shibboleth2.xml ServiceProvider on MS IIS: Can Configure One IdP or the Other to Work, but Never Both

[Cantor, Scott]

On 2/24/15, 3:42 AM, "Mark Neidig" <mneidig at ftni.com> wrote:



>Below is my shibboleth2.xml. I can configure one IdP or the other to 
>work, but never both.
>When I remove a Host element, the other host element works and vice 
>versa. 
>My ApplicationOverride elements do no harm as they are, but they don't 
>help either.

I don't know why they're there, so step one is normally to stop using them 
and start over, undoing all these changes to reduce the complexity.

>Please show me what the configuration should be.

I can answer questions. I don't know what it is you want to do, so I have 
no idea how to do it.

If the goal is to establish the default IdP based on virtual host, all you 
need is the RequestMap minus all the overrides and applicationId changes.

The most significant red flag is:

><ApplicationOverride id="SsoSecondClient" 
>entityID="http://test.myCompanySP.com" >
>	<Sessions lifetime="28800" timeout="3600"
>		handlerURL="/test.myCompanySP.com/Shibboleth.sso" handlerSSL="true"

It's never advisable to change the handlerURL, though I didn't see 
anything that would prevent it from working in the abstract.

-- Scott