Multiple IdPs without discovery

[Peter Schober]

* Phil Gold <phil at cs.jhu.edu> [2014-03-20 21:51]:
> in .htaccess files, in specific <Location> and <Directory> settings both
> within and without <VirtualHost> contexts, and in general <Location />
> settings (with and without <VirtualHost> contexts).  In every one of those
> cases, when an application redirects to
> https://sp.my.domain/Shibboleth.sso/Login

...then what you set for those Locations and Directories does not apply.

Assuming you meant the above literally, i.e., you have code that does
a redirect to /Shibboleth.sso/Login

If you meant to say it happens when you access the protected source
for which the Apache Location or Directory directives actually match
*and* active protection has been configured for those (as per the
docs), then this would be a bug.
But so far nothing you said makes me think that's the case.

> Do you have any suggestions about where I should be looking to
> figured out what I'm doing wrong?

Decide on whether you want httpd to intiate sessions or whether you
want to do that in your (application's) code.
You can do both, of course, if you know what to expect.
-peter