<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Raja,<div><br></div><div>You need both domains listed.</div><div><br></div><div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML2/POST">http://test.mydomain.net/Shibboleth.sso/SAML2/POST</a>" index="0"/></div><div><div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="http://dev.mydomain.net/Shibboleth.sso/SAML2/POST">http://dev.mydomain.net/Shibboleth.sso/SAML2/POST</a>" index="6"/></div></div><div><br></div><div>Thanks,</div><div>Nate.</div><div><br><div><div>On 1 Nov 2012, at 00:10, "Raz's" <<a href="mailto:gajula.rajashekhar@gmail.com">gajula.rajashekhar@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Thanks a lot Nate,<div><br></div><div>End points nothing but AssertionConsumerService correct, They are present in my metadata which was uploaded to the <a href="http://testshib.org/">testshib.org</a> IDP, one more thing if i interchange the places for dev and test then test will work and dev will not works (now <a href="http://dev.mydomain.net/">dev.mydomain.net</a> will gets the error message like previous)</div>
<div><br></div><div>Here the exact metadata of <a href="http://test.mydomain.net/">Test.Mydomain.net</a>.</div><div><br></div><div><div><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_d27fc6cfbb1c99cb5eb6a848d6b2a385cacb7bf9" entityID="<a href="https://test.mydomain.net/shibboleth">https://test.mydomain.net/shibboleth</a>"></div>
<div><br></div><div> <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol"></div><div> <md:Extensions></div>
<div> <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="<a href="http://test.mydomain.net/Shibboleth.sso/Login">http://test.mydomain.net/Shibboleth.sso/Login</a>"/></div>
<div> </md:Extensions></div><div> <md:KeyDescriptor></div><div> <ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div><div>
<ds:KeyName>ths-multitenant.ths.local</ds:KeyName></div><div> <ds:X509Data></div><div> <ds:X509SubjectName>CN=ths-multitenant.ths.local</ds:X509SubjectName></div><div>
<ds:X509Certificate> encoded one</div><div></ds:X509Certificate></div><div> </ds:X509Data></div><div> </ds:KeyInfo></div><div> </md:KeyDescriptor></div><div> <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="http://test.mydomain.net/Shibboleth.sso/Artifact/SOAP">http://test.mydomain.net/Shibboleth.sso/Artifact/SOAP</a>" index="0"/></div>
<div> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SLO/SOAP">http://test.mydomain.net/Shibboleth.sso/SLO/SOAP</a>"/></div>
<div> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SLO/Redirect">http://test.mydomain.net/Shibboleth.sso/SLO/Redirect</a>"/></div>
<div> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SLO/POST">http://test.mydomain.net/Shibboleth.sso/SLO/POST</a>"/></div>
<div> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SLO/Artifact">http://test.mydomain.net/Shibboleth.sso/SLO/Artifact</a>"/></div>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML2/POST">http://test.mydomain.net/Shibboleth.sso/SAML2/POST</a>" index="0"/></div>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML2/POST-SimpleSign">http://test.mydomain.net/Shibboleth.sso/SAML2/POST-SimpleSign</a>" index="1"/></div>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML2/Artifact">http://test.mydomain.net/Shibboleth.sso/SAML2/Artifact</a>" index="2"/></div>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML2/ECP">http://test.mydomain.net/Shibboleth.sso/SAML2/ECP</a>" index="3"/></div>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML/POST">http://test.mydomain.net/Shibboleth.sso/SAML/POST</a>" index="4"/></div>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML/Artifact">http://test.mydomain.net/Shibboleth.sso/SAML/Artifact</a>" index="5"/></div>
<div> </md:SPSSODescriptor></div><div><br></div><div></md:EntityDescriptor></div></div><div><br></div><div>-Raja</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Nov 1, 2012 at 4:52 AM, Nate Klingenstein <span dir="ltr"><<a href="mailto:ndk@internet2.edu" target="_blank">ndk@internet2.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div>Raja,</div><div><br></div><div>The metadata that you uploaded to TestShib probably doesn't have endpoints listed for the domain <a href="http://test.mydomain.net/" target="_blank">test.mydomain.net</a>. You'll need to ensure that there are AssertionConsumerService URL's for both hosts.</div>
<div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP</a></div><div><br></div><div>Thanks,</div>
<div>Nate.</div><div><div class="h5"><br><div><div>On 31 Oct 2012, at 23:08, "Raz's" <<a href="mailto:gajula.rajashekhar@gmail.com" target="_blank">gajula.rajashekhar@gmail.com</a>> wrote:</div><br>
<blockquote type="cite">Hi Nate,<br><div class="gmail_extra"><div><br></div><div>When i configured SP as follows </div><div><br></div><div><div> <Site id="1" name="<a href="http://sp.mydomain.net/" target="_blank">sp.mydomain.net</a>"></div>
<div> <span style="white-space:pre-wrap"> </span><Alias><a href="http://dev.mydomain.net/" target="_blank">dev.mydomain.net</a></Alias></div><div> <span style="white-space:pre-wrap"> </span><Alias><a href="http://test.mydomain.net/" target="_blank">test.mydomain.net</a></Alias></div>
