Shibboleth SP for multiple domains

[vadud3 at gmail.com]

On Fri, Jul 9, 2021 at 11:57 AM Peter Schober <peter.schober at univie.ac.at>
wrote:

> * vadud3 at gmail.com <vadud3 at gmail.com> [2021-07-09 16:56]:
> > I compared the metadata of
> > https://server.example.org/Shibboleth.sso/Metadata with
> > https://node1.example.org/Shibboleth.sso/Metadata and they both have the
> > same
> > entityID https://server.example.org.
> >
> > However, the Location for server.example.org is
> https://server.example.org
> > and for node1.example.org is https://node1.example.org
> >
> > Does that make sense of the same entityID for both? I can then send the
> > metadata from node1 to the IdP admin team.
>
> If you have decided that both servers/vhosts/whetever are in fact one
> thing (or rather, do not need to be told apart by any IDPs for local
> policy decisions) -- see item 3 from my earlier reply -- you can give
> them both the same entityID (and also key pair), no problem.
>
> But there the software on either server doesn't know that there's the
> other side so none of the tools on either side will give you the
> complete metadata automatically. I.e., you'd have to assemle the
> metadata to give to the IDP:
> * One entityID (same on both servers)
> * One keypair (same on both servers)
> * The relevant ACS URL (HTTP-POST at least) *for* *each* server/host,
>   with a unique index XML attribute (index="0" for one, index="1" for
>   the other, for example).
>
> I.e.:
>
> 1. Make the key pair used for SAML the same on both servers.
> 2. Generate metadata for one of the servers
> 3. Amend that metadata by hand with the ACS URL for the other server/s
> 4. Provide amended metadata to the IDP to use.
>
>
EntityNaming under CONCEPTS space aligns with your suggestion of being a
unique entity.
I will modify the enitityID for the node1 vhost and send it over to IDP.

Thanks a lot!
Asif




> -peter
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>


-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210709/26f7b25b/attachment.htm>