I just don't get it.<div>Why is it a bad idea to use the metadata handler?</div><div>How to you pass SP metadata to the IdP?<br><br>I do not want to create it by hand!</div><div><br></div><div>Y.<br><div class="gmail_quote">
On Tue, Sep 11, 2012 at 5:53 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
* Yannick Béot <<a href="mailto:yannick.beot@gmail.com">yannick.beot@gmail.com</a>> [2012-09-11 09:09]:<br>
<div class="im">> Before diving into this back channel, the misuse bothers me.<br>
> I have read again<br>
> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationModel" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationModel</a><br>
><br>
> "Each user session is connected to a single application"<br>
> Since I cannot share the session between the domains, I guess I'll have to<br>
> declare one application/entityID by FQDN even though it is the same<br>
> application.<br>
<br>
</div>Yet another problem. The previous hint was about how you pass metadata<br>
on to parties that rely on that. Telling them to grab it from the SP's<br>
handler isn't the recommended approach.<br>
<br>
Whether you have one or two "applications" (in Shibboleth config<br>
terms) is unrelated to the use or non-use of a common vhost or DNS<br>
domain.<br>
You can have them both as the "default" applcation and as a single<br>
EntityDescriptor in metadata (with several ACS URLs for several FQDNs)<br>
or as seperate EntityDescriptors each with their own metadata.<br>
<br>
The former approach with several ACS URLs within the same<br>
EntityDescriptor has the drawback you noted, which is that only one<br>
SLO message is being sent to the entity, which won't be sufficient<br>
to terminate the other domain's session over the front channel.<br>
<br>
If they're different SPs to the IDP (seperate EntityDescriptors each<br>
with their own metadata) the IdP would need to send two SLO messages,<br>
one for each logical SP.<br>
<span class="HOEnZb"><font color="#888888">-peter<br>
</font></span><div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>