ApplicationOverride with apache reverse proxy and different configurations per customer

[Micky Williamson]

Hello,
My configuration is below…in a nutshell:
When I access https://www.fakecompany.com/cust1 or https://www.fakecompany.com/cust2 I get redirected to the IdP correctly…then the IDP needs to redirect back to the proper Shibboleth.SSO/SAML/POST url and I’m not sure I have it correct…because it doesn’t seem to work.  I would like to not have to define an application default, but Shibboleth doesn’t like that.  Can somebody please help?
I am new to Shibboleth.  I have the following configuration:
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
    clockSkew="180">
  <ApplicationDefaults entityID="https://id.fakecompany.com" REMOTE_USER="eppn persistent-id targeted-id">
    <Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerSSL="true" cookieProps="https">
      <SSO entityID="http://www.idprovider.com/12345678">SAML2 SAML1</SSO>
      <Logout>SAML2 Local</Logout>
      <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
      <Handler type="Status" Location="/Status" />
      <Handler type="Session" Location="/Session" showAttributeValues="false"/>
      <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
    </Sessions>
    <Errors supportContact="root at localhost" helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/>
    <MetadataProvider type="XML" validate="true" file="/etc/shibboleth/Metadata.xml"/>
    <MetadataProvider type="XML" validate="true" file="/etc/shibboleth/MetadataCust2.xml"/>
    <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
    <AttributeResolver type="Query" subjectMatch="true"/>
    <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
    <CredentialResolver type="File" key="keystore/id.key" certificate="keystore/id.crt"/>
    <ApplicationOverride id="cust2" entityID="https://id.fakecompany.com/cust2">
      <Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerSSL="true" cookieProps="https">
        <SSO entityID="http://www.idprovider.com/ABCDEFG">SAML2 SAML1</SSO>
        <Logout>SAML2 Local</Logout>
        <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
        <Handler type="Status" Location="https://id.fakecompany.com/Shibboleth.sso/cust2/Status"/>
        <Handler type="Session" Location="/Session" showAttributeValues="true"/>
        <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
      </Sessions>
    </ApplicationOverride>
  </ApplicationDefaults>
  <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
  <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig>
I have the following apache config:
<VirtualHost *:443>
    Header set Access-Control-Allow-Origin "*"
    RewriteEngine on
    RewriteRule ^/app11/$ /jep/app11/ [R]
    RewriteRule ^/appservices/(.*) /jep/appservices/$1 [R]
    ServerName id-jio-web.fakecompany.com<http://id-jio-web.fakecompany.com>
    ServerAdmin micky.williamson at fakecompany.com
    DocumentRoot /var/www/jio/html
  CustomLog /var/log/apache2/id-jio-web-access.log combined
  ErrorLog /var/log/apache2/id-jio-web-error.log
    LogLevel Debug
    SSLEngine On
    SSLProxyEngine On
    SSLCertificateFile /etc/apache2/keystore/id-jio-web.crt
    SSLCertificateKeyFile /etc/apache2/keystore/id-jio-web.key
    SSLCACertificateFile /etc/apache2/keystore/infra-dev.fakecompany.com.crt
  <Location /jep>
        Header set Cache-Control "max-age=0, must-revalidate"
        RewriteRule ^/jep/app11$ /jep/app11/ [R]
        ProxyPassReverseCookiePath  /app11/ /jep/app11/
        ProxyPassReverseCookiePath  /appservices/ /jep/appservices/
        ProxyPassReverseCookiePath  /fpo-service/ /jep/fpo-service/
        AuthType shibboleth
        ShibRequestSetting requireSession true
        ShibUseHeaders On
        Require shibboleth
        ProxyPass            https://infra-dev.fakecompany.com:8443
        ProxyPassReverse     https://infra-dev.fakecompany.com:8443
    </Location>
    <Location /cust2>
        Header set Cache-Control "max-age=0, must-revalidate"
        RewriteRule ^/jep/app11$ /cust2/app/ [R]
        ProxyPassReverseCookiePath  /app11/ /cust2/app11/
        ProxyPassReverseCookiePath  /appservices/ /cust2/appservices/
        ProxyPassReverseCookiePath  /fpo-service/ /cust2/fpo-service/
        AuthType shibboleth
        ShibRequestSetting requireSession true
        ShibRequestSetting applicationId cust2
        ShibUseHeaders On
        Require shibboleth
        ProxyPass            https://infra-dev.fakecompany.com:8443
        ProxyPassReverse     https://infra-dev.fakecompany.com:8443
    </Location>
Thanks
Micky


This communication may contain proprietary or other confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160711/3f18f79f/attachment-0001.html>