Dynamic (or Relative) URL for both IdP and SP

[Kirill]

Hi.

In our environment, both IdP and SP reside behind a reverse proxy, and both
IdP and SP have the same host name, but the context path is different (e.g.
SP's url - http://abc.example.com/sp/, IdP's url -
http://abc.example.com/idp/).

However, the subdomain part of the url may differ depending on the
environment from which users access the system, e.g. SP's url can be
http://abc.example.com/sp/ or http://xyz.example.com/sp/ (but in the end
the user will use the same system).

This means that I cannot not know the full url of the IdP or SP in advance.
E.g if users uses http://xyz.example.com/sp/ for accessing the SP, then the
URL for the IdP must be dynamically set to http://xyz.example.com/idp/ and
not http://abc.example.com/idp/ for example. And vice versa (IdP must
respond to correct

Here are some abstract options that I could think of (but none of them is
fully developed).

Option 1. Relative urls for the endpoints in metadata for both IdP and SP.

Is this possible / allowed at all from SAML perspective? Are there any
issues I need to worry about?

Option 2. Hack into SP's and IdP's assertions creation logic in order to
set correct URL for HTTP-POST bindings (we only use post bindings)

Option 3. SP could treat IdP on different hosts as different IdPs (and the
other way around). However there are several issues:

 - there is just one physical IdP and its entity ID is fixed. However SP's
will need to hold multiple metadata for IdP and it will need to have
different entity ID.
- the same issue with SP.

Any ideas how I can solve this problem?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160201/e36225eb/attachment-0001.html>