On Wed, Nov 14, 2012 at 3:46 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im"><br>
</div>First off, with the X.509v3 SubjectAltName extension you can have<br></blockquote><div><br></div><div>thx. overhead of regenerating the cert for each new vhost is painful</div><div> </div><div>[...]</div><div><br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Redirects don't cause these errors, so another way to deal with this</blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
is switching from HTTP-POST to the HTTP-Artifact protocol binding.<br>
That's the only binding that does not involve an HTTP POST to the SP.<br>
Not all IdPs will support that, though.<br></blockquote><div><br></div><div>luckily using Shib IdP :) My understanding of the Artifact Resolution Protocol is limited, so I will read up on it</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
There /might/ also be other workarounds, like only exposing the<br>
SSL-enabled vhost in SAML metadata,</blockquote><div><br></div><div>this is what i initially did ... but when accessing to the non-SSL vhost(s), the authnrequest is telling</div><div>the IdP to use the ACS of http://<non ssl vhost></div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> not setting the "secure" flag on<br>
the cookie and explicitly setting the SP's session cookie to a shared<br>
DNS domain. That might not be acceptable in a hosting environment with<br>
hunderts or thousands of other hosts.</blockquote><div><br></div><div>some services it would matter, others not so much</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
But then you disabled SSL and<br>
all cookies will go in the clear anyway, so there's not much security<br>
for the session left.<br></blockquote><div><br></div><div>yeah, for this particular instance, we don't have much in terms of security concerns. typically, we just do the </div><div>1 IP : 1 VHOST : 1 CERT for the important stuff, and that works just fine with Shib.</div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div>