<div dir="ltr"><div><div><div><div>Hello, <br></div>So after some research I manage to
set the right shibboleth2.xml for setting the cookies scope. Therefore, I
got some strange behaviour:<br></div>- I retook the same use case : One
SP and two IdP where each IdP will be used when the user access a
specific URL. So, I have two hostname pointing at the same website: <a href="http://wso2.shibboleth.example.com" target="_blank">wso2.shibboleth.example.com</a> and <a href="http://openam.shibboleth.example.com" target="_blank">openam.shibboleth.example.com</a>.<br></div>- The httpd config look like this : <br><div style="margin-left:80px">#wso2<br><VirtualHost *:80><br> ServerName <a href="http://wso2.shibboleth.example.com" target="_blank">wso2.shibboleth.example.com</a><br><br> DocumentRoot "/var/www/html/"<span class="im"><br> <Location /secure><br> AuthType shibboleth<br> ShibRequestSetting requireSession 1<br></span> ShibRequestSetting applicationId default<br> require shib-session<br> </Location><br> <Location /Shibboleth.sso><br> Satisfy Any<br> Allow from all<span class="im"><br> </Location><br> <Location /><br> AuthType shibboleth<br> Require shibboleth<br> </Location><br></VirtualHost><br><br></span>#openam<br> <VirtualHost *:80><br> ServerName <a href="http://openam.shibboleth.example.com" target="_blank">openam.shibboleth.example.com</a><br> DocumentRoot "/var/www/html/"<span class="im"><br> <Location /secure><br> AuthType shibboleth<br> ShibRequestSetting requireSession 1<br></span> ShibRequestSetting applicationId openam-id<br> require shib-session<br> </Location><br> <Location /Shibboleth.sso><br> Satisfy Any<br> Allow from all<span class="im"><br> </Location><br> <Location /><br> AuthType shibboleth<br> Require shibboleth<br> </Location><br></VirtualHost><br></span></div>- The shibboleth2.xml is configured like this : <br><div style="margin-left:80px"><span class="im"><SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"<br> xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"<br></span><span class="im"> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"<br></span><span class="im"> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"<br></span><span class="im"> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<br> clockSkew="180"><br><br> <ApplicationDefaults<br> entityID="<a href="http://sp.shibboleth.example.com" target="_blank">sp.shibboleth.example.com</a>"<br> REMOTE_USER="eppn persistent-id targeted-id"><br><br> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"<br></span> checkAddress="false" handlerURL="/Shibboleth.sso" handlerSSL="false" cookieProps="; path=/; domain=<a href="http://example.com" target="_blank">example.com</a>; http"><span class="im"><br> <SSO entityID="wso2"<br> discoveryProtocol="SAMLDS" discoveryURL="<a href="https://wso2.example.com:9443/samlsso" target="_blank">https://wso2.example.com:9443/samlsso</a>"><br> SAML2<br> </SSO><br> <Logout>SAML2 Local</Logout><br> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br> <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/><br> <Handler type="Session" Location="/Session" showAttributeValues="false"/><br> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br> </Sessions><br></span> <MetadataProvider type="XML" validate="true" file="/etc/shibboleth/wso2_metadata.xml"/><span class="im"><br> <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/><br> <AttributeResolver type="Query" subjectMatch="true"/><br> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/><br><br></span> <ApplicationOverride id="openam-id"><span class="im"><br><br> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"<br></span> checkAddress="false" handlerSSL="false" cookieProps="; path=/; domain=<a href="http://example.com" target="_blank">example.com</a>; http"><span class="im"><br> <SSO entityID="openam"<br> discoveryProtocol="SAMLDS" discoveryURL="<a href="http://openam.example.com:7777/openam/SSOPOST/metaAlias/idp" target="_blank">http://openam.example.com:7777/openam/SSOPOST/metaAlias/idp</a>"><br> SAML2<br> </SSO><br> <Logout>SAML2 