problems with multiple IP adresses for SP? Aliases?

[Dr. Marco Lechner]

Hi list,

as a shibboleth newby I have two questions that come up when trying to
set our shibboleth installation into productive state:

1. are there any known problems known when the SP is resolved into two
IP adresses (on the same machine using <VirtualHost 10.0.0.11:443
10.0.0.12:443>) we are facing several errors from the SP on some
requests while loading the page (seems to be always if the first IP
adress is used):
- opensaml::SecurityPolicyException (Rejecting replayed message ID
(_xxxxxxxx))
- opensaml::FatalProfileException (A valid authentication statement was
not found in the incoming message)
The AFAIK similar configuration works without problems in the slightly
simpler Testenvironment.
The more realistic reason might be a configuration error on our side -
but we can not find any misconfiguration.

2. Is it possible (any hint to the Wiki or Doku) to use ServerAlias
names for the SP? Well, our application shold be available using
different URLs/Servernames (foo.bfs.de as well as bar.bfs.de ...) -
anybody who can point me to a configuration example. shibboleth2.xml has
onl one entityID entry). Will SSO still work when changing from one
Servernam eto the other?

Thanks for help in advance

Marco Lechner


-- 
Dr. Marco Lechner
Bundesamt fuer Strahlenschutz / Federal Office for Radiation Protection
SW2.1 Koordination Notfallschutzsysteme / Coordination Emergency Systems
Rosastrasse 9 | D-79098 Freiburg | Germany
mlechner at bfs.de | +49 (0)3018 333 6724 | www.bfs.de

-- 
Hinweis zu Anhängen die auf .p7m/.p7c/.p7s oder .asc/.asc.sig enden:
Die .p7?- und .asc-Dateien sind ungefährliche Signaturdateien (digitale
Unterschriften).
In E-Mail-Clients mit S/MIME Konfiguration (.p7?) oder PGP-Erweiterung
(.asc) dienen sie zur:
- - Überprüfung des Absenders
- - Überprüfung einer evtl. Veränderung des Inhalts während der
Übermittlung über das Internet
Die Signaturdateien können ebenso dazu verwendet werden dem Absender
dieser Signatur eine E-Mail mit verschlüsseltem Inhalt zu senden.

In E-Mail-Clients ohne S/MIME Konfiguration oder PGP-Erweiterung
erscheinen die Dateien als Anhang und können ignoriert werden.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0xD733400E.asc
Type: application/pgp-keys
Size: 3108 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20170411/56b8dd71/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5099 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170411/56b8dd71/attachment.p7s>