<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Raja,</div><div><br></div><div>The metadata that you uploaded to TestShib probably doesn't have endpoints listed for the domain <a href="http://test.mydomain.net">test.mydomain.net</a>. You'll need to ensure that there are AssertionConsumerService URL's for both hosts.</div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP">https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP</a></div><div><br></div><div>Thanks,</div><div>Nate.</div><div><br><div><div>On 31 Oct 2012, at 23:08, "Raz's" <<a href="mailto:gajula.rajashekhar@gmail.com">gajula.rajashekhar@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi Nate,<br><div class="gmail_extra"><div><br></div><div>When i configured SP as follows </div><div><br></div><div><div> <Site id="1" name="<a href="http://sp.mydomain.net/">sp.mydomain.net</a>"></div>
<div> <span class="" style="white-space:pre"> </span><Alias><a href="http://dev.mydomain.net/">dev.mydomain.net</a></Alias></div><div> <span class="" style="white-space:pre"> </span><Alias><a href="http://test.mydomain.net/">test.mydomain.net</a></Alias></div>
</div><div> </Site></div><div><br></div><div><div> <RequestMapper type="Native"></div><div> <RequestMap applicationId="default"></div><div> <Host name="<a href="http://dev.mydomain.net/">dev.mydomain.net</a>"><br>
</div><div> <Path name="protected" authType="shibboleth" requireSession="true"/></div><div> </Host></div><div> <Host name="<a href="http://test.mydomain.net/">test.mydomain.net</a>" entityID="<a href="https://idp.testshib.org/idp/shibboleth">https://idp.testshib.org/idp/shibboleth</a>"></div>
<div> <Path name="protected" authType="shibboleth" requireSession="true"/></div><div> </Host></div><div> </RequestMap><br></div><div> </RequestMapper></div>
</div><div><br></div><div><div> <ApplicationDefaults entityID="<a href="https://dev.mydomain.net/shibboleth">https://dev.mydomain.net/shibboleth</a>" REMOTE_USER="eppn"></div><div><br></div>
<div> <Sessions lifetime="28800" timeout="3600" checkAddress="true" consistentAddress="true" relayState="ss:mem" handlerSSL="false"><br></div><div>
<SSO entityID="<a href="https://idp.testshib.org/idp/shibboleth">https://idp.testshib.org/idp/shibboleth</a>"><br>
</div><div> SAML2 SAML1</div><div> </SSO></div><div><br></div><div> <Logout>SAML2 Local</Logout><br></div><div><br></div><div> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br>
</div><div> <Handler type="Status" Location="/Status" acl="127.0.0.1"/><br></div><div> <Handler type="Session" Location="/Session" showAttributeValues="true"/><br>
</div><div> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br></div><div><br></div><div> </Sessions></div><div><br></div><div> <Errors supportContact="root@localhost" logoLocation="/shibboleth-sp/logo.jpg" styleSheet="/shibboleth-sp/main.css"/></div>
<div><br></div><div> <MetadataProvider type="XML" uri="<a href="http://www.testshib.org/metadata/testshib-providers.xml">http://www.testshib.org/metadata/testshib-providers.xml</a>"<br></div>
<div> backingFilePath="testshib-two-idp-metadata.xml" reloadInterval="180000" /></div><div><br></div><div> <AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/><br>
</div><div> <AttributeResolver type="Query" subjectMatch="true"/></div><div> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/></div>
<div><br></div><div> <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/><br></div></div><div><div><br></div><div> </ApplicationDefaults> </div>
</div><div><br></div><div>then i'm getting the error like <strong style="font-family: 'Times New Roman'; font-size: medium; ">Error Message: No peer endpoint available to which to send SAML response</strong><br>
</div><div><font face="Times New Roman" size="3">while access the <a href="http://test.mydomain.net/">test.mydomain.net</a> but it's working fine with <a href="http://dev.mydomain.net/">dev.mydomain.net</a></font></div>
<div><font face="Times New Roman" size="3"><br></font></div><div><font face="Times New Roman" size="3">Here <a href="http://test.mydomain.net/">test.mydomain.net</a> IDP & sessions, handlers etc different from the dev.</font></div>
<div><font face="Times New Roman" size="3"><br></font></div><div><font face="Times New Roman" size="3">-Raja</font></div><div><font face="Times New Roman" size="3"><br></font></div>
On Wed, Oct 31, 2012 at 12:30 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="im">><br>
>Please help me out in the process of SAML SP implementation for sub<br>
>domains. This implementation little bit tricky here single application<br>
>providing the solutions or our clients using the sub domains so each sub<br>
>domain indicates the individual client and<br>
> also each client had the his own idp and sp but we want to integrate<br>
>their idp into our sp at the same it has to redirect the request to<br>
>respected sub domains (clients) idp. Here Session of each and every sub<br>
>domain (client) should be vary based on the sub<br>
> domain(client) idp.<br>
<br>
</div>I answered this in the original thread you raised it in. If you want to<br>
specify the IdP based on the vhost, you add an entityID property naming<br>
the IdP in the RequestMap in a <Host> element for the given vhost. That's<br>
it. You don't need overrides.<br>
<br></blockquote><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
If you need to add restrictions to limit which IdP's users are able to<br>
access the vhosts, then there are various ways to achieve that, or it can<br>
be done entirely inside the application. Again, you don't need overrides<br>
for that.<br>
<span class=""><font color="#888888"><br>
-- Scott<br>
</font></span><div class=""><div class="h5"><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>
--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></blockquote></div><br></div></body></html>