<div><br></div><div>Shib-List,</div><div><br></div><div>Having re-re-read this:</div><div><br></div><div> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride</a></div>
<div><br></div><div><br></div><div>We in a similar situation as Sunil, but we have to use pathways in the hosted application:</div><div><br></div><div><br></div><div>Each customer has a section in the application vhost:</div>
<div><br></div><div>#</div><div> <Location /customer1/login></div><div> AuthType shibboleth</div><div> ShibRequireSession On</div><div> require valid-user</div><div> ShibUseHeaders On</div>
<div> </Location></div><div>#</div><div> <Location /customer1/test></div><div> AuthType shibboleth</div><div> ShibRequireSession On</div><div> require valid-user</div><div> ShibUseHeaders On</div>
<div> </Location></div><div>#</div><div>#</div><div> <Location /customer2/login></div><div> AuthType shibboleth</div><div> ShibRequireSession On</div><div> require valid-user</div><div>
ShibUseHeaders On</div><div> </Location></div><div>#</div><div> <Location /customer2/test></div><div> AuthType shibboleth</div><div> ShibRequireSession On</div><div> require valid-user</div>
<div> ShibUseHeaders On</div><div> </Location></div><div>#</div><div><br></div><div><br></div><div><br></div><div>The reason we are leaning towards Overrides is that each customer has their own IdP service,</div>
<div>some have required client-side CERTS, many have custom attribute mappings, and some have different Session requirements.</div><div><br></div><div>Also as the vhost lines suggest, each customer has a real "login" area (production) and a "test" area (development). </div>
<div>All of our customers want different access levels on those areas.</div><div><br></div><div><br></div><div><br></div><div><br></div><div>So we were thinking of something like this:</div><div><br></div><div><br></div><div>
<ApplicationOverride id="customer1"></div><div> <Sessions lifetime="7200" timeout="3600" <<==================== CUSTOM TIMEOUT</div><div> handlerSSL="true"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>cookieProps="; path=/customer2/login; secure; HttpOnly"/></div><div> <MetadataProvider type="XML"</div><div> uri="<a href="https://idp.customer1.com/Shibboleth.sso/Metadata">https://idp.customer1.com/Shibboleth.sso/Metadata</a>" <<==================== CUSTOM IdP (meta provider from customer)</div>
<div> backingFilePath="/etc/shibboleth/customer1-idps-metadata-saml2.xml"</div><div> reloadInterval="7200" maxRefreshDelay="86400"></div><div> </MetadataProvider></div>
<div> <AttributeExtractor type="XML" file="customer1-attribute-map.xml"/> <<==================== CUSTOM attributes (mostly group access)</div><div> <CredentialResolver type="File" key="customer1-key.pem" certificate="customer1-cert.pem"/> <<==================== CUSTOM CREDENTIALS</div>
<div></ApplicationOverride></div><div><br></div><div><br></div><div><br></div><div>Questions: </div><div><br></div><div>1) Since this override is really about a customer and not about us, do we need a handlerURL (e.g. handlerURL="/customer1/Shibboleth.sso") for each Override?</div>
<div><br></div><div>2) In many examples we have seen, each overrides section has its own entityID. Is that required here? The "Base" URL for each customer will be the same.</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Just the path will be different:</div>
<div><br></div><div> e.g. <a href="https://ourlargeapp.company.com/customer01">https://ourlargeapp.company.com/customer01</a></div><div> e.g. <a href="https://ourlargeapp.company.com/customer02">https://ourlargeapp.company.com/customer02</a></div>
<div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>[...]</div><div><br></div><div><br></div><div>We're new to Shibboleth and I guess I have to confess being a bit confused about entityID. </div>
<div>We declare one in the <ApplicationDefaults> section:</div><div><br></div><div> <a href="http://applications.company.com">applications.company.com</a></div><div><br></div><div>But that is about us. We made a metadata file for it and everything. All the customers are from very different domains, etc. They have their own IdPs. </div>
<div>Do they each need an entityID in the Overrides section? Wouldn't that imply they each have to have their own Metadata on the SP somewhere?</div><div><br></div><div><br></div><div>3) Lastly, this configuration is SP only. We have no Discovery Service. We do not even have an IdP server. </div>
<div>What should we use for <SessionInitiator> or SSO (default IdP). For us, there really isn't one. </div><div><br></div><div>Can we just leave it out of the <ApplicationDefaults> altogether?</div><div><br>
</div><div><br></div><div>Many thanks folks!</div><div><br></div><div>-- RGS<br><br>==================================<br>Roy G. Specter<br><a href="mailto:roygspectech8@gmail.com" target="_blank">roygspectech8@gmail.com</a><br>
========================================<br></div>
<br><br><div class="gmail_quote">On Fri, Jul 26, 2013 at 4:13 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
* bs_sunil <<a href="mailto:bssunil74@yahoo.com">bssunil74@yahoo.com</a>> [2013-07-26 20:35]:<br>
<div class="im">> Thanks Peter. Yes I am good with one entity ID for both vhosts.<br>
<br>
</div>Great.<br>
<div class="im"><br>
> - Have one or several metadata providers so that the single SP knows<br>
> - all the IdPs in use. No application overrides.<br>
><br>
> When you say metadata providers, I am assuming IDP supplied metadata<br>
> referenced like in <MetadataProvider type="XML"<br>
> file="idpmetadata.xml"/>. Can you give an example like where I could supply<br>
> that info?<br>
<br>
</div>I just said to add the metadata for all IDPs to your SP --this is not<br>
specific to and has nothing to do with vhosting or anythig else you<br>
asked about. The documentation clearly covers how to add metadata to<br>
the SP (e.g. using one or more lines like you post above, or using a<br>
folder or many other ways).<br>
<div class="im"><br>
> I do not have a discovery/wayn service. So I can supply multiple<br>
> metadata like file="idpmetadata.xml"<br>
<br>
</div>Adding SAML metadata (describing IDPs) to an SP has nothing to do with<br>
IdP discovery.<br>
You said you wanted each vhost to always use a specific IdP (to work<br>
around having to do IdP discovery) and I already posted the Apache<br>
httpd directive how to do that.<br>
<div class="im"><br>
> - Have a single piece (one EntityDescriptor) of SAML metadata<br>
> containing ACS URLs for /both/ <a href="http://testa.com/" target="_blank">testa.com/</a> and <a href="http://testb.com/" target="_blank">testb.com/</a> and give<br>
> that metadata to the IDP.<br>
><br>
> An example of where I need to do this (like in shibboleth2.xml?)would be<br>
> very helpful.<br>
<br>
</div>No, with "SAML Metadata" I'm mean SAML 2.0 Metadata, as specified by<br>
OASIS.<br>
I had assumed that at one point you provided the IdPs with SAML<br>
Metadata describing your SP. If that is the case you'll need to modify<br>
that metadata so that both <a href="http://testa.com" target="_blank">testa.com</a> and <a href="http://testb.com" target="_blank">testb.com</a> are present in all<br>
AssertionConsumerService elements where only one of them is listed.<br>
(Since you said one entityID for both vhosts is enough that means you<br>
only have a single EntityDescriptor describing your SP to the<br>
IdPs. You just have to make sure both <a href="http://testa.com" target="_blank">testa.com</a> and <a href="http://testb.com" target="_blank">testb.com</a> are<br>
contained in that metatdata.)<br>
<br>
If you did not provided the IdPs with SAML 2.0 Metadata for your SP<br>
you'll have to supply the same information via some other method,<br>
specific to these IdPs.<br>
<span class="HOEnZb"><font color="#888888">-peter<br>
</font></span><div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>