Multiple domains and Shibboleth

[Chanda Banda]

OK thanks for that. Please bear with me. (Im a fresh Uni grad and most of
this is currently beyond me).

So I dont need any new domains/subdomain, OK cool.

So I have installed Shibboleth on the server that hosts abc.com and I can
navigate to
https://localhost/Shibboleth.sso/Status fine.

What are the next steps??? Ive read I need to update shibboleth2.xml and
modify the "Site" nodes but what
goes in here:

name="sp.example.org"

Im trying to set up an SP so that other institutions can access our systems
using their
existing logins.

Thanks.

On Fri, Nov 24, 2017 at 10:14 AM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Chanda Banda <chandabnd727 at googlemail.com> [2017-11-23 17:55]:
> > I understand that if I have abc.com and def.com on Server1 and xyz.com
> > on Server2 then I need to install Shibboleth on both servers and the
> > installation on Server1 will handle both the domains on that server.
>
> Adding Shibboleth to the webserver doesn'r change what server handles
> requests, so yes: Only Server1 will continue to handle abc.com and
> def.com and will be able to protect resources on those vhosts with
> SAML. Likewise Server2 will continue to handle what requests for
> xyz.com and it will be able to protect resources on this vhost with
> SAML2.
>
> Which is why I said you don't need to invent new vhosts or FQDNs for
> Shibboleth, you already have those for your resources.
>
> > You say "*Don't invent new FQDNs to protect content on existing FQDNs.*".
> > I presume by that you mean that i should have sb.abc.com and sb.def.com
> > but not sb.some-new-domain.com?
> >
> > Am I right?
>
> No. If your resource is at "abc.com" then Shibboleth also is at
> "abc.com". Adding a new vhost "sb.abc.com" is precicely "inventing a
> new FQDN" I don't you to avoid. So don't do that.
>
> The Shib SP lives on your webserver. It provides its own content
> handler at (by default) /Shibboleth.sso so it will not intervene with
> requests to your resources. (Either way you'd need to take care that
> this is the case, e.g. by preventing the SP's handler to be proxied or
> otherwise processes by other software.)
>
> There is simply no need to add any new vhosts or FQDNs or servers
> otherwise the documentation would tell you do to so.
> Now I'm going one step further and tell you to NOT add those.
>
> HTH,
> -peter
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171126/7cfee871/attachment.html>