ApplicationOverride with apache reverse proxy and different configurations per customer

[Cantor, Scott]

Seeing as this just came up on the InCommon list, let me say very vocally and explicitly:

Stop using your URLs to identify customers. That is pointless. It doesn't help users and it screws up your Shibboleth deployment.

If you need to have special URLs for customers to directly access a silo, then the customer should be left with that responsibility. They can interact with your Shibboleth SP very easily by just accessing /Shibboleth.sso/Login?entityID=<idp> to trigger things for their IdP. That's why that feature was added. It avoids you having to do all the work that you're doing.

All you need to do is make sure that accessing a particular *resource* is appropriately protected. You might make the resource URLs specific to a customer account, but that doesn't have to be anything the SP software knows about.

If you take that advice, virtually your entire SP configuration drops to nothing.

-- Scott