OpenAthens SP to Shibboleth (using OA Federation): Deep Links

[Manoj Kancharla]

Scott,

There are multiple clients using shibboleth and each of them as an ApplicationOverride. I'm not sure what the implications. We're closer to a deadline

Could you please elaborate on "carving things by path"?  How does "stop using endpoints" approach work? Could you point me to any documentation?

Thanks

Manoj


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, January 27, 2016 5:49 PM
To: Shib Users
Subject: Re: OpenAthens SP to Shibboleth (using OA Federation): Deep Links

On 1/27/16, 4:48 PM, "users on behalf of Manoj Kancharla" <users-bounces at shibboleth.net on behalf of manojk at silverchair.com> wrote:



>The assertion consumer service URL generated in the SAML request is always generating the URL based on the value contained in the target query string.

It has to, or the SP couldn't function. The ACS drops a cookie that the resource has to be able to read.

> So, if the target Url is @ the microsite level, the ACS url in the request is at microsite-level and doesn't match with the ACS Url (top-level site) listed in the metadata. Is this the default behavior?

It's the required behavior unless you want it to loop, or unless you undo all the stuff you nust have created in the configuration. Why are you using overrides? There are very few cases where that makes sense.

>Will my solution (listed below) work? Is there a better solution?

Almost certainly, don't use ApplicationOverrides and carve things up by path.

>I'm thinking about a solution that would require modifying the metadata:

If you create endpoints that are not in the metadata, it won't work. You can add them to the metadata or stop using the endpoints. The latter is preferred in most cases.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net