multiple sp with same hostname

[Peter Schober]

Nikola,

* Nikola Garafolic <ngarafol at srce.hr> [2015-10-13 10:14]:
> I have one virtualhost that uses shibboleth. I currently have it set to run
> only on http. Now I would like to use it on https and http simultaneously.
> So, I need http://domain.com and https://domain.com without http to https
> redirection. I am using apache and haproxy for loadbalancing.

I wouldn't do that, for two reasons: (1) Why bother with SAML at all
when you don't care about security and people taking over other
people's sessions (HTTP Cookies)? (2) Unless you're using the (rather
unusual, these days) Artifact binding many browsers will issue a
security warning when HTTP-POSTing the SAML response from the IDP (on
HTTPS; the IDP /is/ running only on HTTPS, right?!) to the SP (on
plain HTTP). I wouldn't run a service that comes built-in with
security warnings, only teaching subjects to "click away" those
warnings (and w/o a chance for them to understand why and when it's OK
to do so).

> For now in shibboleth2.xml I setup:
> 
> <Host name="domain.com" applicationId="domain">
>             </Host>

You're runing CentOS and httpd as web server. Then you don't need to
do anything in shibboleth2.xml and use httpd's native directives for
everything instead. The wiki should have mentioned that in several
places, certainly on httpd-related ones.

> <ApplicationOverride id="domain" entityID="http://domain.com/"/>
> 
> <ApplicationOverride id="domainssl" entityID="https://domain.com/"/>

Unless there are other (unnamed) special circumstances in your
deployment you also don't need ApplicationOverrides for more than one
vhosts to work on the same machine, TLS or not.

> And have two apache vhosts running on port 80 (since haproxy will do
> loadbalancing) with:
> 
> http vhost:
> 
> ServerName http://domain.com
> ...
> ShibRequestSetting applicationId domain
> 
> and https vhost:
> 
> ServerName https://domain.com
> ...
> ShibRequestSetting applicationId domainssl

You're missing the virtualized port in the ServerName directive,
that's where the Shib SP takes self-referencing URLs from.
-peter