<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hello,
<div class="">My configuration is below…in a nutshell:</div>
<div class="">When I access <a href="https://www.fakecompany.com/cust1" class="">https://www.fakecompany.com/cust1</a> or <a href="https://www.fakecompany.com/cust2" class="">https://www.fakecompany.com/cust2</a> I get redirected to the IdP correctly…then the
IDP needs to redirect back to the proper Shibboleth.SSO/SAML/POST url and I’m not sure I have it correct…because it doesn’t seem to work. I would like to not have to define an application default, but Shibboleth doesn’t like that. Can somebody please help?<br class="">
<div class="">I am new to Shibboleth. I have the following configuration:<br class="">
</div>
<div class=""><SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"<br class="">
clockSkew="180"><br class="">
<ApplicationDefaults entityID="<a href="https://id.fakecompany.com" class="">https://id.fakecompany.com</a>" REMOTE_USER="eppn persistent-id targeted-id"><br class="">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerSSL="true" cookieProps="https"><br class="">
<SSO entityID="http://www.idprovider.com/12345678">SAML2 SAML1</SSO><br class="">
<Logout>SAML2 Local</Logout><br class="">
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br class="">
<Handler type="Status" Location="/Status" /><br class="">
<Handler type="Session" Location="/Session" showAttributeValues="false"/><br class="">
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br class="">
</Sessions><br class="">
<Errors supportContact="root@localhost" helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/><br class="">
<MetadataProvider type="XML" validate="true" file="/etc/shibboleth/Metadata.xml"/><br class="">
<MetadataProvider type="XML" validate="true" file="/etc/shibboleth/MetadataCust2.xml"/><br class="">
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/><br class="">
<AttributeResolver type="Query" subjectMatch="true"/><br class="">
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/><br class="">
<CredentialResolver type="File" key="keystore/id.key" certificate="keystore/id.crt"/><br class="">
<ApplicationOverride id="cust2" entityID="https://id.fakecompany.com/cust2"><br class="">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerSSL="true" cookieProps="https"><br class="">
<SSO entityID="http://www.idprovider.com/ABCDEFG">SAML2 SAML1</SSO><br class="">
<Logout>SAML2 Local</Logout><br class="">
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br class="">
<Handler type="Status" Location="https://id.fakecompany.com/Shibboleth.sso/cust2/Status"/><br class="">
<Handler type="Session" Location="/Session" showAttributeValues="true"/><br class="">
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br class="">
</Sessions><br class="">
</ApplicationOverride><br class="">
</ApplicationDefaults><br class="">
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/><br class="">
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/><br class="">
</SPConfig></div>
<div class="">I have the following apache config:<br class="">
<VirtualHost *:443><br class="">
Header set Access-Control-Allow-Origin "*"<br class="">
RewriteEngine on<br class="">
RewriteRule ^/app11/$ /jep/app11/ [R]<br class="">
RewriteRule ^/appservices/(.*) /jep/appservices/$1 [R] <br class="">
ServerName <a href="http://id-jio-web.fakecompany.com" class="">id-jio-web.fakecompany.com</a><br class="">
ServerAdmin micky.williamson@fakecompany.com<br class="">
DocumentRoot /var/www/jio/html<br class="">
CustomLog /var/log/apache2/id-jio-web-access.log combined<br class="">
ErrorLog /var/log/apache2/id-jio-web-error.log<br class="">
LogLevel Debug<br class="">
SSLEngine On<br class="">
SSLProxyEngine On<br class="">
SSLCertificateFile /etc/apache2/keystore/id-jio-web.crt<br class="">
SSLCertificateKeyFile /etc/apache2/keystore/id-jio-web.key<br class="">
SSLCACertificateFile /etc/apache2/keystore/infra-dev.fakecompany.com.crt<br class="">
<Location /jep><br class="">
Header set Cache-Control "max-age=0, must-revalidate"<br class="">
RewriteRule ^/jep/app11$ /jep/app11/ [R] <br class="">
ProxyPassReverseCookiePath /app11/ /jep/app11/<br class="">
ProxyPassReverseCookiePath /appservices/ /jep/appservices/<br class="">
ProxyPassReverseCookiePath /fpo-service/ /jep/fpo-service/<br class="">
AuthType shibboleth<br class="">
ShibRequestSetting requireSession true<br class="">
ShibUseHeaders On<br class="">
Require shibboleth<br class="">
ProxyPass https://infra-dev.fakecompany.com:8443<br class="">
ProxyPassReverse https://infra-dev.fakecompany.com:8443<br class="">
</Location><br class="">
<Location /cust2><br class="">
Header set Cache-Control "max-age=0, must-revalidate"<br class="">
RewriteRule ^/jep/app11$ /cust2/app/ [R] <br class="">
ProxyPassReverseCookiePath /app11/ /cust2/app11/<br class="">
ProxyPassReverseCookiePath /appservices/ /cust2/appservices/<br class="">
ProxyPassReverseCookiePath /fpo-service/ /cust2/fpo-service/<br class="">
AuthType shibboleth<br class="">
ShibRequestSetting requireSession true<br class="">
ShibRequestSetting applicationId cust2<br class="">
ShibUseHeaders On<br class="">
Require shibboleth<br class="">
ProxyPass https://infra-dev.fakecompany.com:8443<br class="">
ProxyPassReverse https://infra-dev.fakecompany.com:8443<br class="">
</Location><br class="">
Thanks<br class="">
Micky<br class="">
<br class="">
</div>
</div>
<div style="font-size:9pt; font-family: 'Calibri',sans-serif;">
<div style="background-color:#D5EAFF; border:1px dotted #003333; padding:.8em; ">
<p style="font-size:8pt; line-height:10pt; font-family: 'Cambria','times roman',serif;">
This communication may contain proprietary or other confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message. Any disclosure, copying, or distribution
of this message, or the taking of any action based on it, is strictly prohibited.</p>
</div>
</div>
</body>
</html>