<div dir="ltr"><div>Hi Peter,<br><br></div>I've change my conf so that I can take into accounts your suggestions. Now my shibboleth2.xml is : <br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><br><SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"<br> xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"<br> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"<br> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"<br> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<br> clockSkew="180"><br><br> <ApplicationDefaults<br> entityID="<a href="http://sp.shibboleth.example.com">sp.shibboleth.example.com</a>"<br> REMOTE_USER="eppn persistent-id targeted-id"><br><br> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"<br> checkAddress="false" handlerURL="/Shibboleth.sso" handlerSSL="false" cookieProps="; path=/; domain=<a href="http://example.com">example.com</a>; http"><br> <SSO><br> SAML2<br> </SSO><br> <br> <Logout>SAML2 Local</Logout><br> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br> <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/><br> <Handler type="Session" Location="/Session" showAttributeValues="false"/><br> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br> </Sessions><br><br> <MetadataProvider type="Chaining"><br> <MetadataProvider type="XML" validate="true" file="/etc/shibboleth/openam_metadata.xml"/><br> <MetadataProvider type="XML" validate="true" file="/etc/shibboleth/wso2_metadata.xml"/><br> </MetadataProvider><br><br> <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/><br> <AttributeResolver type="Query" subjectMatch="true"/><br> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/><br><br> </ApplicationDefaults><br><br> <br> <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/><br><br> <br> <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/><br><br></SPConfig><br><br></blockquote><div> <br></div><div>The problem is that I do have the same problem again. I dug a bit and I found that if I remove one vhost, it works correctly and if I put two vhost or more, it will always take me into the idp that have entity id of the first vhost. For example, for this httpd.conf:<br><div> </div><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">#openam<br> <VirtualHost *:80><br> ServerName <a href="http://openam.shibboleth.example.com">openam.shibboleth.example.com</a><br> DocumentRoot "/var/www/html/"<br> <Location /secure><br> AuthType shibboleth<br> ShibRequestSetting requireSession 1<br> ShibRequestSetting entityID openam<br> require shib-session<br> </Location><br> <Location /Shibboleth.sso><br> Satisfy Any<br> Allow from all<br> </Location><br> <Location /><br> AuthType shibboleth<br> Require shibboleth<br> </Location><br></VirtualHost><br><br>#wso2<br><VirtualHost *:80><br> ServerName <a href="http://wso2.shibboleth.example.com">wso2.shibboleth.example.com</a><br><br> DocumentRoot "/var/www/html/"<br> <Location /secure><br> AuthType shibboleth<br> ShibRequestSetting requireSession 1<br> ShibRequestSetting entityID wso2<br> require shib-session<br> </Location><br> <Location /Shibboleth.sso><br> Satisfy Any<br> Allow from all<br> </Location><br> <Location /><br> AuthType shibboleth<br> Require shibboleth<br> </Location><br></VirtualHost><br><br></blockquote>I will be redirect to openam when I access <a href="http://wso2.shibboleth.example.com">wso2.shibboleth.example.com</a> which should be wso2 instead.<br><br></div><div>Any idea of why this is happening?<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-05-19 15:57 GMT+02:00 Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* reda sabir <<a href="mailto:sabiretude@gmail.com">sabiretude@gmail.com</a>> [2016-05-19 12:05]:<br>
<span class="">> - I retook the same use case : One SP and two IdP where each IdP<br>
> will be used when the user access a specific URL. So, I have two<br>
> hostname pointing at the same website: <a href="http://wso2.shibboleth.example.com" rel="noreferrer" target="_blank">wso2.shibboleth.example.com</a><br>
> and <a href="http://openam.shibboleth.example.com" rel="noreferrer" target="_blank">openam.shibboleth.example.com</a>.<br>
<br>
</span>You already agreed that there was no need for Overrides, yet your<br>
configuration features ApplicationOverrides?!<br>
<span class=""><br>
> - The httpd config look like this :<br>
> #wso2<br>
> <VirtualHost *:80><br>
> ServerName <a href="http://wso2.shibboleth.example.com" rel="noreferrer" target="_blank">wso2.shibboleth.example.com</a><br>
><br>
> DocumentRoot "/var/www/html/"<br>
> <Location /secure><br>
> AuthType shibboleth<br>
> ShibRequestSetting requireSession 1<br>
> ShibRequestSetting applicationId default<br>
> require shib-session<br>
> </Location><br>
<br>
</span>"applicationId default" is a noop, AFAIU ("default" is default).<br>
Instead of the override what you want here is<br>
ShibRequestSetting entityID <a href="https://entityid-of-one-such-idp.example.org" rel="noreferrer" target="_blank">https://entityid-of-one-such-idp.example.org</a><br>
<br>
> ShibRequestSetting applicationId openam-id<br>
<br>
Same thing: Drop the override, add an entityID parameter.<br>
<span class=""><br>
> <MetadataProvider type="XML" validate="true"<br>
> file="/etc/shibboleth/wso2_metadata.xml"/><br>
<br>
</span>Here add metadata for all IDPs, not just one.<br>
<br>
> <ApplicationOverride id="openam-id"><br>
<br>
Lose the whole ApplicationOverride and child elements.<br>
<br>
I've not yet looked at your DEBUG log since none of what you do<br>
matches what you said you wanted.<br>
<div class="HOEnZb"><div class="h5">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>