Multiple IdPs without discovery

[Phil Gold]

* Peter Schober <peter.schober at univie.ac.at> [2014-03-20 19:26 +0100]:
> * Phil Gold <phil at cs.jhu.edu> [2014-03-20 19:04]:
> > > ShibRequestSetting entityID foo
> > 
> > Is this only for Apache 2.4?  I'm running Shibboleth SP 2.5.3 on Apache
> > 2.2.15 (on Scientific Linux (RHEL) 6.5) and that setting has never worked
> > for me.
> 
> It's not. Can you explain what "has never worked" means, specifically?

I have an SP configured to load metadata for two IdPs and normally to use
the embedded DS to allow people to choose between them.  Here are some
excerpts from my shibboleth2.xml:

    <ApplicationDefaults entityID="https://sp.my.domain/shibboleth"
                         REMOTE_USER="eppn persistent-id targeted-id">
      <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                checkAddress="false" handlerSSL="false">
        <SSO discoveryURL="https://sp.my.domain/shibboleth-ds/index.html"
             discoveryProtocol="SAMLDS">
          SAML2 SAML1
        </SSO>
        <!-- <Logout> and <Handler>s omitted -->
      </Sessions>
      <MetadataProvider type="XML" file="idp1-metadata.xml"
                        legacyOrgNames="true"/>
      <MetadataProvider type="XML" file="idp2-metadata.xml"
                        legacyOrgNames="true"/>
      <!-- other settings unchanged from their defaults -->
    </ApplicationDefaults>

I've tried doing:

    ShibRequestSetting entityID https://idp1.my.domain/idp/shibboleth  

in .htaccess files, in specific <Location> and <Directory> settings both
within and without <VirtualHost> contexts, and in general <Location />
settings (with and without <VirtualHost> contexts).  In every one of those
cases, when an application redirects to
https://sp.my.domain/Shibboleth.sso/Login, the user is presented with the
embedded DS.  If there's an entityID parameter in the
https://sp.my.domain/Shibboleth.sso/Login URL, it's honored even though
the Apache settings don't seem to be.

Do you have any suggestions about where I should be looking to figured out
what I'm doing wrong?

-- 
Phil Gold / JHU CS IT (Linux)
phil at cs.jhu.edu