Hi Nate,<div><br></div><div>No progress after modification of the metadata as per your specification and also when i'm trying to access the <b><a href="http://test.mydomain.net">test.mydomain.net</a></b> then <b><a href="http://dev.mydomain.net">dev.mydomain.net</a></b> is showing @ <b><a href="http://testshib.org">testshib.org</a></b> idp logon page after successful authencation same error message am getting and also sessions are created for <b><a href="http://dev.mydomain.net">dev.mydomain.net</a></b> not for the <b><a href="http://test.mydomain.net">test.mydomain.net</a> </b>on <b><a href="http://testshib.org">testshib.org</a></b>.</div>
<div><br></div><div>I have doubt about the SP metadata configuration, is it mandatory to mention end point to all sub domain which is configure on IDP same like your specification. Here we are getting the SP metadata based on the sub domains for example: <a href="https://dev.mydomain.net/Shibboleth.sso/Metadata">https://dev.mydomain.net/Shibboleth.sso/Metadata</a></div>
<div><br></div><div>i think you understand my scenario, here we going to provide the SP implementation based on the sub domains with unique IDP for each sub domain and also sessions and logout configuration may vary from each sub domain.</div>
<div><br></div><div>Thanks,</div><div>Raja.</div><div><br></div><div><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Nov 1, 2012 at 5:49 AM, Nate Klingenstein <span dir="ltr"><<a href="mailto:ndk@internet2.edu" target="_blank">ndk@internet2.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word">Raja,<div><br></div><div>You need both domains listed.</div><div class="im"><div><br>
</div><div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML2/POST" target="_blank">http://test.mydomain.net/Shibboleth.sso/SAML2/POST</a>" index="0"/></div>
</div><div><div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="http://dev.mydomain.net/Shibboleth.sso/SAML2/POST" target="_blank">http://dev.mydomain.net/Shibboleth.sso/SAML2/POST</a>" index="6"/></div>
</div><div><br></div><div>Thanks,</div><div>Nate.</div><div><div class="h5"><div><br><div><div>On 1 Nov 2012, at 00:10, "Raz's" <<a href="mailto:gajula.rajashekhar@gmail.com" target="_blank">gajula.rajashekhar@gmail.com</a>> wrote:</div>
<br><blockquote type="cite">Thanks a lot Nate,<div><br></div><div>End points nothing but AssertionConsumerService correct, They are present in my metadata which was uploaded to the <a href="http://testshib.org/" target="_blank">testshib.org</a> IDP, one more thing if i interchange the places for dev and test then test will work and dev will not works (now <a href="http://dev.mydomain.net/" target="_blank">dev.mydomain.net</a> will gets the error message like previous)</div>
<div><br></div><div>Here the exact metadata of <a href="http://test.mydomain.net/" target="_blank">Test.Mydomain.net</a>.</div><div><br></div><div><div><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_d27fc6cfbb1c99cb5eb6a848d6b2a385cacb7bf9" entityID="<a href="https://test.mydomain.net/shibboleth" target="_blank">https://test.mydomain.net/shibboleth</a>"></div>
<div><br></div><div> <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol"></div><div> <md:Extensions></div>
<div> <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="<a href="http://test.mydomain.net/Shibboleth.sso/Login" target="_blank">http://test.mydomain.net/Shibboleth.sso/Login</a>"/></div>
<div> </md:Extensions></div><div> <md:KeyDescriptor></div><div> <ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"></div>
<div>
<ds:KeyName>ths-multitenant.ths.local</ds:KeyName></div><div> <ds:X509Data></div><div> <ds:X509SubjectName>CN=ths-multitenant.ths.local</ds:X509SubjectName></div><div>
<ds:X509Certificate> encoded one</div><div></ds:X509Certificate></div><div> </ds:X509Data></div><div> </ds:KeyInfo></div><div> </md:KeyDescriptor></div><div> <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="http://test.mydomain.net/Shibboleth.sso/Artifact/SOAP" target="_blank">http://test.mydomain.net/Shibboleth.sso/Artifact/SOAP</a>" index="0"/></div>
