application override but wrong entityID in <Issuer> in the request

[Cantor, Scott]

> My Apache configuration includes
> 
> <Directory /var/www/registry/auth/login>
>   AuthType shibboleth
>   ShibRequestSetting applicationId registryApplication
>   require valid-user
> </Directory>

That's ok, but won't be sufficient. A different handlerURL will have to be configured and mapped to the application, and since that's a virtual resource, you have to use Location to do it in general.

> I would have expected the <Issuer> to be the entityID that is
> prescribed in the <ApplicationOverride>.

How is the session actually being initiated? There's no requireSession setting in your example, so that would lead me to guess you might be using a manual redirect to /Shibboleth.sso/Login, which would put the blame back on the need for a dedicated, and non-default mapped, handlerURL.

All that said, you *may* be able to avoid the hassle of an override, depending on the use case. If you need to override the entityID used when communicating with a specific IdP, or a set of IdPs that you can identify by means of a supported matching feature (basically either EntitiesDescriptor or ideally EntityAttribute extension/tag), you can do that with the RelyingParty element.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRelyingParty

I can probably advise better if I know what the use case is.

-- Scott