shibboleth2.xml ServiceProvider on MS IIS: Can Configure One IdP or the Other to Work, but Never Both

[Mark Neidig]

Scott,
	Thank you for your response; I applied your advice. Here is a clearer picture.

My situation is I have a client, which hosts its own IDP, accessing my protected SP resources via SSO SAML and I need to allow another client, which also hosts its own IDP, access to a different resource path. 

I have SAML metadata for both IDPs and added them to my SP via a combined MetadataProvider file.

One or the other client can access its target resource when I configure one or the other client in the <RequestMap><Host> element at a time. 

I am asking how to configure two clients. 

Do I use the multiple <Host> elements in a <RequestMap> section?

Can there be multiple <Host> elements inside a <RequestMap>?

When I use multiple <Host> elements inside a <RequestMap> the host element below is listed first will access the respective page. While the host element listed second receives a "Method Not Found" server error.
Reversing the order also reverses which host is successful and which host gets the error.

Exerpt from my shibboleth2.xml
<RequestMapper type="Native" >
     <RequestMap  applicationId="Default Web Site">
           <Host entityID="http://test.IdPSecondClient.com" name="test.myCompanySP.com" scheme="https" port="443" >
               <Path name="/SignIn/SsoSecondClient" requireSession="true" authType="shibboleth"/>
          </Host>
          <Host entityID="http://IdPFirstClient.com" name="test.myCompanySP.com" scheme="https" port="443"> 
               <Path name="/SignIn/SsoFirstClient" authType="shibboleth" requireSession="true"/>
          </Host> 
     </RequestMap>
</RequestMapper>

Thank you for taking time out of your day to address my questions. 

-Mark
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, February 23, 2015 10:08 PM
To: Shib Users
Subject: Re: shibboleth2.xml ServiceProvider on MS IIS: Can Configure One IdP or the Other to Work, but Never Both

On 2/24/15, 3:42 AM, "Mark Neidig" <mneidig at ftni.com> wrote:



>Below is my shibboleth2.xml. I can configure one IdP or the other to 
>work, but never both.
>When I remove a Host element, the other host element works and vice 
>versa.
>My ApplicationOverride elements do no harm as they are, but they don't 
>help either.

I don't know why they're there, so step one is normally to stop using them and start over, undoing all these changes to reduce the complexity.

>Please show me what the configuration should be.

I can answer questions. I don't know what it is you want to do, so I have no idea how to do it.

If the goal is to establish the default IdP based on virtual host, all you need is the RequestMap minus all the overrides and applicationId changes.

The most significant red flag is:

><ApplicationOverride id="SsoSecondClient" 
>entityID="http://test.myCompanySP.com" >
>	<Sessions lifetime="28800" timeout="3600"
>		handlerURL="/test.myCompanySP.com/Shibboleth.sso" handlerSSL="true"

It's never advisable to change the handlerURL, though I didn't see anything that would prevent it from working in the abstract.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net