Shibboleth SP for multiple domains

[Peter Schober]

* vadud3 at gmail.com <vadud3 at gmail.com> [2021-07-09 16:56]:
> I compared the metadata of
> https://server.example.org/Shibboleth.sso/Metadata with
> https://node1.example.org/Shibboleth.sso/Metadata and they both have the
> same
> entityID https://server.example.org.
> 
> However, the Location for server.example.org is https://server.example.org
> and for node1.example.org is https://node1.example.org
> 
> Does that make sense of the same entityID for both? I can then send the
> metadata from node1 to the IdP admin team.

If you have decided that both servers/vhosts/whetever are in fact one
thing (or rather, do not need to be told apart by any IDPs for local
policy decisions) -- see item 3 from my earlier reply -- you can give
them both the same entityID (and also key pair), no problem.

But there the software on either server doesn't know that there's the
other side so none of the tools on either side will give you the
complete metadata automatically. I.e., you'd have to assemle the
metadata to give to the IDP:
* One entityID (same on both servers)
* One keypair (same on both servers)
* The relevant ACS URL (HTTP-POST at least) *for* *each* server/host,
  with a unique index XML attribute (index="0" for one, index="1" for
  the other, for example).

I.e.:

1. Make the key pair used for SAML the same on both servers.
2. Generate metadata for one of the servers
3. Amend that metadata by hand with the ACS URL for the other server/s
4. Provide amended metadata to the IDP to use.

-peter