Before diving into this back channel, the misuse bothers me.<div>I have read again
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationModel">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationModel</a> </div><div><br></div><div><span style="color:rgb(51,51,51);font-family:Arial,Helvetica,FreeSans,sans-serif;font-size:13px;font-style:italic;line-height:17.33333396911621px;background-color:rgb(255,255,255)">"Each user session is connected to a single application"</span></div>
Since I cannot share the session between the domains, I guess I'll have to declare one application/entityID by FQDN even though it is the same application.<div><br></div><div><div>It will resolve my logout problems.</div>
<div><br></div><div><br></div><div>Yannick<br><div><br><br><div class="gmail_quote">On Tue, Sep 11, 2012 at 1:59 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 9/10/12 3:38 PM, "Yannick Béot" <<a href="mailto:yannick.beot@gmail.com">yannick.beot@gmail.com</a>> wrote:<br>
><br>
>In order to make it works, I have modified the metadata part in my<br>
>shibboleth2.xml:<br>
> <Handler type="MetadataGenerator" Location="/Metadata.xml"<br>
>signing="false"><br>
><br>
><EndpointBase><a href="https://www.domain.com/Shibboleth.sso" target="_blank">https://www.domain.com/Shibboleth.sso</a></EndpointBase><br>
><br>
><EndpointBase><a href="https://www.domain.org/Shibboleth.sso" target="_blank">https://www.domain.org/Shibboleth.sso</a></EndpointBase><br>
> </Handler><br>
<br>
</div>That has nothing to do with making it work. Nothing should ever read that<br>
metadata directly or be dependent on it. That is for testing and example<br>
use only. You have no capability for key rollover if you tie your<br>
configuration directly to the metadata you give to peers.<br>
<br>
This has nothing to do with your question, but I don't see how else to<br>
convince people this is wrong but to continually point it out in every<br>
thread where I see a misuse of the feature.<br>
<div class="im"><br>
>Is there a way to make this configuration, 2 domains/1 entityID, works?<br>
<br>
</div>Not over the front channel, no. Back channel it should work.<br>
<div class="im"><br>
>Is there a way that Shibboleth destroys the corresponding session of the<br>
>LogoutRequest, session pointed out by a random Id and a principal,<br>
>wihtout throwing an error?<br>
<br>
</div>Yes, with a back channel logout, it works like that. I did not have time<br>
to work on enhancing the front channel to support it.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div></div></div>