Shibboleth SP for multiple domains

Wed Jul 14 14:56:31 UTC 2021

On Fri, Jul 9, 2021 at 1:45 PM <vadud3 at gmail.com> wrote:

>
>
> On Fri, Jul 9, 2021 at 11:57 AM Peter Schober <peter.schober at univie.ac.at>
> wrote:
>
>> * vadud3 at gmail.com <vadud3 at gmail.com> [2021-07-09 16:56]:
>> > I compared the metadata of
>> > https://server.example.org/Shibboleth.sso/Metadata with
>> > https://node1.example.org/Shibboleth.sso/Metadata and they both have
>> the
>> > same
>> > entityID https://server.example.org.
>> >
>> > However, the Location for server.example.org is
>> https://server.example.org
>> > and for node1.example.org is https://node1.example.org
>> >
>> > Does that make sense of the same entityID for both? I can then send the
>> > metadata from node1 to the IdP admin team.
>>
>> If you have decided that both servers/vhosts/whetever are in fact one
>> thing (or rather, do not need to be told apart by any IDPs for local
>> policy decisions) -- see item 3 from my earlier reply -- you can give
>> them both the same entityID (and also key pair), no problem.
>>
>> But there the software on either server doesn't know that there's the
>> other side so none of the tools on either side will give you the
>> complete metadata automatically. I.e., you'd have to assemle the
>> metadata to give to the IDP:
>> * One entityID (same on both servers)
>> * One keypair (same on both servers)
>> * The relevant ACS URL (HTTP-POST at least) *for* *each* server/host,
>>   with a unique index XML attribute (index="0" for one, index="1" for
>>   the other, for example).
>>
>> I.e.:
>>
>> 1. Make the key pair used for SAML the same on both servers.
>> 2. Generate metadata for one of the servers
>> 3. Amend that metadata by hand with the ACS URL for the other server/s
>> 4. Provide amended metadata to the IDP to use.
>>
>>
> EntityNaming under CONCEPTS space aligns with your suggestion of being a
> unique entity.
> I will modify the enitityID for the node1 vhost and send it over to IDP.
>
> Thanks a lot!
> Asif
>
>
>
>
>> -peter
>> --
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.ne <users-unsubscribe at shibboleth.net>t
>
>
When I try to login to node1.server.com, it redirects me to login page of
server.example.com. Here are the steps. Not sure how to troubleshoot this.

I first try to login to node1 page

https://node1.example.org/jira

It takes me to signon page

https://server.example.org/shibboleth-ds/index.html?entityID=https://node1.example.org&return=https://node1.example.org/Shibboleth.sso/Login?SAMLDS=1&target=ss:mem:f751c18ac676b4941f08555d8e5fbfcab3c36b9092417f1c8ffd29f3

I click on signon button which links to below

https://server.example.org/Shibboleth.sso/Login?SAMLDS=1&target=ss:mem:f751c18ac676b4941f08555d8e5fbfcab3c36b9092417f1c8ffd29f3&entityID=http://ssotest.example.org/adfs/services/trust

On the chrome Network console I see the samlrequest

https://ssotest.example.org/adfs/ls/?SAMLRequest=....&RelayState=ss:mem:f751c18ac676b4941f08555d8e5fbfcab3c36b9092417f1c8ffd29f3&SigAlg=http://www.w3.org/2001/04/xmldsig-more#rsa-sha256&Signature=f3esrxiTFWYxo2KDSsNBdXAADsQ/YBhohzY8z6x3PTtETpc7gl0VviXNwAEpcLp7LitGfd82nqiNU32E/nUWVnO37fJGyuUFnaAIhQcXeGxI6nGTy+HWiCouuVDgdMXrzvf/M5K7rS3cw1tbOoGPAeiEUv8xh5aR1v6c0XjUTno9ZC2ERo7OtEhPA6F/sCdK4e0eGnx0RCop2PLdVdeprPk25gczGjBwhKxsx3wxFeqRU/OqMepmFLB3SBqXXRaEy1ekyE0Hqb9axYhdJqn85j9Dl3eOpkKwabZdjDF010GYy4p2vJo3qzu+RB+N8NL75XXbWn3Q==

SAMLRequest is

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
> AssertionConsumerServiceURL="
> https://server.example.org/Shibboleth.sso/SAML2/POST"
> Destination="https://ssotest.example.org/adfs/ls/"
> ID="_dafedbb9424fd98c192d040ba9833"
> IssueInstant="2021-07-14T14:11:00Z"
> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
> Version="2.0">
> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
> https://server.example.org
> </saml:Issuer>
> <samlp:NameIDPolicy AllowCreate="1"/>

</samlp:AuthnRequest>

Then takes me back to the login page of the server. So login to node1 never
worked. The next three steps on Network console are

GET https://ssotest.example.org/favicon.ico
> POST https://server.example.org/Shibboleth.sso/SAML2/POST
> GET https://server.example.org/

I am kind of lost. Any suggestion on what is going on and how to
troubleshoot this?

Thanks,
Asif

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210714/d99dd6f8/attachment.htm>