Shibboleth2.xml One host element containing two path elements, second path is not routing

[Mark Neidig]

Thanks to MikeWho and Scott for their advice. My issue remains unresolved. 

Summary: I am the SP on MS IIS and the scenarios are all IdP initiated. In my shibboleth2.xml file, I have two Path elements within a Host element. The first path always reaches the target. The path listed second gets a Server Error in Application: Method not found message. The same happens when I reverse the order of the paths.

Question: Given the details below, what do I need to change to get shibboleth to acknowledge the second path?

How I tested: 
	In my browser I type path1, https://test.mySPcompany.com/SignIn/path1. Without the SAML there is no session and, if path1 is listed in shibboleth2.xml first, my browser is redirected to Company1's login page. If the path is listed second I receive the Server Error page with Method not found message.
	In my browser I type path2, https://test.mySPcompany.com/SignIn/path2. Again, without the SAML there is no session and, if path2 is listed in shibboleth2.xml first, my browser is redirected to Company2's login page. If the path is listed second I receive the Server Error page with Method not found message.

How my IdP user tested (This may be an entirely different problem. I'm hoping you will suggest the IdP should send authenticated responses to my target, not my acs url)
	The IdP user sent a SAML authenticated response to my ACS url with a target of path1 (listed first) and received a 500 - Internal server error shibsp::ConfigurationException at (https://test.mySPcompany.com/Shibboleth.sso/SAML2/POST) Shibboleth handler invoked at an unconfigured location.

I have two paths, one for each of two IdPs.

IdP Company1 will use https://test.mySPcompany.com/SignIn/path1
IdP Company2 will use https://test.mySPcompany.com/SignIn/path2
My SP ACS url: https://test.mySPcompany.com/Shibboleth.sso/SAML2/POST

Advice step 1 of 2 (Done): (One Host element with two path elements with entity IDs on the path elements, and app IDs as there are different attributes from each IdP)

Advice step 2 of 2: (Create two ApplicationOverrides elements, in which I set
	2.1. (Done) the SP entityID, 
	2.2. (N/A) the IdP metadata (in a MetadataProvider element inside the ApplicationOverride) and 
	2.3. (N/A) the attribute map (in a AttributeExtractor element).)

For Advice step 2.2, I believe my ApplicationDefaults MetadataProvider serves this up properly as it is a file containing metadata for both companies.
For Advice step 2.3, I believe the attributes are set in the <ApplicationDefaults  REMOTE_USER="userId email" entityID="test.mySPcompany.com">

Here is an excerpt from my attribute-mal.xml:

	<Attribute name="email" id="email" />
	<Attribute name="userId" id="userId" />	

Here is an excerpt from my new shibboleth2.xml file:

	<Host name="test.remitpro.com" scheme="https" port="443" >
		<Path name="/SignIn/path1"  applicationId="path1" requireSession="true" authType="shibboleth"/>
		<Path name="/SignIn/path2"   applicationId="path2"     requireSession="true" authType="shibboleth"/>
	</Host>

	<ApplicationOverride id="path1" entityID="http://saml.company1.com" >
		<Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="true" handlerSSL="true" cookieProps="https"> 			
		<SSO entityID="http://saml.company1.com"
			 discoveryProtocol="SAMLDS" 
			 discoveryURL="https://www2.accp.company1.com/saml?target=sp_name" 
			 target="https://test.sp_company.com/SignIn/path1"> 
		SAML2
		</SSO>	  
		</Sessions>
		<MetadataProvider type="XML" reloadInterval="180000" file="IdentityProvidersForTestRemitproCom.xml"/>
	</ApplicationOverride>
		    
	<ApplicationOverride id="path2" entityID="http://test.company2.com"	>
		<Sessions 	lifetime="28800" timeout="3600" relayState="ss:mem"
				checkAddress="true" handlerSSL="true" cookieProps="https"> 			
					
			<SSO entityID="http://test.company2.com" >
			SAML2
			</SSO>	  
		</Sessions>
		<MetadataProvider type="XML" reloadInterval="180000" file="IdentityProvidersForTestSP.xml"/>
	</ApplicationOverride>


Thank you,

Mark

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of MikeWho
Sent: Tuesday, February 24, 2015 8:02 AM
To: users at shibboleth.net
Subject: RE: shibboleth2.xml ServiceProvider on MS IIS: Can Configure One IdP or the Other to Work, but Never Both

Hi Mark,

I don't know if you can have two Host elements with the same name, perhaps someone else could confirm.

You could try one Host containing two Path elements, corresponding to your two sub-paths. Set the entityID attribute on these Path elements, rather than on the Host. You may also need to set the applicationID attribute on the Path elements if they are separate applications. (For instance, if both IdPs send different attributes I'd guess you'd have to set up two separate ApplicationOverrides, each with distinct attribute maps)

Then you'd have two ApplicationOverrides, in which you set the SP entityID, the IdP metadata (in a MetadataProvider element inside the
ApplicationOverride) and the attribute map (in a AttributeExtractor element). 

Hope this helps,
Mike.



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/shibboleth2-xml-ServiceProvider-on-MS-IIS-Can-Configure-One-IdP-or-the-Other-to-Work-but-Never-Both-tp7611850p7611867.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net