<div dir="ltr"><div><div><div><div><div><div><div><div>Scott,<br><br></div>We're having trouble defining the handler.<br><br></div>The override:<br><br> <ApplicationOverride id="customer1"<br> REMOTE_USER="eppn persistent-id targeted-id"><br>
<Sessions lifetime="28800" timeout="3600" checkAddress="false"<br> handlerURL="/customer1/Shibboleth.sso" handlerSSL="false"><br> <SessionInitiator type="Chaining" Location="/Login" id="customer1_test"<br>
relayState="cookie"<br> entityID="<a href="https://sso.idpmain.customer1.com/idp/shibboleth">https://sso.idpmain.customer1.com/idp/shibboleth</a>"><br> <SessionInitiator type="SAML2" acsIndex="121"<br>
template="bindingTemplate.html"/><br> <SessionInitiator type="Shib1" acsIndex="125"/><br> </SessionInitiator><br><br><br></div>The default shib.conf file (/etc/httpd/conf.d/shib.conf):<br>
<br>#<br># Load the Shibboleth module.<br>#<br>LoadModule mod_shib /usr/lib/shibboleth/mod_shib_22.so<br>#<br># Ensures handler will be accessible.<br>#<br><Location /Shibboleth.sso><br> Satisfy Any<br> Allow from all<br>
</Location><br>#<br><Location /secure><br> AuthType shibboleth<br> ShibRequestSetting requireSession 1<br> require valid-user<br></Location><br><br><br></div>So this works:<br><br><a href="https://apps1.ourcomp.com/Shibboleth.sso/Session">https://apps1.ourcomp.com/Shibboleth.sso/Session</a><br>
<br>10.5.174.23 - - [09/Sep/2013:13:30:09 -0400] "GET /Shibboleth.sso/Session HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"<br>10.5.174.23 - - [09/Sep/2013:13:30:38 -0400] "GET /Shibboleth.sso/Session HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"<br>
10.5.174.23 - - [09/Sep/2013:13:30:39 -0400] "GET /Shibboleth.sso/Session HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"<br><br></div>And the HTTPD logs agree (200 file found):<br>
<br>10.5.174.23 - - [09/Sep/2013:13:30:09 -0400] "GET /Shibboleth.sso/Session HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"<br>10.5.174.23 - - [09/Sep/2013:13:30:38 -0400] "GET /Shibboleth.sso/Session HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"<br>
10.5.174.23 - - [09/Sep/2013:13:30:39 -0400] "GET /Shibboleth.sso/Session HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"<br><br><br></div>However, the extended version fails (404):<br>
<br><br>URL:<br><a href="https://apps1.ourcomp.com/customer1/Shibboleth.sso/Session">https://apps1.ourcomp.com/customer1/Shibboleth.sso/Session</a><br><br> 404 Not Found<br><br><br>access.log:<br><br>10.5.174.23 - - [09/Sep/2013:12:45:55 -0400] "GET
/customer1/Shibboleth.sso/Session HTTP/1.1"404 226 "-" "Mozilla/5.0
(compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"<br>10.5.174.23
- - [09/Sep/2013:12:55:12 -0400] "GET /customer1/index.php HTTP/1.1"
200 69505 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64;
Trident/5.0)"<br>10.5.174.23 - - [09/Sep/2013:12:55:29 -0400] "GET
/customer1/Shibboleth.sso/Session HTTP/1.1"404 226 "-" "Mozilla/5.0
(compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"<br><br><br><br>error.log:<br><br>[Mon Sep 09 12:27:41 2013] [error] [client 10.5.174.23] File does not exist: /home/httpd/customer1/Shibboleth.sso<br>[Mon Sep 09 12:45:55 2013] [error] [client 10.5.174.23] File does not exist: /home/httpd/customer1/Shibboleth.sso<br>
[Mon Sep 09 12:55:29 2013] [error] [client 10.5.174.23] File does not exist: /home/httpd/customer1/Shibboleth.sso<br>[Mon Sep 09 12:59:06 2013] [error] [client 10.5.174.23] File does not exist: /home/httpd/customer1/Shibboleth.sso<br>
[Mon Sep 09 12:59:07 2013] [error] [client 10.5.174.23] File does not exist: /home/httpd/customer1/Shibboleth.sso<br><br><br><br>Works for base URL though (/) :<br><br><a href="https://apps.ourcomp.com/Shibboleth.sso/Session">https://apps.ourcomp.com/Shibboleth.sso/Session</a><br>
<br> A valid session was not found.<br><br><br>10.5.174.23 - - [09/Sep/2013:13:30:09 -0400] "GET /Shibboleth.sso/Session HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"<br>
10.5.174.23 - - [09/Sep/2013:13:30:38 -0400] "GET /Shibboleth.sso/Session HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"<br>10.5.174.23 - - [09/Sep/2013:13:30:39 -0400] "GET /Shibboleth.sso/Session HTTP/1.1" 200 112 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"<br>
<br></div></div><div><div><br><br>We tried adding the customer1 label in the location block, same results though:<br><br>#<br> <Location /customer1/Shibboleth.sso><br> SetHandler shib<br> </Location><br>
#<br><br></div><div>--AND--<br><br></div><div>#<br> <Location /customer1/Shibboleth.sso/*><br> SetHandler shib<br> </Location><br>#<br><br><br><br>What are we missing?<br><br><br><div><div><div>
<br></div></div></div></div></div><div class="gmail_extra"><br clear="all"><div>-- RGS<br><br>==================================<br>Roy G. Specter<br><a href="mailto:roygspectech8@gmail.com" target="_blank">roygspectech8@gmail.com</a><br>
========================================<br></div>
<br><br><div class="gmail_quote">On Mon, Sep 9, 2013 at 10:00 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div class="im">On 9/8/13 8:10 PM, "Roy Spectech" <<a href="mailto:roygspectech8@gmail.com">roygspectech8@gmail.com</a>> wrote:<br>
<br>
>would the custom handlerURLs be these:<br>
><br>
>handlerURL="/customer1/Shibboleth.sso"<br>
>handlerURL="/customer2/Shibboleth.sso"<br>
>handlerURL="/customer3/Shibboleth.sso"<br>
<br>
</div>Probably. The amount of XML you're looking at is beyond horrendous though.<br>
<div class="im"><br>
>I also like your summary of the single entityID and multiple endpoint<br>
>versus multiple entityIDs with a single set of endpoints.."both kinda<br>
>suck!"<br>
><br>
>But, since we have to use one or the other, uhm, which sucks less?<br>
<br>
</div>That depends entirely on the federation(s) involved and anything else that<br>
impacts metadata management, but the single entityID model is usually<br>
easier.<br>
<div class=""><div class="h5"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div>