<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<div class=Section1>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Cantor, Scott E.
[via Shibboleth] [mailto:<a href="/user/SendEmail.jtp?type=node&node=7579792&i=0" target="_top" rel="nofollow" link="external">[hidden email]</a>] <br>
<b><span style='font-weight:bold'>Sent:</span></b> Wednesday, May 30, 2012
10:35 AM<br>
<b><span style='font-weight:bold'>To:</span></b> Christine Ross<br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: Questions about using
ApplicationOverride to define all vhosts/protected sites</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>On 5/30/12 10:04 AM,
"csross" <<a href="/user/SendEmail.jtp?type=node&node=7579785&i=0"
target="_top" link="external" rel="nofollow">[hidden email]</a>> wrote: <br>
> <br>
>My shibboleth implementation <br>
> will be for multiple clients/vhosts, each using different IDPs and <br>
>different entityIDs, application_ids. Right now I am setting up the <br>
>first but I was trying to think ahead. <br>
<br>
<font color=navy><span style='color:navy'>>>></span></font>What is it
that leads you to think you need separate entityIDs for your <br>
<font color=navy><span style='color:navy'>>>></span></font>vhosts? Is
your service really more than one service, or is it just one <br>
<font color=navy><span style='color:navy'>>>></span></font>service
over and over again? If the latter, it isn't clear that you want <br>
<font color=navy><span style='color:navy'>>>></span></font>more than
one entityID. <br>
<font color=navy><span style='color:navy'>>>></span></font>Particularly
if you're going to supply dedicated metadata to each customer <br>
<font color=navy><span style='color:navy'>>>></span></font>anyway,
since that metadata could contain only that customer's endpoints. <br>
</span></font><font size=2 color=navy face=Arial><span style='font-size:10.0pt;
font-family:Arial;color:navy'>If I get another customer/site that wants to use
shib, then I will need to create a new vhost for that site. </span></font><font
color=navy><span style='color:navy'>This I am thinking will mean a different entityID?
So I was under the impression that executing <a
href="https://site2.program.com/Shibboleth.sso/Metadata" target="_top" rel="nofollow" link="external"><font
color=navy><span style='color:navy'>https://site2.program.com/Shibboleth.sso/Metadata</span></font></a>
would display the metadata for that entityID? I <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>>Since I don't want to chance revealing a customer to another, I
thought <br>
>against specifying <br>
> one customer site in the ApplicationDefaults and have a generic <br>
>ApplicationDefault. Then I would define each vhost/client with <br>
>RequestMap, ApplicationOverride and Apache. <br>
<br>
<font color=navy><span style='color:navy'>>>></span></font>You should
not be using the RequestMap for anything with Apache. <font color=navy><span
style='color:navy'><o:p></o:p></span></font></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>I was just being thorough and mentioning
another vhost in Apache and possible changes to the apache22.config. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3 color=navy
face="Times New Roman"><span style='font-size:12.0pt;color:navy'>>>></span></font>I
would also caution that the SP is not designed to hide anything like <br>
<font color=navy><span style='color:navy'>>>></span></font>this and
you should not count on customers not being able to deduce <br>
<font color=navy><span style='color:navy'>>>></span></font>things. If
you want that separation, you should deploy VMs and partition <br>
<font color=navy><span style='color:navy'>>>></span></font>everything.
I would urge you to avoid making any guarantees to anybody <br>
<font color=navy><span style='color:navy'>>>></span></font>about what
they can learn about your deployment. It's simply not designed <br>
<font color=navy><span style='color:navy'>>>></span></font>to do that.
<br>
<font size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:
Arial;color:navy'>I appreciate that. I am very very new to deploying this. <o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'><br>
>Can I put any site that is resolvable on this server as the entitiyID in <br>
>ApplicationDefaults, even if it is not 443 need protection? The site <br>
>will never be used as an application? Can I put any site as the
HomeURL <br>
>there (I thought I had read that it is where someone lands if the user is <br>
>invalid or other problems)? <br>
<br>
<font color=navy><span style='color:navy'>>>></span></font>If a
request never maps to an applicationId of "default", then the various
<br>
<font color=navy><span style='color:navy'>>>></span></font>default
properties are never used if they are overridden. In Apache terms, <br>
<font color=navy><span style='color:navy'>>>></span></font>if every
VirtualHost has a ShibRequestSetting applicationId for all <br>
<font color=navy><span style='color:navy'>>>></span></font>requests,
then all requests will be overridden. <br>
<font color=navy><span style='color:navy'>Does the </span></font>ShibRequestSetting
applicationId <font color=navy><span style='color:navy'>define the
applicationId for the vhost like it does in RequestMap?. If so, then that is
why I am using RequestMap because on this server, the <Location />
statement in the apache22.config would be the same for each vhost/entityID so I
used the RequestMap to differentiate vhosts and identify the appropriate ApplicationDefaults.
I thought about using a different apache22.config for each vhost but that
could be messy. Any suggestions?<o:p></o:p></span></font></span></font></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>>Since I specified the
MetadataProvider only <br>
> in the ApplicationOverride section for the site I am setting up, I <br>
>received a warning that "no MetadataProvider available, configuration
is <br>
>probably unusable". I don't like warnings so can I use <br>
>anyMetadataProvider entry from (ie) Testshib in the ApplicationDefaults? <br>
<br>
<font color=navy><span style='color:navy'>>>></span></font>Testshib on
a production server? Just create a dummy metadata file of some <br>
<font color=navy><span style='color:navy'>>>></span></font>sort and
load that, or pick one of the metadata sources actually used and <br>
<font color=navy><span style='color:navy'>>>></span></font>load that.