Local</Logout><br> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br> <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/><br></span><span class="im"> <Handler type="Session" Location="/Session" showAttributeValues="false"/><br> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br> </Sessions><br> <MetadataProvider type="XML" validate="true" file="/etc/shibboleth/openam_metadata.xml"/><br><br></span><span class="im"> </ApplicationOverride><br><br> </ApplicationDefaults><br><br> <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/><br> <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/><br><br></SPConfig><br></span></div><br></div><div>When I try to access the website with the fqdn : <a href="http://wso2.shibboleth.example.com" target="_blank">wso2.shibboleth.example.com</a>, I succeed at authenticating to wso2. But when I access the website with <a href="http://openam.shibboleth.example.com" target="_blank">openam.shibboleth.example.com</a>, I'm getting redirected to wso2 instead of openam. Here's the logs of shibd.log:<br></div><br>2016-05-19 08:21:02 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: message encoded, sending redirect to client<br>2016-05-19 08:23:41 DEBUG Shibboleth.Listener [2]: dispatching message (default::getHeaders::Application)<br>2016-05-19 08:23:41 DEBUG Shibboleth.Config [2]: timestamp of local resource changed, elevating to a write lock<br>2016-05-19 08:23:41 INFO Shibboleth.Config [2]: change detected, signaling reload thread...<br>2016-05-19 08:23:41 INFO Shibboleth.Config : reloading local resource...<br>2016-05-19 08:23:41 DEBUG Shibboleth.Config : loading configuration from external resource...<br>2016-05-19 08:23:41 INFO Shibboleth.Config : loaded XML resource (/etc/shibboleth/shibboleth2.xml)<br>2016-05-19 08:23:41 INFO Shibboleth.Config : Shibboleth SP Version 2.5.6<br>2016-05-19
08:23:41 INFO Shibboleth.Config : Library versions: log4shib 1.0.9,
Xerces-C 3.1.3, XML-Security-C 1.7.3, XMLTooling-C 1.5.6, OpenSAML-C
2.5.5, Shibboleth 1.5.6<br>2016-05-19 08:23:41 INFO Shibboleth.Config : building SecurityPolicyProvider of type XML...<br>2016-05-19 08:23:41 DEBUG Shibboleth.SecurityPolicyProvider.XML : using local resource (/etc/shibboleth/security-policy.xml), will monitor for changes<br>2016-05-19 08:23:41 DEBUG Shibboleth.SecurityPolicyProvider.XML : loading configuration from external resource...<br>2016-05-19 08:23:41 INFO Shibboleth.SecurityPolicyProvider.XML : loaded XML resource (/etc/shibboleth/security-policy.xml)<br>2016-05-19 08:23:41 INFO OpenSAML.SecurityPolicyRule.Conditions : building SecurityPolicyRule of type Audience<br>2016-05-19 08:23:41 INFO OpenSAML.SecurityPolicyRule.Conditions : building SecurityPolicyRule of type Audience<br>2016-05-19 08:23:41 INFO OpenSAML.SecurityPolicyRule.Conditions : building SecurityPolicyRule of type Ignore<br>2016-05-19 08:23:41 INFO OpenSAML.SecurityPolicyRule.Conditions : building SecurityPolicyRule of type Ignore<br>2016-05-19 08:23:41 INFO OpenSAML.SecurityPolicyRule.Conditions : building SecurityPolicyRule of type Ignore<br>2016-05-19 08:23:41 INFO Shibboleth.Config : building ProtocolProvider of type XML...<br>2016-05-19 08:23:41 DEBUG Shibboleth.ProtocolProvider.XML : using local resource (/etc/shibboleth/protocols.xml), will not monitor for changes<br>2016-05-19 08:23:41 DEBUG Shibboleth.ProtocolProvider.XML : loading configuration from external resource...