<div dir="ltr">Hi,<div><br></div><div>We have Shibboleth on both our SP and IdP, using SP initiated authentication, everything is working perfectly.</div><div>For different reasons, we need to make the call to the SP from another URL and this is proving to be quite difficult.</div>
<div style><br></div><div style>For example, currently we make the request with:</div><div style><a href="https://original.example.com/Shibboleth.sso/Login?target=https://original.example.com&entityID=https://idp.address.com/idp/shibboleth">https://original.example.com/Shibboleth.sso/Login?target=https://original.example.com&entityID=https://idp.address.com/idp/shibboleth</a><br>
</div><div style><br></div><div style>Now we ALSO need to make the call with the new Host:</div><div><a href="https://new-host.example.com/Shibboleth.sso/Login?target=https://new-host.example.com&entityID=https://idp.address.com/idp/shibboleth">https://new-host.example.com/Shibboleth.sso/Login?target=https://new-host.example.com&entityID=https://idp.address.com/idp/shibboleth</a><br>
</div><div><br></div><div>My first point of failure was that the IdP returned:<br></div><div><strong>Error Message: No peer endpoint available to which to send SAML response</strong> </div><div style>So I solved that by adding, to the original SP metadata file on the IdP, AssertionConsumerService lines that contain the new Host address.</div>
<div style>It seems that now the IdP is OK with the new host, but after I get redirected from the IdP to the SP, I get the new error:</div><div style><br></div><div style><div>opensaml::BindingException at (<a href="https://original.saas.hp.com/Shibboleth.sso/SAML2/POST">https://original.saas.hp.com/Shibboleth.sso/SAML2/POST</a>)</div>
<div>SAML message delivered with POST to incorrect server URL.</div><div><br></div><div style>Just to clarify - this error seems to be common among people who use SSL Offloading on the Load Balancer but did not configure Apache to believe it is working in HTTPS, this is not my case, as everything is working until I try to add the second URL.</div>
<div style><br></div><div style>Anyway, I tried to follow a couple guides that were supposed to enable it, here are the changes I made to the SP side:</div><div style><br></div><div style>SHIBBOLETH2.XML:</div><div style>
<br></div><div style><div><Host name="<a href="http://new-host.example.com">new-host.example.com</a>" applicationId="new-host"></div><div> <Path name="secure" authType="shibboleth" redirectToSSL="443" requireSession="true"/></div>
<div><span class="" style="white-space:pre"> </span><Path name="<appname>" authType="shibboleth" redirectToSSL="443" requireSession="true"/></div><div> </Host></div>
</div></div><div style><br></div><div style>(right before </ApplicationDefaults>):</div><div style><div> <ApplicationOverride id="new-host" entityID="<a href="https://new-host.example.com/shibboleth">https://new-host.example.com/shibboleth</a>"/><span class="" style="white-space:pre"> </span></div>
<div><span class="" style="white-space:pre"><br></span></div><div><br></div><div style>HTTPD.CONF:</div><div style><div><VirtualHost <a href="http://new-host.example.com:443">new-host.example.com:443</a>></div><div>
ServerName <a href="https://new-host.example.com:443">https://new-host.example.com:443</a></div><div>UseCanonicalName On</div><div><Location /></div><div><span class="" style="white-space:pre"> </span>AuthType shibboleth</div>
<div><span class="" style="white-space:pre"> </span>ShibRequestSetting applicationId new-host</div><div><span class="" style="white-space:pre"> </span>ShibRequireSession On</div><div><span class="" style="white-space:pre"> </span>require valid-user</div>
<div></Location></div><div></VirtualHost></div></div></div><div style><br></div><div style><br></div><div style>These are the guides I followed:</div><div style><a href="https://wiki.cam.ac.uk/raven/Virtual_hosting_issues_with_Shibboleth">https://wiki.cam.ac.uk/raven/Virtual_hosting_issues_with_Shibboleth</a><br>
</div><div style><a href="http://www.edugate.ie/content/shibboleth-sp-multidomain-environment">http://www.edugate.ie/content/shibboleth-sp-multidomain-environment</a><br></div><div style><br></div><div style>Any help will be greatly appreciated!</div>
<div style><br></div><div style>Thanks</div></div>