Shib protecting Wordpress Multisite install using wildcard DNS

[Wessel, Keith]

Interesting, Dave. I’m not sure I follow. How would we go about implementing that? I thought that the endpoint _had_ to be in the metadata.

The dynamically generated metadata idea certainly makes sense, too.

Thanks, all.

Keith


From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of David Langenberg
Sent: Thursday, February 19, 2015 12:10 PM
To: Shib Users
Subject: Re: Shib protecting Wordpress Multisite install using wildcard DNS

This sounds like one of those RARE use cases where a signed AuthRequest makes sense (to get around needing all those ACS endpoints in metadata).

Dave

On Thu, Feb 19, 2015 at 11:01 AM, Wessel, Keith <kwessel at illinois.edu<mailto:kwessel at illinois.edu>> wrote:
Hi, all,

I think I know the answer to this question, but I want to make sure I'm not missing something.

We have an SP admin wanting to Shib-protect a multisite Wordpress installation. A Wordpress site owner can request a new site on this service and have it automatically provisioned. Rather than paths to protect each WP installation, they're adding virtual hosts. They have a wildcard DNS entry.

As far as I know, each new hostname created will have to manually be added to the SP metadata in a new set of endpoints for the IDP to allow logins to that WP hostname. There's no way around it.

Is there a solution here, or do I just need to tell them that's not goignt o work unless they want to manually add endpoints?

Thanks,
Keith

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>



--
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150219/60367b76/attachment.html