OpenAthens SP to Shibboleth (using OA Federation): Deep Links

[Manoj Kancharla]

I have modified the metadata to include the following nodes a) <init:RequestInitiator> b) <md:ArtifactResolutionService> c) <md:SingleLogoutService> d) <md:AssertionConsumerService> for each of the micro sites (in addition to the top-level site).
Now, when I try to login from a micro site, I'm getting error " Binding Exception SAML message delivered with POST to incorrect server URL" 

https://amadev.silverchair.com/Shibboleth.sso/Login?entityID=https%3a%2f%2fidp.eduserv.org.uk%2fopenathens&target=https%3a%2f%2fjama.amadev.silverchair.com%2fjournal.aspx
https://jama.amadev.silverchair.com/Shibboleth.sso/Login?entityID=https%3a%2f%2fidp.eduserv.org.uk%2fopenathens&target=https%3a%2f%2fjama.amadev.silverchair.com%2fjournal.aspx

SAML Request
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    AssertionConsumerServiceURL="https://jama.amadev.silverchair.com/Shibboleth.sso/SAML2/POST"
                    Destination="https://auth.athensams.net/oahf"
                    ID="_50872bc9805d4cb8612b9dc503196c5a"
                    IssueInstant="2016-01-28T12:49:14Z"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Version="2.0"
                    >
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sp.silverchair.com/ama/development/shibboleth</saml:Issuer>
    <samlp:NameIDPolicy AllowCreate="1" />
</samlp:AuthnRequest>

Any help is appreciated. I feel like I'm close...

Thanks

Manoj

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, January 27, 2016 7:52 PM
To: Shib Users
Subject: Re: OpenAthens SP to Shibboleth (using OA Federation): Deep Links

On 1/27/16, 7:40 PM, "users on behalf of Manoj Kancharla" <users-bounces at shibboleth.net on behalf of manojk at silverchair.com> wrote:



>There are multiple clients using shibboleth and each of them as an ApplicationOverride. I'm not sure what the implications.

I can't tell you why you chose that approach, though. If you tell me why you think you need an override, I can tell you whether that's a use case for one. That's all I can do. The wiki also describes these issues at length in describing what that feature is for and what it's not needed for.

> We're closer to a deadline

If you want to keep using overrides, then you MUST create endpoints, in metadata, specific to every override. They can share one entityID, or not, but they're all required.

>Could you please elaborate on "carving things by path"?

Mapping resources to applicationId based on directories rather than vhosts, and having to set handlerURL specifically in each one. That's what I assume you did.

>How does "stop using endpoints" approach work?

Stop using the endpoints meant stop using overrides, same recommendation.

> Could you point me to any documentation?

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationModel

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net