about Audience policy

[Cantor, Scott]

On 6/29/18, 12:51 PM, "users on behalf of Paolo Veronesi" <users-bounces at shibboleth.net on behalf of paolo.veronesi at cup2000.it> wrote:

> As far as i understand, i need to modify security-policy.xml for the application id="pippo" in order to accept both
> https://www.fake_pippo.org/shibboleth and
> https://www2.fake_pippo.org/shibboleth as Audience, but it is not clear to me how.

No. You should in order of preference:

* stop using overrides
* not make them path-based and use vhosts

Failing that, you are in for a lot of hassle, and need to read the documentation on path-based overrides [1] that discusses the issue of overriding the handlers and the need for a full <Sessions> element with a handlerURL, modifications to metadata, etc.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride