<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
What am I missing ? :
<div class=""><br class="">
<div class=""><b class="">shibsp::ConfigurationException<br class="">
<br class="">
The system encountered an error at Tue Jul 12 18:37:36 2016<br class="">
<br class="">
To report this problem, please contact the site administrator at root@localhost.<br class="">
<br class="">
Please include the following message in any email:<br class="">
<br class="">
shibsp::ConfigurationException at (<a href="https://id-jio-web.jeppesen.com/cust2/jiops/" class="">https://id-jio-web.jeppesen.com/cust2/jiops/</a>)<br class="">
<br class="">
</b>
<div class=""><b class="">Invalid handlerURL property (c2/Shibboleth.sso) in <Sessions> element for Application (c2)</b></div>
<div class=""><br class="">
</div>
<div class="">My config is:</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><b class=""> <ApplicationOverride id="c2" entityID="<a href="https://id-jio-web.jeppesen.com/c2" class="">https://id-jio-web.jeppesen.com/c2</a>"><br class="">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerURL="/c2/Shibboleth.sso" handler<br class="">
SSL="true" cookieProps="https"><br class="">
<SSO entityID="<a href="http://www.okta.com/exk6l60qelcbBCOaT0h7" class="">http://www.okta.com/exk6l60qelcbBCOaT0h7</a>">SAML2 SAML1</SSO><br class="">
<Logout>SAML2 Local</Logout><br class="">
<Handler type="MetadataGenerator" Location="Metadata" signing="false"/><br class="">
<Handler type="Status" Location="Status"/><br class="">
<Handler type="Session" Location="Session" showAttributeValues="true"/><br class="">
<Handler type="DiscoveryFeed" Location="DiscoFeed"/><br class="">
</Sessions><br class="">
</ApplicationOverride></b><br class="">
<br class="">
</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Jul 11, 2016, at 8:21 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">On 7/11/16, 9:30 PM, "users on behalf of Micky Williamson" <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a> on behalf of
<a href="mailto:mwilliamson@silasg.com" class="">mwilliamson@silasg.com</a>> wrote:<br class="">
<br class="">
<blockquote type="cite" class="">It did dawn on me that after I got home I left off a little information of why the<br class="">
configuration is the way it is....the software at the SP is NOT multi tenant capable...so
<br class="">
there will be one deployment per customer (I didn't write it). So the separation to the<br class="">
different tomcat backends is going to take place within the ReverseProxy configuration.<br class="">
As I considered your comments, it dawned on me what you were getting at....sadly, the<br class="">
apps are always going to be siloed...<br class="">
</blockquote>
<br class="">
And sadly that means the SP configuration will be awful. I'm just trying to explain why. It's not the right approach and is at odds with the design of the software. I think you understand the general issues now. That's all I was trying to get at.<br class="">
<br class="">
Per your other note, using paths plus all of the other constraints here means you basically are stuck with a lot of extra work. If you want to do this, then you need to override the handlerURL in the Sessions tag for each override, and your SAML metadata will
have to contain a set of endpoints for every customer that are prefixed with the path segment that's mapped to the applicationId.<br class="">
<br class="">
You didn't do all of that, and that's why it's not working. This is covered in the wiki under the topic on application overrides.<br class="">
<br class="">
Once you override handlerURL, it will generate requests with a response location of (e.g.) /cust1/Shibboleth.sso/SAML2/POST and that will associate the session it creates with the right override.<br class="">
<br class="">
-- Scott<br class="">
<br class="">
<br class="">
-- <br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a><br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
<div style="font-size:9pt; font-family: 'Calibri',sans-serif;">
<div style="background-color:#D5EAFF; border:1px dotted #003333; padding:.8em; ">
<p style="font-size:8pt; line-height:10pt; font-family: 'Cambria','times roman',serif;">
This communication may contain proprietary or other confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message. Any disclosure, copying, or distribution
of this message, or the taking of any action based on it, is strictly prohibited.</p>
</div>
</div>
</body>
</html>