Multi-Domain SP

[Ran]

It's not working yet, no. the error did not change.
opensaml::BindingException at (
https://original.example.com/Shibboleth.sso/SAML2/POST)
SAML message delivered with POST to incorrect server URL.

I understand your comment about the VirtualHost directive. in that case,
this is what I have right now:

<VirtualHost new-host.example.com:443>
ServerName https://new-host.example.com:443
<Location />
        AuthType shibboleth
        require shibboleth
        ShibUseHeaders on
</Location>
</VirtualHost>

The ServerName in the VirtualHost is correct, because I can paste it in my
browser and get to the Apache landing page. this is what I'm using to build
the Request URL.
Am I missing any directives in that snippet? at this point I'm just winging
it by copying different parts from different guides.


On Mon, Mar 11, 2013 at 2:23 PM, Peter Schober
<peter.schober at univie.ac.at>wrote:

> * Ran <ran at sheinberg.net> [2013-03-11 13:11]:
> > Well I removed all the irrelevant stuff per your recommendation.
> > Removed all the added stuff from Shibboleth.xml
> > Started fresh on the IdP by regenerating the Metadata from the SP and
> > adding the ACS URLs + upped their indexes.
>
> Didn't see an error report in your mail, though, so is it working as
> expected?
>
> > Now I think the last point is httpd.conf. this is what I left:
> > <VirtualHost new-host.example.com:443>
> > ServerName new-host.examplecom:443
> > ServerAlias new-host.examplecom
> > UseCanonicalName On
> > </VirtualHost>
> >
> > I am trying without Location and the applicationId as you mentioned.
> > am I using the directives correctly?
> > And another question is how should the Virtualhost do the binding? on
> port
> > 443 which is what the Load Balancer is listening on? or maybe 8080 since
> > this is what the Application is listening to (so maybe <VirtualHost
> > new-host.example.com:8080> ? that doesn't seem to work as well...
>
> So you are in fact terminating SSL at some other system? The advice
> stays the same: ServerName needs to be correct. Correct means matches
> whatever the HTTP User Agent sees, i.e. including the schema (https)
> before the hostname.
> On what local TCP port you have your httpd listen is irrelevant for
> any purposes of this list and the Shibboleth software (assuming you
> don't intend on exposing this to the network). What's wrong with port
> 80? But local deployment choice, really.
> Also note that httpd does not bind to ports based on virtualhost
> directives (it uses the Listen directives for that).
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130311/2714a436/attachment.html