<div dir="ltr"><div>Peter,</div><div> </div><div>Thanks so much for answering our questions so well.</div><div> </div><div>We thought, perhaps wrongly, that each "customer" should have their own CERT, Key, and <span>ACS</span> lines. The reason for that is because, in this case, there's are NOT separate <span>VHOSTS</span> for each customer. The application is implemented in "paths" from the file tree:</div>
<div> </div><div>/home/<span>wwwroot</span>/customer01\app01022</div><div>/home/<span>wwwroot</span>/customer02\app010310</div><div>[...etc...]</div><div> </div><div>We have to have some way to segregate the customers as many have different released variables (so different REMOTE_USER values), different Session elements (lifetime/timeout lengths), etc. </div>
<div> </div><div>So without <span>VHOSTS</span>, we thought each customer should have their own CERT and key.</div><div>If that is not a good idea, or has no positive side, we'll drop it.</div><div> </div><div>The second part of our question concerned the different <span>ACS</span> lines. We knew they had to have different index numbers so as not to collide with the existing ones.</div>
<div> </div><div>So that means we have this as the "generated" <span>metadata</span>:</div><div> </div><div><<span>md</span>:<span>EntityDescriptor</span> <span>xmlns</span>:<span>md</span>="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:<span>metadata</span>" ID="_7f02024667d46287<br>
aafdd4ecdfd0627d2010938b" <span>entityID</span>="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>"></div><div> </div><div>But the "customer" <span>entityID</span> are different:</div>
<div> </div><div><span>entityID</span>="<a href="https://apps.corp.com/customer01/Shibboleth">https://apps.corp.com/customer01/Shibboleth</a>.<span>sso</span></div><div> </div><div> </div><div>and the associated <span>ACS</span> lines need to have unique <span>indeces</span> (example):<br>
<br> <<span>md</span>:<span>AssertionConsumerService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:HTTP-POST-<span>SimpleSign</span>" Location="<a href="https://apps.corp.com/customer01/Shibboleth">https://apps.corp.com/customer01/Shibboleth</a>.<span>sso</span>/SAML2/POST-<span>SimpleSign</span>" index="22"/></div>
<div> </div><div> </div><div>That was the goal. Now, if we're way off here, then we'd love to see the correct way.</div><div> </div><div>But if we need to add multiple customer <span>ACS</span> lines, and each customer has a unique <span>entityID</span>, CERT and Key, is there a way to combine those into one file so we only have to publish one file.</div>
<div> </div><div> </div><div>Of course, another choice is to take the "Generated file" and just manually adjust it:</div><div> </div><div>So this (generated):</div><div> </div><div><<span>md</span>:<span>EntityDescriptor</span> <span>xmlns</span>:<span>md</span>="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:<span>metadata</span>" ID="_7f02024667d46287aafdd4ecdfd0627d2010938b" <span>entityID</span>="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>"></div>
<div> </div><div> <<span>md</span>:<span>ArtifactResolutionService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:SOAP" Location="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>/Artifact/SOAP" index="1"/><br>
<<span>md</span>:<span>SingleLogoutService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:SOAP" Location="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>/<span>SLO</span>/SOAP"/><br>
<<span>md</span>:<span>SingleLogoutService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:HTTP-Redirect" Location="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>/<span>SLO</span>/Redirect"/><br>
<<span>md</span>:<span>SingleLogoutService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:HTTP-POST" Location="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>/<span>SLO</span>/POST"/><br>
<<span>md</span>:<span>SingleLogoutService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:HTTP-Artifact" Location="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>/<span>SLO</span>/Artifact"/><br>
<<span>md</span>:<span>AssertionConsumerService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:HTTP-POST" Location="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>/SAML2/POST" index="1"/><br>
<<span>md</span>:<span>AssertionConsumerService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:HTTP-POST-<span>SimpleSign</span>" Location="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>/SAML2/POST-<span>SimpleSign</span>" index="2"/><br>
