shibboleth2.xml ServiceProvider on MS IIS: Can Configure One IdP or the Other to Work, but Never Both

[Mark Neidig]

Hello,

Below is my shibboleth2.xml. I can configure one IdP or the other to work, but never both. 
When I remove a Host element, the other host element works and vice versa. 
My ApplicationOverride elements do no harm as they are, but they don't help either. 

Please show me what the configuration should be.

Thank you,

Mark

<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"    
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    clockSkew="180">

    <!--Required for IIS-->
    <InProcess logger="native.logger">
        <ISAPI normalizeRequest="true" safeHeaderNames="true">
  			<Site id="1" name="test.myCompanySP.com" scheme="https" port="443" />
        </ISAPI>
    </InProcess>
		
	<RequestMapper type="Native" >
	
		<RequestMap  applicationId="Default Web Site">
		<!-- Missing one of these causes : Method not found: -->
  			<Host entityID="http://test.IdPSecondClient.com"	applicationId="SsoSecondClient" name="test.myCompanySP.com" scheme="https" port="443" >
				<Path name="/SignIn/SsoSecondClient" requireSession="true" authType="shibboleth"/>
			</Host>
			<Host entityID="http://IdPFirstClient.com" applicationId="ssoFirstClient" name="test.myCompanySP.com" scheme="https" port="443"> 
				<Path name="/SignIn/SsoFirstClient" authType="shibboleth" requireSession="true"/>
            </Host> 
 
		</RequestMap>
	</RequestMapper>
						 
	<ApplicationDefaults 
		REMOTE_USER="userId email" 
		entityID="http://test.myCompanySP.com">
		<!-- homeURL="https://test.myCompanySP.com/secure/"> -->
		
        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="true" handlerSSL="true" cookieProps="https">

<!-- 			<SSO entityID="http://test.IdPSecondClient.com" >
			SAML2
			</SSO> -->
			<!-- <SSO entityID="http://IdPFirstClient.com"  -->
			<SSO>
<!--			     discoveryProtocol="SAMLDS" 
 				 discoveryURL="https://www2.accp.ing-usa.com/esamloutbound/saml?target=myCompanySP" 
			     target="https://test.myCompanySP.com/SignIn/ssoFirstClient"> -->
			SAML2
			</SSO>			
            <!-- SAML and local-only logout. -->
            <Logout>SAML2 Local</Logout>

            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="true"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
        </Sessions>

        <!--
        Allows overriding of error template information/filenames. You can
        also add attributes with values that can be plugged into the templates.
        -->
        <Errors supportContact="support at myCompanySP.com"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>
		
		<MetadataProvider type="XML" reloadInterval="180000" file="IdentityProvidersForTestmyCompanySPCom.xml"/>

        <!-- Map to extract attributes from SAML assertions. -->
        <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
        
        <!-- Use a SAML query if no attributes are supplied during SSO. -->
        <AttributeResolver type="Query" subjectMatch="true"/>

        <!-- Default filtering policy for recognized attributes, lets other data pass. -->
        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

        <!-- Simple file-based resolver for using a single keypair. -->
        <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>

		<ApplicationOverride id="SsoSecondClient" entityID="http://test.myCompanySP.com" >
		<Sessions lifetime="28800" timeout="3600"
			handlerURL="/test.myCompanySP.com/Shibboleth.sso" handlerSSL="true"
			cookieProps="; path=/SignIn/SsoSecondClient; secure; HttpOnly"/>
		</ApplicationOverride>		
		<ApplicationOverride id="ssoFirstClient" entityID="http://test.myCompanySP.com" >
		<Sessions lifetime="28800" timeout="3600"
			handlerURL="/test.myCompanySP.com/Shibboleth.sso" handlerSSL="true"
			cookieProps="; path=/SignIn/ssoFirstClient; secure; HttpOnly"/>
		</ApplicationOverride>
    </ApplicationDefaults>
    
    <!-- Policies that determine how to process and authenticate runtime messages. -->
    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml" />

    <!-- Low-level configuration about protocols and bindings available for use. -->
    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml" />

</SPConfig>