Multi-Domain SP

[Ran]

Well I removed all the irrelevant stuff per your recommendation.
Removed all the added stuff from Shibboleth.xml
Started fresh on the IdP by regenerating the Metadata from the SP and
adding the ACS URLs + upped their indexes.

Now I think the last point is httpd.conf. this is what I left:
<VirtualHost new-host.example.com:443>
ServerName new-host.examplecom:443
ServerAlias new-host.examplecom
UseCanonicalName On
</VirtualHost>

I am trying without Location and the applicationId as you mentioned.
am I using the directives correctly?
And another question is how should the Virtualhost do the binding? on port
443 which is what the Load Balancer is listening on? or maybe 8080 since
this is what the Application is listening to (so maybe <VirtualHost
new-host.example.com:8080> ? that doesn't seem to work as well...



On Mon, Mar 11, 2013 at 2:01 PM, Peter Schober
<peter.schober at univie.ac.at>wrote:

> * Ran <ran at sheinberg.net> [2013-03-11 12:44]:
> > > Since you're using Apache httpd there's nothing in the SP you'd *need*
> > > to change, in the most common case (so using overrides wouldn't be my
> > > first choice). Instead you could simply configure the second virtual
> > > host correctly in Apache httpd, by setting ServerName.
> >
> > -- Didn't I do that? can you point out what's wrong in the snippet from
> > httpd.conf?
>
> Yes, but you also set an application id (I'd try without
> ApplicationOverrides first) so remoev that. And there were the changes
> to shibboleth2.xml (which I said you don't need.)
>
> > > For response messages from the IdP to be able to be recieved correctly
> > > you'd then put additional protocol endpoints (ACS URLs etc) for the
> > > new vhost into the same EntityDescriptor for the existing SP. Done.
> > >
> > > -- Didn't I do that as well? added
> > <md:AssertionConsumerService
> > Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
> > https://new-host.example.com/Shibboleth.sso/SAML2/POST" index="1"/>
> > In the SP's metadata file that is located on the IdP.
>
> That should do. Provided the IdP has fresh metadata (otherwise it will
> fail anyway) I'd make sure any index values from ACS URLs are unique.
> Then look at your logs.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130311/6a01d822/attachment.html