do that as well? added
> <md:AssertionConsumerService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
> https://new-host.example.com/Shibboleth.sso/SAML2/POST" index="1"/>
> In the SP's metadata file that is located on the IdP.

That should do. Provided the IdP has fresh metadata (otherwise it will
fail anyway) I'd make sure any index values from ACS URLs are unique.
Then look at your logs.
-peter