application override but wrong entityID in <Issuer> in the request

Scott Koranda skoranda at gmail.com
Fri May 31 13:47:19 EDT 2013


Hello,

I am using the Shibboleth SP 2.4.3.

I have configured an application override to support a second
entityID. The second entityID is necessary because the two different
logical SPs operate in different federations.

The application override is

<ApplicationOverride id="registryApplication"
entityID="https://domain01.org/shibboleth-sp" />

My Apache configuration includes

<Directory /var/www/registry/auth/login>
  AuthType shibboleth
  ShibRequestSetting applicationId registryApplication
  require valid-user
</Directory>

When I initiate a session I see this in the log file:

May 31 12:33:41 myhost shibboleth-sp: 1370021621 DEBUG Shibboleth.Apache [230
61] shib_check_user: mapped https://domain01.org/registry/auth/login
to registryApplication

So it appears that my Apache configuration is correct so that when the
session is initiated it is mapped to the registryApplication
"application".

The SAML <AuthnRequest> being sent to the IdP, however, includes

<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://otherdomain.org/shibboleth-sp</saml:Issuer>

I would have expected the <Issuer> to be the entityID that is
prescribed in the <ApplicationOverride>.

What have I done incorrectly or incompletely?

Thanks,

Scott K


More information about the users mailing list