Multiple domains and Shibboleth

[Peter Schober]

* Chanda Banda <chandabnd727 at googlemail.com> [2017-11-23 17:55]:
> I understand that if I have abc.com and def.com on Server1 and xyz.com
> on Server2 then I need to install Shibboleth on both servers and the
> installation on Server1 will handle both the domains on that server.

Adding Shibboleth to the webserver doesn'r change what server handles
requests, so yes: Only Server1 will continue to handle abc.com and
def.com and will be able to protect resources on those vhosts with
SAML. Likewise Server2 will continue to handle what requests for
xyz.com and it will be able to protect resources on this vhost with
SAML2.

Which is why I said you don't need to invent new vhosts or FQDNs for
Shibboleth, you already have those for your resources.

> You say "*Don't invent new FQDNs to protect content on existing FQDNs.*".
> I presume by that you mean that i should have sb.abc.com and sb.def.com
> but not sb.some-new-domain.com?
> 
> Am I right?

No. If your resource is at "abc.com" then Shibboleth also is at
"abc.com". Adding a new vhost "sb.abc.com" is precicely "inventing a
new FQDN" I don't you to avoid. So don't do that.

The Shib SP lives on your webserver. It provides its own content
handler at (by default) /Shibboleth.sso so it will not intervene with
requests to your resources. (Either way you'd need to take care that
this is the case, e.g. by preventing the SP's handler to be proxied or
otherwise processes by other software.)

There is simply no need to add any new vhosts or FQDNs or servers
otherwise the documentation would tell you do to so.
Now I'm going one step further and tell you to NOT add those.

HTH,
-peter