<div dir="ltr"><div><div><div>Environment: Shibboleth 2.4.3; Apache 2.2.3; CentOS 5 Linux<br></div><div><br>I'm working on setting up a federation between a partner and my SP. The partner requires (due to circumstances beyond my control) that I provide multiple SP entityIDs that they can use for different systems on their side. I'm aware this is not ideal, but there is nothing I can do about this.<br>
<br></div><div>When testing out the secondary entityID, I'm getting this error:<div> unacceptable AudienceRestriction in assertion<br></div><br></div><div></div>I've attempted to use an ApplicationOverride to create an alias with all the same settings, endpoints, etc... except the entityID. The NativeSPApplicationOverride wiki page has and example under Common
Example Scenarios that seems to be what I want, just a simple alias with
a different entityID:<br> <ApplicationOverride id="alternate" entityID="<a href="https://myapp.example.org/shibboleth">https://myapp.example.org/shibboleth</a>"/><br>but when I try this, the default application is still used:<br>
DEBUG Shibboleth.Listener [1]: dispatching message (default/SAML2/POST)<br><br></div>I have setup my apache config to request the alternate application, but it seems to have no effect:<br> <Location /shibboleth><br>
AuthType shibboleth<br> ShibRequestSetting requireSession 1<br> ShibRequestSetting applicationId alternate<br> require valid-user<br> </Location><br></div><div>This also would be a problem, since then I would always be using the alternate application configuration.<br>
</div><div><br></div><div>Based on this thread:<br> <a href="http://comments.gmane.org/gmane.comp.web.shibboleth.user/24679">http://comments.gmane.org/gmane.comp.web.shibboleth.user/24679</a><br></div><div>it seems that any application override must also use completely separate paths (without creating a new virtualhost)? If so, then the explanation of the example is really misleading as it seems to be a very simple thing, while it actually involves a lot of other config changes as well.<br>
</div><div><br><br></div><div>OK, so after all of that, given my requirements, is there a way to create a simple alias for an entityID, or to specify an alternate/additional audience that would be acceptable?<br><br><br></div>
</div>