</div><div> </Site></div><div><br></div><div><div> <RequestMapper type="Native"></div><div> <RequestMap applicationId="default"></div><div> <Host name="<a href="http://dev.mydomain.net/" target="_blank">dev.mydomain.net</a>"><br>
</div><div> <Path name="protected" authType="shibboleth" requireSession="true"/></div><div> </Host></div><div> <Host name="<a href="http://test.mydomain.net/" target="_blank">test.mydomain.net</a>" entityID="<a href="https://idp.testshib.org/idp/shibboleth" target="_blank">https://idp.testshib.org/idp/shibboleth</a>"></div>
<div> <Path name="protected" authType="shibboleth" requireSession="true"/></div><div> </Host></div><div> </RequestMap><br></div><div> </RequestMapper></div>
</div><div><br></div><div><div> <ApplicationDefaults entityID="<a href="https://dev.mydomain.net/shibboleth" target="_blank">https://dev.mydomain.net/shibboleth</a>" REMOTE_USER="eppn"></div>
<div><br></div>
<div> <Sessions lifetime="28800" timeout="3600" checkAddress="true" consistentAddress="true" relayState="ss:mem" handlerSSL="false"><br></div><div>
<SSO entityID="<a href="https://idp.testshib.org/idp/shibboleth" target="_blank">https://idp.testshib.org/idp/shibboleth</a>"><br>
</div><div> SAML2 SAML1</div><div> </SSO></div><div><br></div><div> <Logout>SAML2 Local</Logout><br></div><div><br></div><div> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br>
</div><div> <Handler type="Status" Location="/Status" acl="127.0.0.1"/><br></div><div> <Handler type="Session" Location="/Session" showAttributeValues="true"/><br>
</div><div> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br></div><div><br></div><div> </Sessions></div><div><br></div><div> <Errors supportContact="root@localhost" logoLocation="/shibboleth-sp/logo.jpg" styleSheet="/shibboleth-sp/main.css"/></div>
<div><br></div><div> <MetadataProvider type="XML" uri="<a href="http://www.testshib.org/metadata/testshib-providers.xml" target="_blank">http://www.testshib.org/metadata/testshib-providers.xml</a>"<br>
</div>
<div> backingFilePath="testshib-two-idp-metadata.xml" reloadInterval="180000" /></div><div><br></div><div> <AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/><br>
</div><div> <AttributeResolver type="Query" subjectMatch="true"/></div><div> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/></div>
<div><br></div><div> <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/><br></div></div><div><div><br></div><div> </ApplicationDefaults> </div>
</div><div><br></div><div>then i'm getting the error like <strong style="font-family:'Times New Roman';font-size:medium">Error Message: No peer endpoint available to which to send SAML response</strong><br>
</div><div><font face="Times New Roman" size="3">while access the <a href="http://test.mydomain.net/" target="_blank">test.mydomain.net</a> but it's working fine with <a href="http://dev.mydomain.net/" target="_blank">dev.mydomain.net</a></font></div>
<div><font face="Times New Roman" size="3"><br></font></div><div><font face="Times New Roman" size="3">Here <a href="http://test.mydomain.net/" target="_blank">test.mydomain.net</a> IDP & sessions, handlers etc different from the dev.</font></div>
<div><font face="Times New Roman" size="3"><br></font></div><div><font face="Times New Roman" size="3">-Raja</font></div><div><font face="Times New Roman" size="3"><br></font></div>
On Wed, Oct 31, 2012 at 12:30 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div>><br>
>Please help me out in the process of SAML SP implementation for sub<br>
>domains. This implementation little bit tricky here single application<br>
>providing the solutions or our clients using the sub domains so each sub<br>
>domain indicates the individual client and<br>
> also each client had the his own idp and sp but we want to integrate<br>
>their idp into our sp at the same it has to redirect the request to<br>
>respected sub domains (clients) idp. Here Session of each and every sub<br>
>domain (client) should be vary based on the sub<br>
> domain(client) idp.<br>
<br>
</div>I answered this in the original thread you raised it in. If you want to<br>
specify the IdP based on the vhost, you add an entityID property naming<br>
the IdP in the RequestMap in a <Host> element for the given vhost. That's<br>
it. You don't need overrides.<br>
<br></blockquote><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
If you need to add restrictions to limit which IdP's users are able to<br>
access the vhosts, then there are various ways to achieve that, or it can<br>
be done entirely inside the application. Again, you don't need overrides<br>
for that.<br>
<span><font color="#888888"><br>
-- Scott<br>
</font></span><div><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></blockquote></div><br></div>
--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div><br></div></div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>
--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></blockquote></div><br></div></body></html>