FW: 2 Shibboleth SP’s with 2 different entity IDs but same AssertionConsumerService(ACS) URL

[Muthukumar Manohar, Emily (ELS-CON)]

Hi Team,

A very good day to you.
We have a business requirement where we need to have 2 Shibboleth SP’s with 2 different entity IDs but same AssertionConsumerService(ACS) URL and both SPs will be running on the same server.

As the shibboleth documentation says the “The location of the ACS is a relative path that will be combined with the base handlerURL”. Hence I have the same handler URL for both old SP and new SP.
I have the following configuration in my shibboleth2.xml
<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config" xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" clockSkew="600" logger="syslog.logger">

   <RequestMapper type="Native">
      <RequestMap applicationId="default">
         <Host applicationId="default" name="sample-oldshibauth-np.test.com" requireSession="true" scheme="http">
            <Path authType="shibboleth" exportAssertion="true" name="hbeat" requireSession="false"/>
            <Path authType="shibboleth" exportAssertion="true" name="ShibAuth" requireSession="false"/>
        </Host>
        <Host applicationId="default" name=" sample-oldshibauth-np.test.com " requireSession="true" scheme="https">
            <Path authType="shibboleth" exportAssertion="true" name="hbeat" requireSession="false"/>
            <Path authType="shibboleth" exportAssertion="true" name="ShibAuth" requireSession="false"/>
        </Host>
         <Host applicationId="new_shib" name=" sample-newshibauth-np.test.com " requireSession="true" scheme="http">
            <Path authType="shibboleth" exportAssertion="true" name="hbeat" requireSession="false"/>
            <Path authType="shibboleth" exportAssertion="true" name="ShibAuth" requireSession="false"/>
         </Host>
         <Host applicationId="new_shib" name=" sample-newshibauth-np.test.com " requireSession="true" scheme="https">
            <Path authType="shibboleth" exportAssertion="true" name="hbeat" requireSession="false"/>
            <Path authType="shibboleth" exportAssertion="true" name="ShibAuth" requireSession="false"/>
         </Host>
      </RequestMap>
   </RequestMapper>

 <ApplicationDefaults attributePrefix="ELS_" connectTimeout="11" encryption="false" entityID="https://auth.oldshib.com/" homeURL="https://sample-oldshibauth-np.test.com/ShibAuth/deliverCred" id="default" policyId="default" timeout="20">
      <Sessions checkAddress="false" exportLocation="/GetAssertion" handlerSSL="false" handlerURL="https://sample-oldshibauth-np.test.com/SHIRE" lifetime="28800" redirectLimit="host" relayState="cookie" timeout="3600">
         <SSO discoveryProtocol="SAMLDS">
               SAML2 SAML1
            </SSO>
         <SessionInitiator Location="/Login1" acsIndex="100" id="Login1" isDefault="true" outgoingBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" type="Chaining">
            <SessionInitiator template="bindingTemplate.html" type="SAML2"/>
         </SessionInitiator>
         <SessionInitiator Location="/Login100" isDefault="true" outgoingBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" type="SAML2"/>
         <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="/SAML2/POST" index="1"/>
         <LogoutInitiator Location="/Logout" type="Chaining">
            <LogoutInitiator template="bindingTemplate.html" type="SAML2"/>
            <LogoutInitiator type="Local"/>
         </LogoutInitiator>
         <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="/SLO/SOAP"/>
        <Handler Location="/Metadata" signing="false" type="MetadataGenerator"/>
      </Sessions>
      <ApplicationOverride attributePrefix="ELS_" connectTimeout="11" encryption="false" entityID=" https://auth.newshib.com/" homeURL=" https://sample-oldshibauth-np.test.com/ShibAuth/deliverCred" policyId="default" timeout="20" id="new_shib">
         <Sessions checkAddress="false handlerURL=" https://sample-oldshibauth-np.test.com/SHIRE " handlerSSL="true" lifetime="58800" redirectLimit="host" relayState="cookie" timeout="3600">
            <SSO discoveryProtocol="SAMLDS">
               SAML2 SAML1
            </SSO>
            <SessionInitiator Location="/Login1" entityID="https://idp-2.infra.test.com/idp/shibboleth" acsIndex="100" id="Login1" isDefault="true" outgoingBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" type="Chaining">
               <SessionInitiator template="bindingTemplate.html" type="SAML2"/>
            </SessionInitiator>
            <SessionInitiator Location="/Login100" isDefault="true" outgoingBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" type="SAML2"/>
            <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="/SAML2/POST" index="1"/>
            <LogoutInitiator Location="/Logout" type="Chaining">
               <LogoutInitiator template="bindingTemplate.html" type="SAML2"/>
               <LogoutInitiator type="Local"/>
            </LogoutInitiator>
            <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="/SLO/SOAP"/>
         </Sessions>
      </ApplicationOverride>
   </ApplicationDefaults>
</SPConfig>


Is the above configuration correct? Can I have same handler URL for both SPs? Or is there any other ideal way to achieve my business requirement of having 2 SPs with different entity ID but same ACS URL? With the above config in shibboleth2.xml, when I try to authenticate via old SP, my idp is rejecting the request with status 403.


Thanks,
Emily Sherline M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250305/2ac03840/attachment.htm>