If every override has a MetadataProvider defined, then the <br>
<font color=navy><span style='color:navy'>>>></span></font>default is
never used. <br>
</span></font><font size=2 color=navy face=Arial><span style='font-size:10.0pt;
font-family:Arial;color:navy'>Thank you. Testshib was just an example. <o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'><br>
> What could be the possible problems with this please? Can I just
leave <br>
>the ApplicatinDefaults section without one and define each in the <br>
>ApplicationDefaults? <br>
<br>
It won't hurt anything, it just causes the log message. <br>
<br>
>If I can set up my sites by adding ApplicationDefaults/RequestMap <br>
>sections, do I have <br>
> to send new metadata to every client/vhost or just the new client I am <br>
>adding please? <br>
<br>
<font color=navy><span style='color:navy'>>>></span></font>I don't
know what that means, but every IdP needs appropriate metadata, <br>
<font color=navy><span style='color:navy'>>>></span></font>period. How
you do that is deployment specific. Simple scripting is <br>
<font color=navy><span style='color:navy'>>>></span></font>usually an
easy way to generate large amounts of metadata, e.g. the <br>
<font color=navy><span style='color:navy'>>>></span></font>metagen.sh
example in the etc directory. <br>
<font color=navy><span style='color:navy'>What I mean is that every time I add
a shibboleth customer (a new vhost like site2.program.com) and add a new
ApplicationOverride for that vhost with a new entityID, do I have to generate
new Metadata for every vhost or just the new one by executing </span></font><a
href="https://site2.program.com/Shibboleth.sso/Metadata" target="_top" rel="nofollow" link="external">https://site2.program.com/Shibboleth.sso/Metadata</a>?.
<font color=blue><span style='color:blue'>Do I have to send new metadata to
every IDP every time I make any change to the shibboleth2.xml?<o:p></o:p></span></font></span></font></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'><br>
>Am I correct in thinking all I have to access each sites metadata or is <br>
><a href="https://site1.program.com/Shibboleth.sso/Metadata" target="_top" link="external" rel="nofollow">https://site1.program.com/Shibboleth.sso/Metadata</a><br>
><a href="https://site2.program.com/Shibboleth.sso/Metadata" target="_top" link="external" rel="nofollow">https://site2.program.com/Shibboleth.sso/Metadata</a><br>
<font color=navy><span style='color:navy'>T</span></font>hat is not a source of
production metadata, it's for example use. <br>
<br>
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>You have two major issues: <br>
<br>
<font color=navy><span style='color:navy'>>>></span></font>why are you
using overrides at all? <font color=navy><span style='color:navy'><o:p></o:p></span></font></span></font></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=2 color=navy
face=Arial><span style='font-size:10.0pt;font-family:Arial;color:navy'>There
may be more than one customer, vhost.<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3 color=navy
face="Times New Roman"><span style='font-size:12.0pt;color:navy'>>>></span></font>don't
use the RequestMap <br>
<br>
-- Scott <br>
<br>
<font color=navy><span style='color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=2 color=navy
face=Arial><span style='font-size:10.0pt;font-family:Arial;color:navy'>Thank
you very much. I am sorry for the simplistic questions but this requirement
came up fast and I cannot find training classes for this.<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3 color=navy
face="Times New Roman"><span style='font-size:12.0pt;color:navy'>Christine</span></font><br>
-- <br>
To unsubscribe from this list send an email to <a
href="/user/SendEmail.jtp?type=node&node=7579785&i=1" target="_top" link="external" rel="nofollow">[hidden email]</a> <br>
<br>
<o:p></o:p></p>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=1 width="100%" noshade color="#cccccc" align=center>
</span></font></div>
<div>
<div>
<p class=MsoNormal><b><font size=1 color="#444444" face=Tahoma><span
style='font-size:9.0pt;font-family:Tahoma;color:#444444;font-weight:bold'>If
you reply to this email, your message will be added to the discussion below:<o:p></o:p></span></font></b></p>
</div>
<p class=MsoNormal><font size=1 color="#444444" face=Tahoma><span
style='font-size:9.0pt;font-family:Tahoma;color:#444444'><a
href="http://shibboleth.1660669.n2.nabble.com/Questions-about-using-ApplicationOverride-to-define-all-vhosts-protected-sites-tp7579648p7579785.html" target="_top" rel="nofollow" link="external">http://shibboleth.1660669.n2.nabble.com/Questions-about-using-ApplicationOverride-to-define-all-vhosts-protected-sites-tp7579648p7579785.html</a>
<o:p></o:p></span></font></p>
</div>
<div style='margin-top:4.8pt'>
<p class=MsoNormal style='line-height:18.0pt'><font size=1 color="#666666"
face=Tahoma><span style='font-size:8.5pt;font-family:Tahoma;color:#666666'>To
unsubscribe from Questions about using ApplicationOverride to define all
vhosts/protected sites, <a
href="" target="_top" rel="nofollow" link="external">click
here</a>.<br>
<a
href="http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml" target="_top" rel="nofollow" link="external"><font
size=1 face="Times New Roman"><span style='font-size:7.0pt;font-family:"Times New Roman"'>NAML</span></font></a>
<o:p></o:p></span></font></p>
</div>
</div>
<br/><hr align="left" width="300" />
View this message in context: <a href="http://shibboleth.1660669.n2.nabble.com/Questions-about-using-ApplicationOverride-to-define-all-vhosts-protected-sites-tp7579648p7579792.html">RE: Questions about using ApplicationOverride to define all vhosts/protected sites</a><br/>
Sent from the <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html">Shibboleth - Users mailing list archive</a> at Nabble.com.<br/>