<div dir="ltr">Well after a few days of playing around with this, I literally narrowed down the problem to 3 lines in server.conf.<div><br></div><div>This is my current configuration:</div><div><br></div><div><ol style><li style>
<i>ServerName <a href="https://original.example.com:443">https://original.example.com:443</a></i><br></li><li style><i>UseCanonicalName On</i><br></li><li style><i>ProxyPreserveHost On</i><br></li><li style><i>ProxyIOBufferSize 65536</i><br>
</li><li style><i><VirtualHost <a href="http://new-host.example.com:443">new-host.example.com:443</a>></i><br></li><li style><i>ServerName <a href="https://new-host.example.com:443">https://new-host.example.com:443</a></i><br>
</li><li style><i>UseCanonicalName On</i><br></li><li style><i><Location /></i><br></li><li style><i></Location></i><br></li><li style><i></VirtualHost></i><br></li></ol><div style>With this configuration, original is able to login and new-host gives the error.</div>
</div><div><i><br></i></div><div style>If I change line #5 to:</div><div style><i><VirtualHost new-host.example.com:*></i><br></div><div style>The situation is reversed and new-host logins, while new-host gives the error.</div>
<div style><br></div><div style>What is wrong with my binding?? I've tried every combination I can think of but nothing works. </div><div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Mon, Mar 11, 2013 at 2:31 PM, Ran <span dir="ltr"><<a href="mailto:ran@sheinberg.net" target="_blank">ran@sheinberg.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">It's not working yet, no. the error did not change.<div><div>opensaml::BindingException at (<a href="https://original.example.com/Shibboleth.sso/SAML2/POST" target="_blank">https://original.example.com/Shibboleth.sso/SAML2/POST</a>)</div>
<div class="im">
<div>SAML message delivered with POST to incorrect server URL.</div></div></div><div><br></div><div>I understand your comment about the VirtualHost directive. in that case, this is what I have right now:</div><div><br>
</div><div><div class="im"><div><VirtualHost <a href="http://new-host.example.com:443" target="_blank">new-host.example.com:443</a>></div><div>ServerName <a href="https://new-host.example.com:443" target="_blank">https://new-host.example.com:443</a></div>
</div><div>
<Location /></div><div> AuthType shibboleth</div><div> require shibboleth</div><div> ShibUseHeaders on</div><div></Location></div><div></VirtualHost></div><div><br></div><div>The ServerName in the VirtualHost is correct, because I can paste it in my browser and get to the Apache landing page. this is what I'm using to build the Request URL.</div>
<div>Am I missing any directives in that snippet? at this point I'm just winging it by copying different parts from different guides.</div></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br>
<br><div class="gmail_quote">On Mon, Mar 11, 2013 at 2:23 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Ran <<a href="mailto:ran@sheinberg.net" target="_blank">ran@sheinberg.net</a>> [2013-03-11 13:11]:<br>
<div>> Well I removed all the irrelevant stuff per your recommendation.<br>
> Removed all the added stuff from Shibboleth.xml<br>
> Started fresh on the IdP by regenerating the Metadata from the SP and<br>
> adding the ACS URLs + upped their indexes.<br>
<br>
</div>Didn't see an error report in your mail, though, so is it working as<br>
expected?<br>
<div><br>
> Now I think the last point is httpd.conf. this is what I left:<br>
> <VirtualHost <a href="http://new-host.example.com:443" target="_blank">new-host.example.com:443</a>><br>
> ServerName new-host.examplecom:443<br>
> ServerAlias new-host.examplecom<br>
> UseCanonicalName On<br>
> </VirtualHost><br>
><br>
> I am trying without Location and the applicationId as you mentioned.<br>
> am I using the directives correctly?<br>
> And another question is how should the Virtualhost do the binding? on port<br>
> 443 which is what the Load Balancer is listening on? or maybe 8080 since<br>
> this is what the Application is listening to (so maybe <VirtualHost<br>
> <a href="http://new-host.example.com:8080" target="_blank">new-host.example.com:8080</a>> ? that doesn't seem to work as well...<br>
<br>
</div>So you are in fact terminating SSL at some other system? The advice<br>
stays the same: ServerName needs to be correct. Correct means matches<br>
whatever the HTTP User Agent sees, i.e. including the schema (https)<br>
before the hostname.<br>
On what local TCP port you have your httpd listen is irrelevant for<br>
any purposes of this list and the Shibboleth software (assuming you<br>
don't intend on exposing this to the network). What's wrong with port<br>
80? But local deployment choice, really.<br>
Also note that httpd does not bind to ports based on virtualhost<br>
directives (it uses the Listen directives for that).<br>
<div><div>-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>