<html><body><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1424966679493_47396" class="" style="">I am going to be spinning up 2 new 2.5.3 SP servers (Windows IIS 7) to run along with my existing 2.3.1 SP servers. These new servers will use a 3 year cert and also provide connections for those customers for whom a bug in 2.3.1 prevents them from connecting to us.</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style="">On my 2.3.1 system, we prefer that our users use the SP initiated link and support said link as it allows access via our mobile applications that cannot be replicated with an IDP initiated link. On the 2.3.1 system, I will typically supply an SP initiated link that has this format:</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style="">https://shib.lynda.com/Shibboleth.sso/InCommon</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style="">Appended to that will be a querystring containing providerId with the entityID of the enterprise, and a target value as well. Here is an example:</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style="">https://shib.lynda.com/Shibboleth.sso/InCommon?providerId=urn:mace:incommon:someschool.edu&target=https://shib.lynda.com/InCommon</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style="">So this part: https://shib.lynda.com/Shibboleth.sso invokes the IIS sso extentsion and the /InCommon provides the path to the session initiator (it is /UBC for another customer as shall be seen below).</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style="">In my 2.3.1 config, I have the following 2 definitions:</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><span class="" style="white-space:pre"> </span><!-- Session Initiator for InCommon --></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><span class="" style="white-space:pre"> </span> </div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><span class="" style="white-space:pre"> </span><SessionInitiator type="Chaining" Location="/InCommon" isDefault="true" id="InCommon" relayState="cookie"></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> <SessionInitiator type="SAML2" acsByIndex="false" acsIndex="1" template="bindingTemplate.html"/></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> <SessionInitiator type="Shib1" acsIndex="2"/></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> </SessionInitiator></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><span class="" style="white-space:pre"> </span><!-- Session Initiator for University of British Columbia --><span class="" style="white-space:pre"> </span> </div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><span class="" style="white-space:pre"> </span> </div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><span class="" style="white-space:pre"> </span> <SessionInitiator type="Chaining" Location="/UBC" isDefault="true" id="UBC" relayState="cookie" entityID="https://shibboleth2.id.ubc.ca/idp/shibboleth"></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> <SessionInitiator type="SAML2" acsIndex="1" forceAuthn="true" template="bindingTemplate.html"/></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> <SessionInitiator type="Shib1" acsIndex="5"/></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> </SessionInitiator></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style="">Originally, I only had the InCommon one and I used it for all customers. UBC asked us to make one for them specifically so that they could have the /ubc path and we accommodated that as well so we currently have 2 in our setup as you can see.</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style="">Looking at the docs for 2.5.3, I see there is a new stanza called <SSO> that is supposed to replace the existing session initiator(s): https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style="">Currently, on the 2.5.3 test box I am running, I enabled this config (which appears to be fine):</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> <ApplicationDefaults entityID="ShibbolethTestVM"</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> REMOTE_USER="eppn persistent-id targeted-id"></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> checkAddress="true" handlerSSL="true" cookieProps="https"></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style="" dir="ltr"><span class="" style="white-space:pre"> </span><!-- Session Initiator for New Shib 2.5.3--></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><span class="" style="white-space:pre"> </span> </div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><span class="" style="white-space:pre"> </span><SessionInitiator type="Chaining" Location="/lyndaSSO" isDefault="true" id="InCommon" relayState="cookie"></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> <SessionInitiator type="SAML2" acsByIndex="false" acsIndex="1" template="bindingTemplate.html"/></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> <SessionInitiator type="Shib1" acsIndex="2"/></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> </SessionInitiator></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><span class="" style="white-space:pre"> </span><!--<SSO discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">SAML2 SAML1</SSO>--></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> <!-- SAML and local-only logout. </div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""> <Logout>SAML2 Local</Logout>--></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><span class="" style="white-space:pre"> </span></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style="">My question is this: Is it possible to replace the session initiator definition that I have there for /lyndaSSO with the <SSO> stanza that will allow me to still use the same SP link format (i.e. <a href="https://shib.lynda.com/Shibboleth.sso/InCommon?providerId=urn:mace:incommon:someschool.edu&target=https://shib.lynda.com/InCommon)?" id="yui_3_16_0_1_1424966679493_47580">https://shib.lynda.com/Shibboleth.sso/InCommon?providerId=urn:mace:incommon:someschool.edu&target=https://shib.lynda.com/InCommon</a>)?</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style="" dir="ltr">If so, how would I replicate that session initiator using the SSO tag?</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1424966679493_47396" class="" style="">Thanks!</div><div id="yui_3_16_0_1_1424966679493_47396" class="" style=""><br class="" style=""></div></div></body></html>