Dynamic (or Relative) URL for both IdP and SP

[Cantor, Scott]

> Option 1. Relative urls for the endpoints in metadata for both IdP and SP.
> 
> Is this possible / allowed at all from SAML perspective? Are there any issues I
> need to worry about?

Not allowed and not supported.

> Option 2. Hack into SP's and IdP's assertions creation logic in order to set
> correct URL for HTTP-POST bindings (we only use post bindings)

It's the SP implementation responsible for properly expressing the URL it needs used, and the IdP should simply enforce that via metadata. Your problem is a broken SP, or a broken configuration of an SP.

A Shibboleth SP, certainly, will do the right thing if the web server is properly configured.

> Any ideas how I can solve this problem?

Top of mind is stop playing these games with URLs. I have no idea why you think it's necessary for the IdP to live at different virtual hosts, but that's just creating problems. You cannot, with one entityID, dictate which SSO endpoint an SP will use unless you supply different metadata based on the vhost. The Shibboleth SP certainly can handle that, but it's hardly productive work.

-- Scott