<div dir="ltr">Thanks for the quick answer Peter. my responses embedded<br><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Mar 11, 2013 at 1:01 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">* Ran <<a href="mailto:ran@sheinberg.net">ran@sheinberg.net</a>> [2013-03-11 11:46]:<br>
<div class="im">> For different reasons, we need to make the call to the SP from<br>
> another URL and this is proving to be quite difficult.<br>
><br>
> For example, currently we make the request with:<br>
> <a href="https://original.example.com/Shibboleth.sso/Login?target=https://original.example.com&entityID=https://idp.address.com/idp/shibboleth" target="_blank">https://original.example.com/Shibboleth.sso/Login?target=https://original.example.com&entityID=https://idp.address.com/idp/shibboleth</a><br>
><br>
> Now we ALSO need to make the call with the new Host:<br>
> <a href="https://new-host.example.com/Shibboleth.sso/Login?target=https://new-host.example.com&entityID=https://idp.address.com/idp/shibboleth" target="_blank">https://new-host.example.com/Shibboleth.sso/Login?target=https://new-host.example.com&entityID=https://idp.address.com/idp/shibboleth</a><br>
<br>
</div>Does "make the call" mean "need to protect resources on a different<br>
name-based virtual host"?<br>
<br>
(From where protocol requests are made is mostly irrelevant, esp those<br>
above; you can also issue SAML authentication requests to the IdP in<br>
the name of the SP from any other host, unless the IdP insists these<br>
to be signed by the SP.)<br>
<div class="im"><br>
> Just to clarify - this error seems to be common among people who use<br>
> SSL Offloading on the Load Balancer but did not configure Apache to<br>
> believe it is working in HTTPS, this is not my case, as everything<br>
> is working until I try to add the second URL.<br>
<br>
</div>There can be several reasons for that error of which a scheme mismatch<br>
(https vs http) is only one.<br>
<br>
> SHIBBOLETH2.XML:<br>
<br>
Since you're using Apache httpd there's nothing in the SP you'd *need*<br>
to change, in the most common case (so using overrides wouldn't be my<br>
first choice). Instead you could simply configure the second virtual<br>
host correctly in Apache httpd, by setting ServerName.<br></blockquote><div><br></div><div style>-- Didn't I do that? can you point out what's wrong in the snippet from httpd.conf?</div><div style> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
For response messages from the IdP to be able to be recieved correctly<br>
you'd then put additional protocol endpoints (ACS URLs etc) for the<br>
new vhost into the same EntityDescriptor for the existing SP. Done.<br>
<div class="im"><br></div></blockquote><div style>-- Didn't I do that as well? added </div><div style><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://new-host.example.com/Shibboleth.sso/SAML2/POST">https://new-host.example.com/Shibboleth.sso/SAML2/POST</a>" index="1"/> </div>
<div style>In the SP's metadata file that is located on the IdP.</div><div style>What's missing?</div><div style><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="im">
> These are the guides I followed:<br>
> <a href="https://wiki.cam.ac.uk/raven/Virtual_hosting_issues_with_Shibboleth" target="_blank">https://wiki.cam.ac.uk/raven/Virtual_hosting_issues_with_Shibboleth</a><br>
> <a href="http://www.edugate.ie/content/shibboleth-sp-multidomain-environment" target="_blank">http://www.edugate.ie/content/shibboleth-sp-multidomain-environment</a><br>
<br>
</div>I'm not gonna read and comment on those now. If you have questions<br>
regarding any 3rd-party documentation you'd better contact the authors<br>
of those.<br>
<br>
Cheers,<br>
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div></div>