Multiple IDP Entity IDs with 1 IDP

Mon Sep 9 13:55:11 EDT 2013

Scott,

We're having trouble defining the handler.

The override:

        <ApplicationOverride id="customer1"
            REMOTE_USER="eppn persistent-id targeted-id">
      <Sessions lifetime="28800" timeout="3600" checkAddress="false"
           handlerURL="/customer1/Shibboleth.sso" handlerSSL="false">
          <SessionInitiator type="Chaining" Location="/Login"
id="customer1_test"
                   relayState="cookie"
                   entityID="
https://sso.idpmain.customer1.com/idp/shibboleth">
              <SessionInitiator type="SAML2" acsIndex="121"
                       template="bindingTemplate.html"/>
              <SessionInitiator type="Shib1" acsIndex="125"/>
          </SessionInitiator>

The default shib.conf file (/etc/httpd/conf.d/shib.conf):

#
# Load the Shibboleth module.
#
LoadModule mod_shib /usr/lib/shibboleth/mod_shib_22.so
#
# Ensures handler will be accessible.
#
<Location /Shibboleth.sso>
  Satisfy Any
  Allow from all
</Location>
#
<Location /secure>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  require valid-user
</Location>

So this works:

https://apps1.ourcomp.com/Shibboleth.sso/Session

10.5.174.23 - - [09/Sep/2013:13:30:09 -0400] "GET /Shibboleth.sso/Session
HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1;
WOW64; Trident/5.0)"
10.5.174.23 - - [09/Sep/2013:13:30:38 -0400] "GET /Shibboleth.sso/Session
HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1;
WOW64; Trident/5.0)"
10.5.174.23 - - [09/Sep/2013:13:30:39 -0400] "GET /Shibboleth.sso/Session
HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1;
WOW64; Trident/5.0)"

And the HTTPD logs agree (200 file found):

10.5.174.23 - - [09/Sep/2013:13:30:09 -0400] "GET /Shibboleth.sso/Session
HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1;
WOW64; Trident/5.0)"
10.5.174.23 - - [09/Sep/2013:13:30:38 -0400] "GET /Shibboleth.sso/Session
HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1;
WOW64; Trident/5.0)"
10.5.174.23 - - [09/Sep/2013:13:30:39 -0400] "GET /Shibboleth.sso/Session
HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1;
WOW64; Trident/5.0)"

However, the extended version fails (404):

URL:
https://apps1.ourcomp.com/customer1/Shibboleth.sso/Session

     404 Not Found

access.log:

10.5.174.23 - - [09/Sep/2013:12:45:55 -0400] "GET
/customer1/Shibboleth.sso/Session HTTP/1.1"404 226 "-" "Mozilla/5.0
(compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
10.5.174.23 - - [09/Sep/2013:12:55:12 -0400] "GET /customer1/index.php
HTTP/1.1" 200 69505 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1;
WOW64; Trident/5.0)"
10.5.174.23 - - [09/Sep/2013:12:55:29 -0400] "GET
/customer1/Shibboleth.sso/Session HTTP/1.1"404 226 "-" "Mozilla/5.0
(compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"

error.log:

[Mon Sep 09 12:27:41 2013] [error] [client 10.5.174.23] File does not
exist: /home/httpd/customer1/Shibboleth.sso
[Mon Sep 09 12:45:55 2013] [error] [client 10.5.174.23] File does not
exist: /home/httpd/customer1/Shibboleth.sso
[Mon Sep 09 12:55:29 2013] [error] [client 10.5.174.23] File does not
exist: /home/httpd/customer1/Shibboleth.sso
[Mon Sep 09 12:59:06 2013] [error] [client 10.5.174.23] File does not
exist: /home/httpd/customer1/Shibboleth.sso
[Mon Sep 09 12:59:07 2013] [error] [client 10.5.174.23] File does not
exist: /home/httpd/customer1/Shibboleth.sso

Works for base URL though (/) :

https://apps.ourcomp.com/Shibboleth.sso/Session

    A valid session was not found.

10.5.174.23 - - [09/Sep/2013:13:30:09 -0400] "GET /Shibboleth.sso/Session
HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1;
WOW64; Trident/5.0)"
10.5.174.23 - - [09/Sep/2013:13:30:38 -0400] "GET /Shibboleth.sso/Session
HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1;
WOW64; Trident/5.0)"
10.5.174.23 - - [09/Sep/2013:13:30:39 -0400] "GET /Shibboleth.sso/Session
HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1;
WOW64; Trident/5.0)"

We tried adding the customer1 label in the location block, same results
though:

#
     <Location /customer1/Shibboleth.sso>
        SetHandler shib
     </Location>
#

--AND--

#
     <Location /customer1/Shibboleth.sso/*>
        SetHandler shib
     </Location>
#

What are we missing?

-- RGS

==================================
Roy G. Specter
roygspectech8 at gmail.com
========================================

On Mon, Sep 9, 2013 at 10:00 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 9/8/13 8:10 PM, "Roy Spectech" <roygspectech8 at gmail.com> wrote:
>
> >would the custom handlerURLs be these:
> >
> >handlerURL="/customer1/Shibboleth.sso"
> >handlerURL="/customer2/Shibboleth.sso"
> >handlerURL="/customer3/Shibboleth.sso"
>
> Probably. The amount of XML you're looking at is beyond horrendous though.
>
> >I also like your summary of the single entityID and multiple endpoint
> >versus multiple entityIDs with a single set of endpoints.."both kinda
> >suck!"
> >
> >But, since we have to use one or the other, uhm, which sucks less?
>
> That depends entirely on the federation(s) involved and anything else that
> impacts metadata management, but the single entityID model is usually
> easier.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130909/76cf5ed3/attachment.html 