Multiple SP entityIDs from a single, wildcard Apache vhost?

[Paul Dixon]

Overview
========
What I'd like to have to have a single wildcard vhost, with each domain
which hits it using a different ApplicationOverride to obtain an SP
entityID.

However, when I try to initiate authorization with TestShib, I get the
error "None of the configured SessionInitiators handled the request"

I tried increasing setting log4j.category.Shibboleth.RequestMapper=DEBUG to
see if I could learn more, but there was no further output in the logs.


Apache configuration
=================

The single default vhost provided a secured area in /Login

 <Location /Login>
    AuthType shibboleth
    ShibRequestSetting requireSession 1
    require shib-session
  </Location>

I also have "UseCanonicalDomain off" so that Apache uses the supplied
hostname rather than the canonical one (this is behind a load balancer, so
I can control what actually reaches this far)

shibboleth2.xml
=============

Here's the relevant bits of the shibboleth2.xml configuration

<!-- request mapper looks like this.... ->
<RequestMapper type="Native">
    <RequestMap applicationId="default">
      <Host name="product1.example.com" applicationId="product-1"/>
      <Host name="product2.example.com" applicationId="product-2"/>
      <Host name="product3.example.com" applicationId="product-3"/>
    </RequestMap>
  </RequestMapper>

<ApplicationDefaults id="default" entityID="
https://sp.example.org/shibboleth" REMOTE_USER="eppn persistent-id
targeted-id">

  <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="false" cookieProps="http">
      <!--
           This is where I might be going wrong - I removed entityID
attribute as I want to
           specify the IdP via query string, and I also removed
discoveryURL as a discovery
           service isn't necessary-->
        <SSO>SAML2 SAML1</SSO>
        ...

        <!-- I set the SP entityID for each domain here -->

        <ApplicationOverride id="product-1" entityID="
https://product1.example.com/shibboleth"/>
        <ApplicationOverride id="product-2" entityID="
https://product2.example.com/shibboleth"/>
        <ApplicationOverride id="product-3" entityID="
https://product3.example.com/shibboleth"/>
   </Sessions>

</ApplicationDefaults>


Testing
======
I initiate a TestShib test with a URL like this
https://product3.example.com/Login/?entityID=https://idp.testshib.org/idp/shibboleth

which displays a shibsp::ConfigurationException "None of the configured
SessionInitiators handled the request."


Why do I want to do this?
===================
My hope was that I could avoid having to reload apache whenever I wanted to
add a new SP setup, and simply have the configuration driven entirely from
shibboleth2.xml


Ideas?
=====
>From reading the docs and the list archives, what I'm trying to do may be
pushing too hard against some design elements of the Native SP software.
But I'm hoping there's a simple tweak I can make to the <SSO> element
perhaps to get this working....


Paul
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150630/37814656/attachment.html>