ApplicationOverride with apache reverse proxy and different configurations per customer

[Cantor, Scott]

> My configuration is below…in a nutshell:

> When I access https://www.fakecompany.com/cust1 or https://www.fakecompany.com/cust2 I get
> redirected to the IdP correctly…then the
> IDP needs to redirect back to the proper Shibboleth.SSO/SAML/POST url and I’m not sure I  > have it correct…because it doesn’t seem to work.  I would like to not have to define an
> application default, but Shibboleth doesn’t like that.  Can somebody please help?

The best option is to stop using overrides. Shibboleth is not designed to silo everything. It wants you to load all the metadata globally, and if you must, you can tell it which IdP to use based on a path by specifying the entityID content setting in the Apache configuration based on the location/path.

So you would tell it the entityID to use based on the /cust1 and /cust2 paths via "ShibRequestSetting entityID <idpname>"

But that doesn't do authorization. Your application is expected to control which IdP(s) and user(s) can access resources without the SP doing that for you.

That is the intended model in most cases.

If you must compartmentalize this in the SP, then you should use virtual hosts instead, to segment customers, and in that scenario, your overrides can be fairly simple, pretty close to what you're doing now.

What you're trying to do is the worst way to go, using paths. That is much more complex.

To do that, your override's <Sessions> elements need to override the handlerURL setting and point it to /cust1/Shibboleth.sso and so forth, and then your metadata has to include complete endpoints for every set of paths.

-- Scott