<br>2016-05-19 08:23:41 INFO Shibboleth.ProtocolProvider.XML : loaded XML resource (/etc/shibboleth/protocols.xml)<br>2016-05-19 08:23:41 WARN Shibboleth.Application : custom cookieProps setting should include "; secure" for SSL/TLS-only usage<br>2016-05-19 08:23:41 WARN Shibboleth.Application : handlerSSL should be enabled for SSL/TLS-enabled web sites<br>2016-05-19 08:23:41 INFO Shibboleth.Application : auto-configuring SSO initiation for protocol (SAML2)<br>2016-05-19 08:23:41 INFO Shibboleth.Application : adding SessionInitiator of type (SAML2) to chain (/Login)<br>2016-05-19 08:23:41 DEBUG Shibboleth.Listener [2]: dispatching message (default/Login::run::SAML2SI)<br>2016-05-19 08:23:41 DEBUG XMLTooling.StorageService [2]: inserted record (e09ae8b56591fbb67d836cb31addb597d1ecbb9615fc821dd0d46fe69d1c37ea) in context (RelayState) with expiration (1463646821)<br>2016-05-19 08:23:41 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [2]: validating input<br>2016-05-19 08:23:41 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [2]: marshalling, deflating, base64-encoding the message<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: starting to marshal samlp:AuthnRequest<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: creating root element to marshall<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: marshalling namespace attributes for XMLObject<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: marshalling text and child elements for XMLObject<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: starting to marshalling saml:Issuer<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: creating root element to marshall<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: marshalling namespace attributes for XMLObject<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: marshalling text and child elements for XMLObject<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: caching DOM for XMLObject<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: starting to marshalling samlp:NameIDPolicy<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: creating root element to marshall<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: marshalling namespace attributes for XMLObject<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: marshalling text and child elements for XMLObject<br>2016-05-19 08:23:41 INFO Shibboleth.Application : auto-configuring ArtifactResolution endpoints for protocol (SAML2)<br>2016-05-19 08:23:41 INFO Shibboleth.Application : adding ArtifactResolutionService for Binding (urn:oasis:names:tc:SAML:2.0:bindings:SOAP) at (/Artifact/SOAP)<br>2016-05-19 08:23:41 INFO Shibboleth.Listener : registered remoted message endpoint (default/Artifact/SOAP::run::SAML2Artifact)<br>2016-05-19 08:23:41 INFO Shibboleth.Application : auto-configuring SSO endpoints for protocol (SAML2)<br>2016-05-19 08:23:41 INFO Shibboleth.Application : adding AssertionConsumerService for Binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST) at (/SAML2/POST)<br>2016-05-19 08:23:41 INFO Shibboleth.Listener : registered remoted message endpoint (default/SAML2/POST)<br>2016-05-19 08:23:41 INFO Shibboleth.Application : adding AssertionConsumerService for Binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign) at (/SAML2/POST-SimpleSign)<br>2016-05-19 08:23:41 INFO Shibboleth.Listener : registered remoted message endpoint (default/SAML2/POST-SimpleSign)<br>2016-05-19 08:23:41 INFO Shibboleth.Application : adding AssertionConsumerService for Binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact) at (/SAML2/Artifact)<br>2016-05-19 08:23:41 INFO Shibboleth.Listener : registered remoted message endpoint (default/SAML2/Artifact)<br>2016-05-19 08:23:41 INFO Shibboleth.Application : adding AssertionConsumerService for Binding (urn:oasis:names:tc:SAML:2.0:bindings:PAOS) at (/SAML2/ECP)<br>2016-05-19 08:23:41 INFO Shibboleth.Listener : registered remoted message endpoint (default/SAML2/ECP)<br>2016-05-19 08:23:41 INFO Shibboleth.Application : adding SessionInitiator of type (SAMLDS) to chain (/Login)<br>2016-05-19 08:23:41 INFO Shibboleth.Listener : registered remoted message endpoint (default/Login::run::SAML2SI)<br>2016-05-19 08:23:41 INFO Shibboleth.SecurityPolicyProvider.XML : reload thread started...running when signaled<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: caching DOM for XMLObject<br>2016-05-19 08:23:41 DEBUG XMLTooling.XMLObject [2]: caching DOM for XMLObject (document is bound)</div>