<div> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SLO/SOAP" target="_blank">http://test.mydomain.net/Shibboleth.sso/SLO/SOAP</a>"/></div>
<div> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SLO/Redirect" target="_blank">http://test.mydomain.net/Shibboleth.sso/SLO/Redirect</a>"/></div>
<div> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SLO/POST" target="_blank">http://test.mydomain.net/Shibboleth.sso/SLO/POST</a>"/></div>
<div> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SLO/Artifact" target="_blank">http://test.mydomain.net/Shibboleth.sso/SLO/Artifact</a>"/></div>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML2/POST" target="_blank">http://test.mydomain.net/Shibboleth.sso/SAML2/POST</a>" index="0"/></div>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML2/POST-SimpleSign" target="_blank">http://test.mydomain.net/Shibboleth.sso/SAML2/POST-SimpleSign</a>" index="1"/></div>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML2/Artifact" target="_blank">http://test.mydomain.net/Shibboleth.sso/SAML2/Artifact</a>" index="2"/></div>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML2/ECP" target="_blank">http://test.mydomain.net/Shibboleth.sso/SAML2/ECP</a>" index="3"/></div>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML/POST" target="_blank">http://test.mydomain.net/Shibboleth.sso/SAML/POST</a>" index="4"/></div>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="<a href="http://test.mydomain.net/Shibboleth.sso/SAML/Artifact" target="_blank">http://test.mydomain.net/Shibboleth.sso/SAML/Artifact</a>" index="5"/></div>
<div> </md:SPSSODescriptor></div><div><br></div><div></md:EntityDescriptor></div></div><div><br></div><div>-Raja</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Nov 1, 2012 at 4:52 AM, Nate Klingenstein <span dir="ltr"><<a href="mailto:ndk@internet2.edu" target="_blank">ndk@internet2.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div>Raja,</div><div><br></div><div>The metadata that you uploaded to TestShib probably doesn't have endpoints listed for the domain <a href="http://test.mydomain.net/" target="_blank">test.mydomain.net</a>. You'll need to ensure that there are AssertionConsumerService URL's for both hosts.</div>
<div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP</a></div><div><br></div><div>Thanks,</div>
<div>Nate.</div><div><div><br><div><div>On 31 Oct 2012, at 23:08, "Raz's" <<a href="mailto:gajula.rajashekhar@gmail.com" target="_blank">gajula.rajashekhar@gmail.com</a>> wrote:</div><br>
<blockquote type="cite">Hi Nate,<br><div class="gmail_extra"><div><br></div><div>When i configured SP as follows </div><div><br></div><div><div> <Site id="1" name="<a href="http://sp.mydomain.net/" target="_blank">sp.mydomain.net</a>"></div>
<div> <span style="white-space:pre-wrap"> </span><Alias><a href="http://dev.mydomain.net/" target="_blank">dev.mydomain.net</a></Alias></div><div> <span style="white-space:pre-wrap"> </span><Alias><a href="http://test.mydomain.net/" target="_blank">test.mydomain.net</a></Alias></div>
</div><div> </Site></div><div><br></div><div><div> <RequestMapper type="Native"></div><div> <RequestMap applicationId="default"></div><div> <Host name="<a href="http://dev.mydomain.net/" target="_blank">dev.mydomain.net</a>"><br>
</div><div> <Path name="protected" authType="shibboleth" requireSession="true"/></div><div> </Host></div><div> <Host name="<a href="http://test.mydomain.net/" target="_blank">test.mydomain.net</a>" entityID="<a href="https://idp.testshib.org/idp/shibboleth" target="_blank">https://idp.testshib.org/idp/shibboleth</a>"></div>
<div> <Path name="protected" authType="shibboleth" requireSession="true"/></div><div> </Host></div><div> </RequestMap><br></div><div> </RequestMapper></div>
</div><div><br></div><div><div> <ApplicationDefaults entityID="<a href="https://dev.mydomain.net/shibboleth" target="_blank">https://dev.mydomain.net/shibboleth</a>" REMOTE_USER="eppn"></div>
<div><br></div>
