<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; ">
<div>
<div><font>Hi,</font></div>
<div><br>
</div>
<div>I am trying to implement following scenario,</div>
<div>
<div><br>
</div>
<div>1. User will access specific URL e.g. mydomain.domain.com</div>
<div>2. Apache receive this request and based on entityID https://mydomain.domain.com, user should be redirected to IDP URL.</div>
<div>3- Once User authenticated, IDP returned with SAML Token and Apache/Shibboleth should allow user to access actual contents e.g. https://mydomain.domain.com pass SAML authentication because of Akamai authentication token.</div>
<div><br>
</div>
<div>I have following questions if someone can help me here,</div>
</div>
<div><br>
</div>
<div>- I am using a domain name e.g. https://mydomain.domain.com and I used it as entityID, do I need to use following URL as 'https://mydomain.domain.com/shibboleth?</div>
<div><br>
</div>
<div>- I am using external IDP and they provided me metadata which I have copied in /etc/shibboleth/. I used following configuration to define this metadata but what URL I should use and entityID under SSO? When I have defined metadata file then do I really
need to define entityID under <sso? </div>
<div><br>
</div>
<div>- Few documentations saying that use this type of url, https://myidp.domain.com/idp/shibboleth? We have different URL in metadata than why we need to define it here?</div>
<div><br>
</div>
<div>- After defining all these property how request will route to idp once use hit https://mydomain.domain.com?</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div><SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"</div>
<div>xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"</div>
<div>xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"</div>
<div>xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"</div>
<div>xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"</div>
<div>clockSkew="180"></div>
<div><br>
</div>
<div>
<div><ApplicationDefaults entityID="https://mydomain.domain.com"</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>REMOTE_USER="eppn persistent-id targeted-id"></div>
<div><br>
</div>
</div>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><Sessions lifetime="28800" timeout="3600" relayState="ss:mem"</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>checkAddress="false" handlerSSL="true" cookieProps="https"></div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><SSO entityID="https://mydomain.domain.com"></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>SAML2 SAML1</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span></SSO></div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><!-- SAML and local-only logout. --></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><Logout>SAML2 Local</Logout></div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><!-- Extension service that generates "approximate" metadata based on SP configuration. --></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><Handler type="MetadataGenerator" Location="/Metadata" signing="false"/></div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><!-- Status reporting service. --></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/></div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><!-- Session diagnostic service. --></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><Handler type="Session" Location="/Session" showAttributeValues="false"/></div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><!-- JSON feed of discovery information. --></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><Handler type="DiscoveryFeed" Location="/DiscoFeed"/></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span></Sessions></div>
<div><br>
</div>
<div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><Errors supportContact="root@localhost"</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>helpLocation="/about.html"</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>styleSheet="/shibboleth-sp/main.css"/></div>
<div><br>
</div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><!-- Example of locally maintained metadata. --></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><MetadataProvider type="XML" file="saml20_BP_metadata_TFIM_UAT_22AUG2013.xml"/></div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><!-- Map to extract attributes from SAML assertions. --></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/></div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><!-- Use a SAML query if no attributes are supplied during SSO. --></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><AttributeResolver type="Query" subjectMatch="true"/></div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><!-- Default filtering policy for recognized attributes, lets other data pass. --></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/></div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><!-- Simple file-based resolver for using a single keypair. --></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/></div>
<div><br>
</div>
<div><br>
</div>
<div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><ApplicationOverride id="aralappid" entityID="https://mydomain.domain.com"></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span></ApplicationOverride></div>
<div><br>
</div>
<div></ApplicationDefaults></div>
<div><br>
</div>
<div><!-- Policies that determine how to process and authenticate runtime messages. --></div>
<div><SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/></div>
<div><br>
</div>
<div><!-- Low-level configuration about protocols and bindings available for use. --></div>
<div><ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/></div>
<div><br>
</div>
<div></SPConfig></div>
<div><br>
</div>
<div><br>
</div>
<div>- I have multiple virtual hosts defined in vhost.conf and would like to trigger shibboleth for one virtual host? I have defined following in vhost.conf file.</div>
<div><br>
</div>
<div>
<div><Location /></div>
<div>AuthType shibboleth</div>
<div>ShibCompatWith24 On</div>
<div>ShibRequestSetting requireSession 1</div>
<div>require shib-session</div>
<div></Location></div>
<div><br>
</div>
<div>Can some one help me here.</div>
<div><br>
</div>
</div>
<div><br>
</div>
</div>
</div>
<div><br>
</div>
<div>Kind Regards,</div>
<div>Junaid Akbar</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; "><br>
</div>
</div>
<div style="color: rgb(0, 0, 0); font-family: Consolas, monospace; font-size: 12px; ">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Consolas, monospace; font-size: 12px; ">
On 18/08/2014 14:27, "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:</div>
<div style="color: rgb(0, 0, 0); font-family: Consolas, monospace; font-size: 12px; ">
<br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="color: rgb(0, 0, 0); font-family: Consolas, monospace; font-size: 12px; border-left-color: rgb(181, 196, 223); border-left-width: 5px; border-left-style: solid; padding: 0px 0px 0px 5px; margin: 0px 0px 0px 5px; ">
<div>On 8/18/14, 4:42 AM, "<a href="mailto:junaid.akbar@wipro.com">junaid.akbar@wipro.com</a>" <<a href="mailto:junaid.akbar@wipro.com">junaid.akbar@wipro.com</a>></div>
<div>wrote:</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div><br>
</div>
<div>Can some one help me to correctly configure shibboleth so that specific</div>
<div>virtual host can be redirected to out idp. Please share values or</div>
<div>properties trigger this redirection?</div>
</blockquote>
<div><br>
</div>
<div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent</a></div>
<div><br>
</div>
<div>-- Scott</div>
<div><br>
</div>
<div>-- </div>
<div>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></div>
<div><br>
</div>
</blockquote>
<p>The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments.</p>
<p>WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.</p>
<p>www.wipro.com</p>
</body>
</html>