Multiple domains and Shibboleth

[Klingenstein, Nate]

Chanda,


He just means that your identity layer should fit your application layer.  Shibboleth does not dictate the requirements to your application.


If your application is spread across many hosts, then you're reinventing an SSO protocol.  Just protect the services where they are if you can.  Fewer hosts is easier in my experience.


Hope this helps,

Nate.

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Chanda Banda <chandabnd727 at googlemail.com>
Sent: Thursday, November 23, 2017 8:54:18 AM
To: Shib Users
Subject: Re: Multiple domains and Shibboleth

Many thanks for your reply.

I understand that if I have abc.com<http://abc.com> and def.com<http://def.com> on Server1 and xyz.com<http://xyz.com>
on Server2 then I need to install Shibboleth on both servers and the installation
on Server1 will handle both the domains on that server.

You say "Don't invent new FQDNs to protect content on existing FQDNs.".
I presume by that you mean that i should have sb.abc.com<http://sb.abc.com> and sb.def.com<http://sb.def.com>
but not sb.some-new-domain.com<http://sb.some-new-domain.com>?

Am I right?

Thanks.

On Tue, Nov 21, 2017 at 6:32 PM, Peter Schober <peter.schober at univie.ac.at<mailto:peter.schober at univie.ac.at>> wrote:
* Chanda Banda <chandabnd727 at googlemail.com<mailto:chandabnd727 at googlemail.com>> [2017-11-21 19:26]:
> What is the best/recommended way to implement Shibboleth for my scenario?

One you haven't listed yet:

*Option5*

Make sure Shibboleth is installed on any web server that hosts content
that needs to be protected. Then enable it for all vhosts / resources
as needed.

Don't invent new FQDNs to protect content on existing FQDNs.

See also wiki.shibboleth.net/confluence/display/SHIB2/NativeSPOneMany<http://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPOneMany>

-peter
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171123/b67d6bab/attachment.html>