Shibboleth sp Apache - Artifact profile or POST profile depending on idp
cneberg
cneberg at gmail.com
Thu May 8 04:09:08 UTC 2025
I'm migrating from one idp to another (Azure) on an Apache webserver
behind a shibboleth sp. The website has multiple virtual sites on
different host names each with its own entity id. For the old IDP
the artifact profile was always used, but for the new one can only use
the POST profile. I'm moving sites one entity id at a time by
specifying ShibRequestSetting enityIDSelf per virtual host. The issue
comes up that if I change protocols.xml to prefer artifact profile it
fails on the new one. I assumed it would just check the idp metadata
and used the supported protocol instead it gives the message below.
WARN Shibboleth.SessionInitiator.SAML2 [3] [default]: artifact binding
selected for response, but identity provider lacks support
INFO Shibboleth.SessionInitiator.Shib1 [3] [default]: unable to locate
Shibboleth-aware identity provider role for provider
Ideas? I have a couple of other related questions I'll put into
different threads.
Thanks,
Christopher
More information about the users
mailing list