Use of Shibboleth IDp Multiple Websites in Windows server using application override

[Oswal, Vipul (Air MI)]

Hi Team,

Happy new year! Hope you are doing well!

I want to host 2 or more .Net sites hosted on the IIS. I am using Shibboleth IDp to connect to okta for SSO authentication. Below are the configurations I did for Shibboleth2.xml file. Also, I was able to authenticate one site1 using shibboleth to okta. Unable to authenticate site2 using application override.

Both the site are having loadbalancer and are connected using https to port 443 and 444. Can you please advise on how can we achieve?

<InProcess>
        <ISAPI normalizeRequest="true" safeHeaderNames="true">
            <Site id="9" name="site1.nike.com" scheme="https" port="443" />
                                                <Site id="8" name="site2.nike.com" scheme="https" port="444" />
        </ISAPI>
    </InProcess>
​
    <RequestMapper type="Native">
        <RequestMap>
            <Host name="site1.nike.com" applicationId="site1" authType="shibboleth" requireSession="true"/>
                <Host name="site2.nike.com"  authType="shibboleth" requireSession="true"/>
        </RequestMap>
    </RequestMapper>
​
    <ApplicationDefaults entityID=https://site2.nike.com
        REMOTE_USER="eppn subject-id pairwise-id persistent-id"
        cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
​
        <Sessions lifetime="288000" timeout="36000" relayState="ss:mem"
                  checkAddress="false" handlerSSL="false" cookieProps="https"
                  redirectLimit="none" consistentAddress="false" >
​

            <SSO entityID=http://www.okta.com/xxxxxxxxx<https://urldefense.com/v3/__http:/www.okta.com/xxxxxxxxx__;!!KLCbKzk!gDnMLGltzKHOKSMvn-zyAddVn0m_wP62QXvDj_PNAJy8cj8E1_hsnJtxSF4pIDcUMrBBSxqtZX0D-gIcYwTZ_86aGA$>>
              SAML2
            </SSO>
​
            <!-- SAML and local-only logout. -->
            <Logout>SAML2 Local</Logout>
​
            <!-- Administrative logout. -->
            <LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" />
​
            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
​
            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="false"/>
​
            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
        </Sessions>
​
        <!-- Example of locally maintained metadata. -->
        <MetadataProvider type="XML" validate="true" path="site2.xml"/>

                                <!-- Map to extract attributes from SAML assertions. -->
        <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>

        <!-- Default filtering policy for recognized attributes, lets other data pass. -->
        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
​
        <!-- Simple file-based resolvers for separate signing/encryption keys. -->
        <CredentialResolver type="File" use="signing"
            key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
        <CredentialResolver type="File" use="encryption"
            key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>

                                <ApplicationOverride id="site1" entityID=https://site1.nike.com >
​
                                                <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="true" cookieProps="https"
                  redirectLimit="exact" consistentAddress="false">
​
                                                                <SSO entityID=http://www.okta.com/yyyyyyyyyyy<https://urldefense.com/v3/__http:/www.okta.com/yyyyyyyyyyy__;!!KLCbKzk!gDnMLGltzKHOKSMvn-zyAddVn0m_wP62QXvDj_PNAJy8cj8E1_hsnJtxSF4pIDcUMrBBSxqtZX0D-gIcYwRVMFgQmg$>>
                                                                  SAML2
                                                                </SSO>
​
                                                                <!-- SAML and local-only logout. -->
                                                                <Logout>SAML2 Local</Logout>
​
                                                                <!-- Administrative logout. -->
                                                                <LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" />
​
                                                                <!-- Status reporting service. -->
                                                                <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
​
                                                                <!-- Session diagnostic service. -->
                                                                <Handler type="Session" Location="/Session" showAttributeValues="false"/>
​
                                                                <!-- JSON feed of discovery information. -->
                                                                <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
                                                </Sessions>
​
                                                <!-- Example of locally maintained metadata. -->
                                                <MetadataProvider type="XML" validate="true" path="site2.xml"/>
                                </ApplicationOverride>

    </ApplicationDefaults>

Regards,
Vipul

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230109/75ff1554/attachment.htm>