Shibboleth sp Apache - Artifact profile or POST profile depending on idp

cneberg cneberg at gmail.com
Thu May 8 04:09:08 UTC 2025


I'm migrating from one idp to another (Azure) on an Apache webserver
behind a shibboleth sp. The website has multiple virtual sites on
different host names each with its own entity id.    For the old IDP
the artifact profile was always used, but for the new one can only use
the POST profile.  I'm moving sites one entity id at a time by
specifying ShibRequestSetting enityIDSelf per virtual host.  The issue
comes up that if I change protocols.xml to prefer artifact profile  it
fails on the new one.   I assumed it would just check the idp metadata
and used the supported protocol instead it gives the message below.

WARN Shibboleth.SessionInitiator.SAML2 [3] [default]: artifact binding
selected for response, but identity provider lacks support

INFO Shibboleth.SessionInitiator.Shib1 [3] [default]: unable to locate
Shibboleth-aware identity provider role for provider

Ideas? I have a couple of other related questions I'll put into
different threads.

Thanks,
Christopher


More information about the users mailing list