<div dir="ltr">Thanks guys! I actually got it to work with the following:<div><br></div><div><div>NameVirtualHost *:*</div><div><VirtualHost *:443><br></div><div> ServerName <a href="https://original.example.com:443">https://original.example.com:443</a></div>
<div> ServerAlias <a href="http://original.example.com">original.example.com</a></div><div></VirtualHost></div><div><VirtualHost *:443><br></div><div> ServerName <a href="https://new-host.example.com:443">https://new-host.example.com:443</a></div>
<div> ServerAlias <a href="http://new-host.example.com">new-host.example.com</a></div><div></VirtualHost></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Mar 11, 2013 at 6:32 PM, Simon Bright <span dir="ltr"><<a href="mailto:simon.bright@e2bn.org" target="_blank">simon.bright@e2bn.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="font-size:10pt;font-family:verdana,helvetica,sans-serif"><div>Hi Ran<br></div><div><br></div><div>Just jumping in here. We have two vhost set up here on Apache. I'll refrain from saying "you must have" but you may find that it will only work if you have separate IP for each host.</div>
<div><br></div><div>My ssl.conf file has these lines. My server has two IP addresses on 1 nic. The following config is then duplicated for each host , using the correct IP address hostnames and certificate paths for each. <br>
</div><div><br></div><div><VirtualHost [ip address here]:443><br>ServerName hostname:443<br>DocumentRoot /var/www/html/hostname<br>ErrorLog logs/hostname/ssl_error_log<br>TransferLog logs/hostname/ssl_access_log<br>
LogLevel warn<br>SSLEngine on<br>SSLVerifyDepth 10<br>SSLOptions +StdEnvVars +ExportCertData<br>SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW<br>SSLCertificateFile <em>/path-to-certificate</em><br>SSLCertificateKeyFile <em>/path-to-key</em><br>
SSLCertificateChainFile /<em>path-to-cabundle</em><br>SSLVerifyClient none<br></VirtualHost><br><br></div><div><br></div><div><br></div><div><span name="x"></span><div style="text-align:left"><span style="font-size:small" size="2"><span style="font-family:verdana,helvetica,sans-serif"></span></span>Regards<br>
</div><br>Simon Bright<br>Technical Services Manager<br>E2BN<br>01462 834588<br>07912 853 107<br><a href="http://www.e2bn.org" target="_blank">www.e2bn.org</a><br><div><br></div><br><span name="x"></span><br></div><hr><div>
<div class="h5"><div style="font-size:12pt;font-style:normal;font-family:Helvetica,Arial,sans-serif;text-decoration:none;font-weight:normal"><div dir="ltr">Well after a few days of playing around with this, I literally narrowed down the problem to 3 lines in server.conf.<div>
<br></div><div>This is my current configuration:</div><div><br></div><div><ol><li><i>ServerName <a href="https://original.example.com:443" target="_blank">https://original.example.com:443</a></i><br></li><li><i>UseCanonicalName On</i><br>
</li><li><i>ProxyPreserveHost On</i><br></li><li><i>ProxyIOBufferSize 65536</i><br></li><li><i><VirtualHost <a href="http://new-host.example.com:443" target="_blank">new-host.example.com:443</a>></i><br></li><li><i>ServerName <a href="https://new-host.example.com:443" target="_blank">https://new-host.example.com:443</a></i><br>
</li><li><i>UseCanonicalName On</i><br></li><li><i><Location /></i><br></li><li><i></Location></i><br></li><li><i></VirtualHost></i><br></li></ol><div>With this configuration, original is able to login and new-host gives the error.</div>
</div><div><i><br></i></div><div>If I change line #5 to:</div><div><i><VirtualHost new-host.example.com:*></i><br></div><div>The situation is reversed and new-host logins, while new-host gives the error.</div><div><br>
</div><div>What is wrong with my binding?? I've tried every combination I can think of but nothing works. </div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div><br></div><div class="gmail_quote">
On Mon, Mar 11, 2013 at 2:31 PM, Ran <span dir="ltr"><<a href="mailto:ran@sheinberg.net" target="_blank">ran@sheinberg.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">It's not working yet, no. the error did not change.<div><div>opensaml::BindingException at (<a href="https://original.example.com/Shibboleth.sso/SAML2/POST" target="_blank">https://original.example.com/Shibboleth.sso/SAML2/POST</a>)</div>
<div><div>SAML message delivered with POST to incorrect server URL.</div></div></div><div><br></div><div>I understand your comment about the VirtualHost directive. in that case, this is what I have right now:</div><div><br>
</div><div><div><div><VirtualHost <a href="http://new-host.example.com:443" target="_blank">new-host.example.com:443</a>></div><div>ServerName <a href="https://new-host.example.com:443" target="_blank">https://new-host.example.com:443</a><br>
</div></div><div><Location /></div><div> AuthType shibboleth</div><div> require shibboleth</div><div> ShibUseHeaders on</div><div></Location></div><div></VirtualHost></div><div><br></div>
<div>The ServerName in the VirtualHost is correct, because I can paste it in my browser and get to the Apache landing page. this is what I'm using to build the Request URL.</div><div>Am I missing any directives in that snippet? at this point I'm just winging it by copying different parts from different guides.</div>
</div></div><div><div><div class="gmail_extra"><br> <br><div class="gmail_quote">On Mon, Mar 11, 2013 at 2:23 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Ran <<a href="mailto:ran@sheinberg.net" target="_blank">ran@sheinberg.net</a>> [2013-03-11 13:11]:<br><div>> Well I removed all the irrelevant stuff per your recommendation.<br>
> Removed all the added stuff from Shibboleth.xml<br> > Started fresh on the IdP by regenerating the Metadata from the SP and<br> > adding the ACS URLs + upped their indexes.<br> <br></div>Didn't see an error report in your mail, though, so is it working as<br>
expected?<br><div><br> > Now I think the last point is httpd.conf. this is what I left:<br> > <VirtualHost <a href="http://new-host.example.com:443" target="_blank">new-host.example.com:443</a>><br> > ServerName new-host.examplecom:443<br>
> ServerAlias new-host.examplecom<br> > UseCanonicalName On<br> > </VirtualHost><br> ><br> > I am trying without Location and the applicationId as you mentioned.<br> > am I using the directives correctly?<br>
> And another question is how should the Virtualhost do the binding? on port<br> > 443 which is what the Load Balancer is listening on? or maybe 8080 since<br> > this is what the Application is listening to (so maybe <VirtualHost<br>
> <a href="http://new-host.example.com:8080" target="_blank">new-host.example.com:8080</a>> ? that doesn't seem to work as well...<br> <br></div>So you are in fact terminating SSL at some other system? The advice<br>
stays the same: ServerName needs to be correct. Correct means matches<br> whatever the HTTP User Agent sees, i.e. including the schema (https)<br> before the hostname.<br> On what local TCP port you have your httpd listen is irrelevant for<br>
any purposes of this list and the Shibboleth software (assuming you<br> don't intend on exposing this to the network). What's wrong with port<br> 80? But local deployment choice, really.<br> Also note that httpd does not bind to ports based on virtualhost<br>
directives (it uses the Listen directives for that).<br><div><div>-peter<br> --<br> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div></div></blockquote></div><br></div><br>--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></div>
<div><br></div></div></div></div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>