<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p>Merging them into a single metadata file with multiple certs did work- thank you Peter.<br>
<br>
Yes, I agree this is the best way to make it work, but its bad to have different behaving IDPs in a single metadata.<br>
<br>
Will see if I can get a better solution at the Azure IDP level, but sort of doubt it.<br>
<br>
For now, I am good. Thank you!</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Peter Schober <peter.schober@univie.ac.at><br>
<b>Sent:</b> Wednesday, September 20, 2017 3:33:13 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Re: Azure as IDP protecting multiple Shibboleth Apps- Cert error</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">* Sean Flannery <sean.flannery@jwt.com> [2017-09-20 04:38]:<br>
> I think the short version of this question is: in shibboleth SP, can<br>
> you map multiple certs to a given IDP entity ID?<br>
<br>
An IDP can have multiple certs in its metadata, no problem. The SP can<br>
use any of those for verification of signed protocol messages.<br>
<br>
> * Azure IDP generates metadata for each each app you want to<br>
> protect. The metadata for an app contains a unique cert, but<br>
> the same entityID is used for all metadata.<br>
> <br>
> * when you import all the metadata and setup the multiple<br>
> applications in Shibboleth- only one of the apps will<br>
> work. The others will all fail because their certs don't align<br>
> with what shibboleth expects for that (IDP's) entityID.<br>
<br>
You could "merge" all those individual EntityDescriptors into a single<br>
one, that has the union of all protocol endpoints (ACS URLs, etc.) and<br>
keys.(SLO won't work that way, though, but that's just yet another reason<br>
why SLO doesn't work properly, of course.)<br>
<br>
Since they all claim to be the *same* entity there's no other sane way<br>
to handle those, IMHO.<br>
<br>
> Does the problem make sense?<br>
<br>
Obviously it's not a good idea to generate vastly different metadata<br>
and then give it all the same entityID.<br>
<br>
-peter<br>
-- <br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font>
</body>
</html>