Shibboleth2.xml One host element containing two path elements, second path is not routing

[Michael A Grady]

On Feb 27, 2015, at 4:31 PM, Mark Neidig <mneidig at ftni.com> wrote:

> 
> Here is an excerpt from my new shibboleth2.xml file:
> 
> 	<Host name="test.remitpro.com" scheme="https" port="443" >
> 		<Path name="/SignIn/path1"  applicationId="path1" requireSession="true" authType="shibboleth"/>
> 		<Path name="/SignIn/path2"   applicationId="path2"     requireSession="true" authType="shibboleth"/>
> 	</Host>
> 
> 	<ApplicationOverride id="path1" entityID="http://saml.company1.com" >

     The entityID attribute in the ApplicationOverride element needs to be the entityID of this "path-based SP", NOT the entityID of the IdP. And that IdP will need to have metadata for each of these path-based SPs, with distinct ACS endpoints. You are defining distinct Sps, one per company IdP, and you need to carry this distinction thru to everything.

> 		<Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="true" handlerSSL="true" cookieProps="https"> 			
> 		<SSO entityID="http://saml.company1.com"
> 			 discoveryProtocol="SAMLDS" 
> 			 discoveryURL="https://www2.accp.company1.com/saml?target=sp_name" 
> 			 target="https://test.sp_company.com/SignIn/path1"> 
> 		SAML2
> 		</SSO>	  
> 		</Sessions>
> 		<MetadataProvider type="XML" reloadInterval="180000" file="IdentityProvidersForTestRemitproCom.xml"/>
> 	</ApplicationOverride>
> 		    
> 	<ApplicationOverride id="path2" entityID="http://test.company2.com"	>

  As above, this is not what you want as the ApplicationOverride entityID.

> 		<Sessions 	lifetime="28800" timeout="3600" relayState="ss:mem"
> 				checkAddress="true" handlerSSL="true" cookieProps="https"> 			
> 					
> 			<SSO entityID="http://test.company2.com" >
> 			SAML2
> 			</SSO>	  
> 		</Sessions>
> 		<MetadataProvider type="XML" reloadInterval="180000" file="IdentityProvidersForTestSP.xml"/>
> 	</ApplicationOverride>
> 
> 
> Thank you,
> 
> Mark
> 


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.