<<span>md</span>:<span>AssertionConsumerService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:HTTP-Artifact" Location="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>/Shibboleth.<span>sso</span>/SAML2/Artifact" index="3"/><br>
<<span>md</span>:<span>AssertionConsumerService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:<span>PAOS</span>" Location="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>/SAML2/<span>ECP</span>" index="4"/><br>
<<span>md</span>:<span>AssertionConsumerService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:1.0:profiles:browser-post" Location="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>/<span>SAML</span>/POST" index="5"/> <br>
<<span>md</span>:<span>AssertionConsumerService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:1.0:profiles:artifact-01" Location="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>/<span>SAML</span>/Artifact" index="6"/></div>
<div><br> </div><div> </div><div>Would become this:</div><div> </div><div> </div><div><<span>md</span>:<span>EntityDescriptor</span> <span>xmlns</span>:<span>md</span>="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:<span>metadata</span>" ID="_7f02024667d46287aafdd4ecdfd0627d2010938b" <span>entityID</span>="<a href="https://apps.corp.com/customer01/Shibboleth">https://apps.corp.com/customer01/Shibboleth</a>.<span>sso</span>"></div>
<div> </div><div> <<span>md</span>:<span>ArtifactResolutionService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:SOAP" Location="<a href="https://apps.corp.com/customer01/Shibboleth">https://apps.corp.com/customer01/Shibboleth</a>.<span>sso</span>/Artifact/SOAP" index="1"/><br>
<<span>md</span>:<span>SingleLogoutService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:SOAP" Location="<a href="https://apps.corp.com/customer01/Shibboleth">https://apps.corp.com/customer01/Shibboleth</a>.<span>sso</span>/<span>SLO</span>/SOAP"/><br>
<<span>md</span>:<span>SingleLogoutService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:HTTP-Redirect" Location="<a href="https://apps.corp.com/customer01/Shibboleth">https://apps.corp.com/customer01/Shibboleth</a>.<span>sso</span>/<span>SLO</span>/Redirect"/><br>
<<span>md</span>:<span>SingleLogoutService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:HTTP-POST" Location="<a href="https://apps.corp.com/customer01/Shibboleth">https://apps.corp.com/customer01/Shibboleth</a>.<span>sso</span>/<span>SLO</span>/POST"/><br>
<<span>md</span>:<span>SingleLogoutService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:HTTP-Artifact" Location="<a href="https://apps.corp.com/customer01/Shibboleth">https://apps.corp.com/customer01/Shibboleth</a>.<span>sso</span>/<span>SLO</span>/Artifact"/><br>
<<span>md</span>:<span>AssertionConsumerService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:HTTP-POST" Location="<a href="https://apps.corp.com/customer01/Shibboleth">https://apps.corp.com/customer01/Shibboleth</a>.<span>sso</span>/SAML2/POST" index="1"/><br>
<<span>md</span>:<span>AssertionConsumerService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:HTTP-POST-<span>SimpleSign</span>" Location="<a href="https://apps.corp.com/Shibboleth">https://apps.corp.com/Shibboleth</a>.<span>sso</span>/SAML2/POST-<span>SimpleSign</span>" index="2"/><br>
<<span>md</span>:<span>AssertionConsumerService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:HTTP-Artifact" Location="<a href="https://apps.corp.com/customer01/Shibboleth">https://apps.corp.com/customer01/Shibboleth</a>.<span>sso</span>/Shibboleth.<span>sso</span>/SAML2/Artifact" index="3"/><br>
<<span>md</span>:<span>AssertionConsumerService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:2.0:bindings:<span>PAOS</span>" Location="<a href="https://apps.corp.com/customer01/Shibboleth">https://apps.corp.com/customer01/Shibboleth</a>.<span>sso</span>/SAML2/<span>ECP</span>" index="4"/><br>
<<span>md</span>:<span>AssertionConsumerService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:1.0:profiles:browser-post" Location="<a href="https://apps.corp.com/customer01/Shibboleth">https://apps.corp.com/customer01/Shibboleth</a>.<span>sso</span>/<span>SAML</span>/POST" index="5"/> <br>
<<span>md</span>:<span>AssertionConsumerService</span> Binding="urn:oasis:names:<span>tc</span>:<span>SAML</span>:1.0:profiles:artifact-01" Location="<a href="https://apps.corp.com/customer01/Shibboleth">https://apps.corp.com/customer01/Shibboleth</a>.<span>sso</span>/<span>SAML</span>/Artifact" index="6"/><br>
</div><div> </div><div>And we just send the second version to the various customer <span>IdPs</span>. Each one <span>get's</span> a different "modified" <span>IdP</span>.</div><div> </div><div>One way or the other, the endpoints have to be unique, and the <span>IdPs</span> need to have the <span>entityID</span>, endpoints and <span>metadata</span> they need.</div>
<div> </div><div>Eventually we'll be Federating so everything will have to be published anyway. However, for now, our question revolved around exactly what to send to the customer <span>IdP</span> servers.</div><div> </div>
<div>Many thanks for all your help.</div><div> </div><div> </div><div> <br clear="all"></div><div class="gmail_extra"><div>-- <span>RGS</span><br><br>==================================<br>Roy G. Specter<br><a href="mailto:roygspectech8@gmail.com" target="_blank">roygspectech8@gmail.com</a><br>
========================================<br></div>
<br><br><div class="gmail_quote">On Sat, Sep 14, 2013 at 9:34 AM, Peter <span>Schober</span> <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.<span>schober</span>@<span>univie</span>.ac.at</a>></span> wrote:<br>
<blockquote style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid" class="gmail_quote">* Roy Spectech <<a href="mailto:roygspectech8@gmail.com">roygspectech8@gmail.com</a>> [2013-09-13 19:27]:<br>
<div class="im">> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<br>
> ID="_7f02024667d46287aafdd4ecdfd0627d2010938b" entityID="<br>
> <a href="https://app1.corp.com/Shibboleth.sso" target="_blank">https://app1.corp.com/Shibboleth.sso</a>"><br>
<br>
</div>Why did you add the "Shibboleth.sso" part there? The software didn't<br>
do that and it doesn't make much sense (the entityID is just a name,<br>
and as such doesn't have to map to a Shibboleth content handler).<br>
<div class="im"><br>
> </md:EntityDescriptor><br>
><br>
> This worked just fine with our partners and customers.<br>
><br>
> Notice all the "<md: ... </md: pairs.<br>
<br>
</div>The XML namespace used (and mapped to "md" above) is irrelevant here.<br>
<div class="im"><br>
> We then added the endpoints and CERT for one of new customers. We generated<br>
> their CERT pair with KEYGEN and their metadata file with METAGEN. When we<br>
> went to add this new meta file to the existing metadata file things blew up.<br>
<br>
</div>If you you mean you concatenated the two XML files together you've<br>
generated non-well-formed (and schema invalid) XML. XML needs a common<br>
root element, you can't have <foo></foo><foo></foo> in a single instance.<br>
<div class="im"><br>
> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:<br>
> ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>" entityID="<br>
> <a href="https://app1.corp.com/customer2301/Shibboleth.sso" target="_blank">https://app1.corp.com/customer2301/Shibboleth.sso</a>"><br>
<br>
</div>You should start by explaining your use case and why every "customer"<br>
would need a seperate entityID for your SP. If you did that before<br>
please provide a pointer to the archives.<br>
<br>
> </md:EntityDescriptor><br>
<div class="im">><br>
> This metadata also has the same <md:..</md pairs. However, none of our<br>
> partners or customers could import the new file. All complained that the<br>
> XML was rejected.<br>
<br>
</div>If you have two seperate files and one validates and the other doesn't<br>
that would indicate the second one wasn't valid. So check for that,<br>
with the methods the software provides, or the list of tools the<br>
documentation mentions.<br>
<div class="im"><br>
> We're using the supplied tools (keygen.sh, metagen.sh) to create<br>
</div>> metadatafiles for new customers (who appear as a different path in<br>
<div class="im">> our application tree). We want to add the customer endpoints and<br>
> entityID's to the main metadata file that we publish.<br>
<br>
</div>If you want the content of both files within a single file (why?)<br>
you'd need to wrap them in a comon root element, an<br>
<EntitiesDescriptor> element in this case.<br>
<div class="im"><br>
> We know we have to care/craft/adjust/edit our metadata. Clearly the<br>
> supplied tools are just a starting point, but what guides to people<br>
> use to make sure the XML is correct for Shibboleth IdP's to<br>
> "consume." Is there a "generic metadata file" or documented guide<br>
> that we can refer to for this type of additional meta?<br>
<br>
</div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP</a><br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataCorrectness" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataCorrectness</a><br>
<br>
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div></div>