Help me understand how to configure existing SP for a single SP authenticating to two IdPs

[Mark Neidig]

The reply to my previous request directed me to some impressive documentation, which I have read and re-read to the point of information overload, but it was fun and easy creating, joining, configuring, and testing an SP on TestShib!  I'm happy to continue reading, but the deadline is near and I need help understanding how to configure Shibboleth2.xml for a single SP authenticating to two IdPs.

My goal is to add another company, i.e. new.CompanyB.com, that has its own IdP, IdP.CompanyB.com, to my existing SP's SSO process. 
I would appreciate comments indicating where I need to make the edits in my template below or a sample shibboloeth2.xml file configured for my scenario. 

If possible and appropriate, please use these values to help me understand where the pieces fit:

Host/SP:			test.mycompany.com

CompanyA's site:		old.companyA.com
CompanyA' IdP:		IdP.CompanyA.com
Host's path if company A:	Path/PathA

CompanyB's site:		new.companyB.com
CompanyB' IdP:		IdP.CompanyB.com
Host's path if company B:	Path/PathB

A mockup of my existing Shibboleth2.xml:
<SPConfig xmlns....>

	<InProcess logger="native.logger">
		<ISAPI normalizeRequest="true" safeHeaderNames="true">
			<Site id="1" name="test.mycompany.com" scheme="https" port="443" />
		</ISAPI>
	</InProcess>


	<RequestMapper type="Native">
		<RequestMap entityID="http://IdP.CompanyA.com" applicationId="Default Web Site">
			<Host name="test.mycompany.com" scheme="https" port="443"> 
				<Path name="Path/PathA" authType="shibboleth" requireSession="true"/>
	            		</Host>
	        	</RequestMap>
	</RequestMapper>

NOTE: new.CompanyB.com wants to use userId instead of email.

	<ApplicationDefaults entityID="https://test.mycompany.com" REMOTE_USER="email">
						 
		<Sessions 	lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="true" 
				handlerSSL="true" cookieProps="http">
			
			<SSO 	entityId="http://IdP.CompanyA.com" discoveryProtocol="SAMLDS" 
				discoveryURL="https://www2.CompanyA.com/somepath/saml?target=mycompany" 
				target="https://test.mycompany.com/Path1/Path2/">
				SAML2
			</SSO>
					
			<Logout>SAML2 Local</Logout>
			<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
			<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
			<Handler type="Session" Location="/Session" showAttributeValues="false"/>
			<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
		</Sessions>
	
		<Errors supportContact="support at mycompany.com"
			helpLocation="/about.html"
			styleSheet="/shibboleth-sp/main.css"/>

QUESTION: Can this file referenced in MetadataProvider hold metadata for more than one IdP? If so, wrapped in  an <EntitiesDescriptor> element?
		<MetadataProvider type="XML" file="TestIdentityProvidersMetaData.xml" />

		<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
		<AttributeResolver type="Query" subjectMatch="true"/>
		<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
		<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
	
		<ApplicationOverride id="Default Web Site" entityID="https://test.mycompany.com" />
		
	</ApplicationDefaults>
    
	<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml" />
	<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml" />

</SPConfig>

Thank you,
Mark
==================================================================================================

> I'm told my company is a current Shibboleth user. I am replacing the 
> developer that initially set up our Shibboleth. Our SSO code is in 
> place and functional. I just need to add another client and I am 
> having trouble determining the next step. I'm being asked for our ACS 
> URL.


Then you're likely running the Shibboleth Service Provider (SP) software, i.e., you're using it to protect some resource that's made available to others via SAML WebSSO.

Here's the home of the current documentation:
https://wiki.shibboleth.net/confluence/display/SHIB2/
Then chose "Configure" in the left box:
https://wiki.shibboleth.net/confluence/display/SHIB2/Configuration
Then "Talk to a New Identity Provider" in the middle box:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddIdP

What the client wants are the essential communication parameters for your Shibboleth SP software. 

The standardized format to communicate them is SAML metadata. 
You can generate the SAML metadata for your own SP (which also details your ACS URLs) by using the provided 'metagen' tool from the SP distribution.

You can also find an approximation (!) of your SAML metadata at https://yourserver.example.com/Shibboleth.sso/Metadata

At taking the ACS URL values from there should be fine, provided:
	1. you're accessing this URL at the right vhost (in case there are several pointing to the same system) and also
	2. provided the Shibboleth "handler" (the path the webserver knows belongs to the Shibboleth software) is the default value, /Shibboleth.sso

HTH,
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net