ApplicationOverride with apache reverse proxy and different configurations per customer

[Micky Williamson]

Scott,
this sounds like the right configuration….I am not an Identity person, just one who has been asked to swap out Wso2 for Okta/Shibboleth.  since we have Okta as an Idp, and Okta will have a serrate entity id per “pool of customers”….where do you tie the different entity ids (one per customer) to shibboleth if you don’t use overrides?
The shibboleth.xml file has entity ids for the application, as well as for the SSO within the application….so which entityId would you use?

I apologize for my lack of understanding, but do appreciate the help!

Micky
> On Jul 11, 2016, at 3:06 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
> Seeing as this just came up on the InCommon list, let me say very vocally and explicitly:
>
> Stop using your URLs to identify customers. That is pointless. It doesn't help users and it screws up your Shibboleth deployment.
>
> If you need to have special URLs for customers to directly access a silo, then the customer should be left with that responsibility. They can interact with your Shibboleth SP very easily by just accessing /Shibboleth.sso/Login?entityID=<idp> to trigger things for their IdP. That's why that feature was added. It avoids you having to do all the work that you're doing.
>
> All you need to do is make sure that accessing a particular *resource* is appropriately protected. You might make the resource URLs specific to a customer account, but that doesn't have to be anything the SP software knows about.
>
> If you take that advice, virtually your entire SP configuration drops to nothing.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

This communication may contain proprietary or other confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited.