application override but wrong entityID in <Issuer> in the request
Scott Koranda
skoranda at gmail.com
Fri May 31 13:47:19 EDT 2013
Hello,
I am using the Shibboleth SP 2.4.3.
I have configured an application override to support a second
entityID. The second entityID is necessary because the two different
logical SPs operate in different federations.
The application override is
<ApplicationOverride id="registryApplication"
entityID="https://domain01.org/shibboleth-sp" />
My Apache configuration includes
<Directory /var/www/registry/auth/login>
AuthType shibboleth
ShibRequestSetting applicationId registryApplication
require valid-user
</Directory>
When I initiate a session I see this in the log file:
May 31 12:33:41 myhost shibboleth-sp: 1370021621 DEBUG Shibboleth.Apache [230
61] shib_check_user: mapped https://domain01.org/registry/auth/login
to registryApplication
So it appears that my Apache configuration is correct so that when the
session is initiated it is mapped to the registryApplication
"application".
The SAML <AuthnRequest> being sent to the IdP, however, includes
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://otherdomain.org/shibboleth-sp</saml:Issuer>
I would have expected the <Issuer> to be the entityID that is
prescribed in the <ApplicationOverride>.
What have I done incorrectly or incompletely?
Thanks,
Scott K
More information about the users
mailing list