SP setup for multiple IDPs

[Herron, Joel D]

So attempted to just add it to the Override and I’m getting what I believe is an odd error.

Note: This was originally a v2 SP and was upgraded with zero changes outside the required ones and it's Windows and IIS so all the best combinations.

ERROR XMLTooling.ParserPool : error on line 109, column 31, message: element 'Sessions' is not allowed for content model

Reading the docs it says Sessions is a valid child element to <ApplicationOveride> and I understand that the default attributes are mostly ignored, so I duplicated what was there. I’m assuming something else is blocking this configuration.


<ApplicationOverride id="APPNAME"   entityID=https://APPNAME.uww.edu/shibboleth>
      <Sessions lifetime="40000" timeout="7200" relayState="ss:mem" checkAddress="false" handlerSSL="true" cookieProps="https">
            <SSO entityID=”######.okta.com/IDPID”>
                SAML2
            </SSO>
    </Sessions>
</ApplicationOveride>



--Joel


From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott via users <users at shibboleth.net>
Date: Monday, May 15, 2023 at 1:50 PM
To: Shib Users <users at shibboleth.net>
Cc: Cantor, Scott <cantor.2 at osu.edu>
Subject: Re: SP setup for multiple IDPs
*EXTERNAL EMAIL*

> What is the recommended way to handle this type setup?

If there wasn't a URL difference between the applications, then there couldn't have been any overrides (at least none being used) and it was just broken to begin with, or at least full of unused settings.

I wouldn't use overrides but if it's there and working, then the only change required to migrate one of them to a different IdP is to...change the setting. That's it. If you're trying to get rid of the overrides then the entityID setting has to move over into the RequestMap in the same places the original overridden applicationId was set. That's why overrides are almost always unneeded now.

If instead you have a situation where one URL has to allow for 2 IdPs or 20, that's discovery. There is nothing that can be done except discovery (or moving to IdP-initiated SSO).

-- Scott


--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230531/95c4dc1e/attachment.htm>