<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
h1
{mso-style-priority:9;
mso-style-link:"Rubrik 1 Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:29.0pt;
font-family:"Times New Roman","serif";
color:white;
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.E-postmall17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.Rubrik1Char
{mso-style-name:"Rubrik 1 Char";
mso-style-priority:9;
mso-style-link:"Rubrik 1";
font-family:"Times New Roman","serif";
color:white;
mso-fareast-language:SV;
font-weight:bold;}
p.error, li.error, div.error
{mso-style-name:error;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=SV link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hello<o:p></o:p></p><p class=MsoNormal>I have set up shibboleth on Windows 2008/IIS 7. I’m running as SP<br>The problem I have is that from this server I need to connect to more than one IdP<o:p></o:p></p><p class=MsoNormal>So I need to protect different virtuals on the IIS with different ApplicationOverrides.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If I set the metadata and entityid for a specific Idp in the ApplicationDefaults then I can connect and everything works fine<o:p></o:p></p><p class=MsoNormal>However if I move the metadata and entityid to an ApplicationOverride<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:9.5pt;font-family:Consolas;color:blue'><</span><span style='font-size:9.5pt;font-family:Consolas;color:#A31515'>ApplicationOverride</span><span style='font-size:9.5pt;font-family:Consolas;color:blue'> </span><span style='font-size:9.5pt;font-family:Consolas;color:red'>id</span><span style='font-size:9.5pt;font-family:Consolas;color:blue'>=</span><span style='font-size:9.5pt;font-family:Consolas'>"<span style='color:blue'>customerId</span>"<span style='color:blue'>></span><o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:9.5pt;font-family:Consolas;color:blue'> <</span><span style='font-size:9.5pt;font-family:Consolas;color:#A31515'>Sessions</span><span style='font-size:9.5pt;font-family:Consolas;color:blue'> </span><span style='font-size:9.5pt;font-family:Consolas;color:red'>lifetime</span><span style='font-size:9.5pt;font-family:Consolas;color:blue'>=</span><span style='font-size:9.5pt;font-family:Consolas'>"<span style='color:blue'>28800</span>"<span style='color:blue'> </span><span style='color:red'>timeout</span><span style='color:blue'>=</span>"<span style='color:blue'>3600</span>"<span style='color:blue'> </span><span style='color:red'>checkAddress</span><span style='color:blue'>=</span>"<span style='color:blue'>false</span>"<span style='color:blue'> </span><span style='color:red'>relayState</span><span style='color:blue'>=</span>"<span style='color:blue'>ss:mem</span>"<span style='color:blue'> </span><span style='color:red'>handlerSSL</span><span style='color:blue'>=</span>"<span style='color:blue'>false</span>"<span style='color:blue'>></span><o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:9.5pt;font-family:Consolas;color:blue'> <</span><span style='font-size:9.5pt;font-family:Consolas;color:#A31515'>SSO</span><span style='font-size:9.5pt;font-family:Consolas;color:blue'> </span><span style='font-size:9.5pt;font-family:Consolas;color:red'>entityID</span><span style='font-size:9.5pt;font-family:Consolas;color:blue'>=</span><span style='font-size:9.5pt;font-family:Consolas'>"<span style='color:blue'>http://customer/adfs/services/trust</span>"<span style='color:blue'>></span><o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:9.5pt;font-family:Consolas'> SAML2<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:9.5pt;font-family:Consolas;color:blue'> </</span><span style='font-size:9.5pt;font-family:Consolas;color:#A31515'>SSO</span><span style='font-size:9.5pt;font-family:Consolas;color:blue'>></span><span style='font-size:9.5pt;font-family:Consolas'><o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:9.5pt;font-family:Consolas;color:blue'> </</span><span style='font-size:9.5pt;font-family:Consolas;color:#A31515'>Sessions</span><span style='font-size:9.5pt;font-family:Consolas;color:blue'>></span><span style='font-size:9.5pt;font-family:Consolas'><o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:9.5pt;font-family:Consolas;color:blue'> <</span><span style='font-size:9.5pt;font-family:Consolas;color:#A31515'>MetadataProvider</span><span style='font-size:9.5pt;font-family:Consolas;color:blue'> </span><span style='font-size:9.5pt;font-family:Consolas;color:red'>type</span><span style='font-size:9.5pt;font-family:Consolas;color:blue'>=</span><span style='font-size:9.5pt;font-family:Consolas'>"<span style='color:blue'>XML</span>"<span style='color:blue'> </span><span style='color:red'>uri</span><span style='color:blue'>=</span>"<span style='color:blue'>https://customer/FederationMetadata/2007-06/FederationMetadata.xml</span>"<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:9.5pt;font-family:Consolas;color:blue'> </span><span style='font-size:9.5pt;font-family:Consolas;color:red'>backingFilePath</span><span style='font-size:9.5pt;font-family:Consolas;color:blue'>=</span><span style='font-size:9.5pt;font-family:Consolas'>"<span style='color:blue'>customer.xml</span>"<span style='color:blue'> </span><span style='color:red'>reloadInterval</span><span style='color:blue'>=</span>"<span style='color:blue'>180000</span>"<span style='color:blue'> /><o:p></o:p></span></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Then when I go to this virtual in the IIS now, if I will get to the login window and after typing in username/password.<o:p></o:p></p><p class=MsoNormal>I get redirected back to our server<o:p></o:p></p><p class=MsoNormal>But I end up at <a href="https://myServer/Shibboleth.sso/SAML2/POST">https://myServer/Shibboleth.sso/SAML2/POST</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p><span style='font-size:8.5pt;font-family:"Verdana","sans-serif"'>The system encountered an error at Mon Aug 05 13:27:04 2013<o:p></o:p></span></p><p><span style='font-size:8.5pt;font-family:"Verdana","sans-serif"'>To report this problem, please contact the site administrator at<a href="mailto:root@localhost">root@localhost</a>.<o:p></o:p></span></p><p><span style='font-size:8.5pt;font-family:"Verdana","sans-serif"'>Please include the following message in any email:<o:p></o:p></span></p><p class=error><span style='font-size:8.5pt;font-family:"Verdana","sans-serif"'>opensaml::FatalProfileException at (https://myServer/Shibboleth.sso/SAML2/POST)<o:p></o:p></span></p><p><span style='font-size:8.5pt;font-family:"Verdana","sans-serif"'>Unable to establish security of incoming assertion.<o:p></o:p></span></p><p><span style='font-size:8.5pt;font-family:"Verdana","sans-serif"'><o:p> </o:p></span></p><p><span style='font-size:8.5pt;font-family:"Verdana","sans-serif"'>In the Shibd.log<o:p></o:p></span></p><p><span style='font-size:8.5pt;font-family:"Verdana","sans-serif"'>I can read<br>2013-08-06 10:49:26 WARN Shibboleth.SSO.SAML2 [1]: no metadata found, can't establish identity of issuer (http://customer/adfs/services/trust)<o:p></o:p></span></p><p><span style='font-size:8.5pt;font-family:"Verdana","sans-serif"'>2013-08-06 10:49:26 WARN Shibboleth.SSO.SAML2 [1]: detected a problem with assertion: Unable to establish security of incoming assertion.<o:p></o:p></span></p><p>Google has not been my friend in solving this, so is there anyone on this list that has some ideas of what I’m doing wrong?<o:p></o:p></p><p>Thanks<o:p></o:p></p><p>Niklas<span style='font-size:8.5pt;font-family:"Verdana","sans-serif"'><o:p></o:p></span></p></div></body></html>