SP 3 and reverseProxy

[Peter Schober]

* Pascal Rigaux <Pascal.Rigaux at univ-paris1.fr> [2018-10-30 08:42]:
> A way to save the burden of registration is to use the same vhost
> and host each applications in a specific path. But usually doing so
> is harder than the burden of registration...

The "burden" you speak of is adding a *single* line with a new ACS URL
to the metadata on record at the IDP, for each new vhost. That's not a
real burden unless you'll be adding vhosts on an hourly bases, IMO.

And as I said twice already, you don't have to do even that (i.e., no
"burden" at all) if the SP is set to sign its authn requests and you
configure the IDP to accept the requested ACS URL from signed requests
even when there's no matching ACS URL in the metadata on record at the
IDP.
So if you're only concerned with a single IDP, and SLO isn't a must,
then you merely configure the SP and IDP accordingly and there is no
additional work for new vhosts at the IDP (nor at the SP) as far as
SAML and Shibboleth is concerned!

It doesn't get easier than this.

> A more complex way is to use a specific domain or subdomains

None of which you need by doing the above.

-peter