<div> <Sessions lifetime="28800" timeout="3600" checkAddress="true" consistentAddress="true" relayState="ss:mem" handlerSSL="false"><br></div><div>
<SSO entityID="<a href="https://idp.testshib.org/idp/shibboleth" target="_blank">https://idp.testshib.org/idp/shibboleth</a>"><br>
</div><div> SAML2 SAML1</div><div> </SSO></div><div><br></div><div> <Logout>SAML2 Local</Logout><br></div><div><br></div><div> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br>
</div><div> <Handler type="Status" Location="/Status" acl="127.0.0.1"/><br></div><div> <Handler type="Session" Location="/Session" showAttributeValues="true"/><br>
</div><div> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br></div><div><br></div><div> </Sessions></div><div><br></div><div> <Errors supportContact="root@localhost" logoLocation="/shibboleth-sp/logo.jpg" styleSheet="/shibboleth-sp/main.css"/></div>
<div><br></div><div> <MetadataProvider type="XML" uri="<a href="http://www.testshib.org/metadata/testshib-providers.xml" target="_blank">http://www.testshib.org/metadata/testshib-providers.xml</a>"<br>
</div>
<div> backingFilePath="testshib-two-idp-metadata.xml" reloadInterval="180000" /></div><div><br></div><div> <AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/><br>
</div><div> <AttributeResolver type="Query" subjectMatch="true"/></div><div> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/></div>
<div><br></div><div> <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/><br></div></div><div><div><br></div><div> </ApplicationDefaults> </div>
</div><div><br></div><div>then i'm getting the error like <strong style="font-family:'Times New Roman';font-size:medium">Error Message: No peer endpoint available to which to send SAML response</strong><br>
</div><div><font face="Times New Roman" size="3">while access the <a href="http://test.mydomain.net/" target="_blank">test.mydomain.net</a> but it's working fine with <a href="http://dev.mydomain.net/" target="_blank">dev.mydomain.net</a></font></div>
<div><font face="Times New Roman" size="3"><br></font></div><div><font face="Times New Roman" size="3">Here <a href="http://test.mydomain.net/" target="_blank">test.mydomain.net</a> IDP & sessions, handlers etc different from the dev.</font></div>
<div><font face="Times New Roman" size="3"><br></font></div><div><font face="Times New Roman" size="3">-Raja</font></div><div><font face="Times New Roman" size="3"><br></font></div>
On Wed, Oct 31, 2012 at 12:30 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div>><br>
>Please help me out in the process of SAML SP implementation for sub<br>
>domains. This implementation little bit tricky here single application<br>
>providing the solutions or our clients using the sub domains so each sub<br>
>domain indicates the individual client and<br>
> also each client had the his own idp and sp but we want to integrate<br>
>their idp into our sp at the same it has to redirect the request to<br>
>respected sub domains (clients) idp. Here Session of each and every sub<br>
>domain (client) should be vary based on the sub<br>
> domain(client) idp.<br>
<br>
</div>I answered this in the original thread you raised it in. If you want to<br>
specify the IdP based on the vhost, you add an entityID property naming<br>
the IdP in the RequestMap in a <Host> element for the given vhost. That's<br>
it. You don't need overrides.<br>
<br></blockquote><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
If you need to add restrictions to limit which IdP's users are able to<br>
access the vhosts, then there are various ways to achieve that, or it can<br>
be done entirely inside the application. Again, you don't need overrides<br>
for that.<br>
<span><font color="#888888"><br>
-- Scott<br>
</font></span><div><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></blockquote></div><br></div>
--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div><br></div></div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>
--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div><br></div></div></div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>