Hello,<br><br>I have one IdP and three SPs on different hosts. <br><br><a href="http://idp.example.com">idp.example.com</a><br><a href="http://sp1.example.com">sp1.example.com</a><br><a href="http://sp2.example.com">sp2.example.com</a><br>
<a href="http://sp3.example.com">sp3.example.com</a><br><br>The three SPs are setup and the applications on them are properly protected with Shib and redirect to the IdP for authentication as expected.<br><br>I would like to login to an application on sp1, and automatically be authenticated when I login to the applications on the others - so the authentication and attributes span across the domain. This was working with an OpenAM IdP using a federation, but I have been unable to replicate this with a Shib IdP. After authenticating by accessing an application on an SP, accessing an application on a different SP redirects to the IdP for login; for lazy sessions it does nothing. It doesn't recognize the Shib session authentication and attributes from the login via the other SP.<br>
<br>Creating a federation following the directions here: <br><br><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/BuildAFederation">https://wiki.shibboleth.net/confluence/display/SHIB2/BuildAFederation</a><br>
<br>resulted in no change of behavior. So, each of the SPs use the federation metadata. As far as I could tell from the directions, there was no change required on the IdP for the federation.<br><br>Here are the things I tried:<br>
<br>* Even though I didn't see any specific changes required for the IdP in a federation, I changed the relying party metadata to use the federation metadata only. But this seemed to work the same as specifying the metadata for each provider separately.<br>
<br>* In shibboleth2.xml, added a domain name to cookieProps in order be sure the cookie is shared across the domain, ie,<br><br> <Sessions lifetime="28800"<br> timeout="3600"<br> checkAddress="false"<br>
handlerURL="/Shibboleth.sso"<br> handlerSSL="true"<br> cookieProps="; domain=<a href="http://example.com">example.com</a>; path=/; secure"<br> exportLocation="<a href="http://localhost/Shibboleth.sso/GetAssertion">http://localhost/Shibboleth.sso/GetAssertion</a>"<br>
idpHistory="false"<br> idpHistoryDays="7"><br><br>* All attributes are allowed to pass as specified in attribute-policy.xml by each SP<br><br>* Disabled the security rule for testing, ie,<br>
<SecurityPolicies><br> <Policy id="default" validate="false"><br> <PolicyRule type="NullSecurity"/><br> </Policy><br> </SecurityPolicies><br>
<br><br>I have a php script that dumps the server variable and is protected by Shib. If I visit the script on an SP after logging into an application on a different SP, the cookies _saml_idp and shibsession_* are present. The shib headers are present but empty. No attributes are listed. Going to sp2/Shibboleth.sso/Session says there is not valid session. I am using tomcat (mod_jk).<br>
<br>Is there something that I'm missing for SPs sharing authentication and attributes across a domain? Any suggestion for me to try?<br><br>Any help would be much appreciated.<br><br>Thanks and have a nice day!<br><br>
Charity<br><br><br><br><br> <br><br><br><div style="visibility: hidden; left: -5000px; position: absolute; z-index: 9999; padding: 0px; margin-left: 0px; margin-top: 0px; overflow: hidden; word-wrap: break-word; color: black; font-size: 10px; text-align: left; line-height: 130%;" id="avg_ls_inline_popup">
</div>