Use a specific IDP for a given resource -- mod_shib not doing as we're telling it

[Wessel, Keith]

Hi,

One of our SP operators wants to direct to a specific campus IDP based on the URL the user visits on the SP rather than using the discover service. I thought it would simply be a matter of adding shibbolethRequestSetting entityID blah to the Apache <Location> block where Shib si enabled, but it's not working. He always gets sent to the default IDP. He has this in shibboleth2.xml:

            <SSO entityID="urn:mace:incommon:uiuc.edu"
                 discoveryProtocol="SAMLDS" discoveryURL="">
              SAML2 SAML1
            </SSO>

We also tried it leaving entityID blank in the SSO element.

His Apache config contains:

        <Location /uPortal/Login>
          AuthType shibboleth
          ShibUseHeaders On
          ShibRequestSetting entityID https://shibboleth.uic.edu/shibboleth
          require valid-user
        </Location>

But when eh visits the URL in the location block, he always gets the IDP from the SSO element in shibboleth2.xml, urn:mace:incommon:uiuc.edu. And when it's left blank in shibboleth2.xml, "entityID=""), he gets an error that his request can't be handled by any session initiators.

Can anyone explain why the Apache shibbolethRequestSetting keyword seems to be ignored?

Keith