<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">you can transform outbound attributes however you want .. if the other party wants "UNICORN-TYPE" instead of AFFILIATION, just do a transform, and yes this is per sP (usually, but I supposed you could also do it globally)
.. SAML inspector plugin (firefox) is very useful in debugging these, as is an alternate log4j.xml that turns it up to TRACE on all the stuff you want (warning that level will expose passwords in your log if done for particular ones, the comment as to which
is right in the file).</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Our ERP application sticks a letter in front of what one might call our "userID" based on other attributes located in LDAP, but it's trivial to do several rule-based transforms and a final one that tosses and error, or
does a default action. We have places that want MAIL but unqualified (?) .. whatever. just give me the attribute name and so long as it doesn't have any illegal characters it it, it'll work just fine.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">If the other guy speaks SAML, it'll work. Maybe not out of the box, but it'll work.</p>
<p style="margin-top:0;margin-bottom:0">Ask for a price break on the integration though because doing silly stuff like that makes your job harder. Sane places give you a discount for being on InCommon (etc) because they know you already figured it out.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">My $0.02</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Michael Holstein CISSP</p>
<p style="margin-top:0;margin-bottom:0">Cleveland State University</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of den@scsk.jp <den@scsk.jp><br>
<b>Sent:</b> Friday, February 9, 2018 4:32:45 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Cc:</b> j.takamatsu@scsk.jp<br>
<b>Subject:</b> How to setup Shibboleth SP for a multi-tenant application</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cordia New"}
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:"Yu Gothic"}
@font-face
{}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0mm;
margin-bottom:.0001pt;
text-align:justify;
text-justify:inter-ideograph;
font-size:10.5pt;
font-family:"Yu Gothic"}
a:x_link, span.x_MsoHyperlink
{color:#0563C1;
text-decoration:underline}
a:x_visited, span.x_MsoHyperlinkFollowed
{color:#954F72;
text-decoration:underline}
.x_MsoChpDefault
{font-family:"Yu Gothic"}
@page WordSection1
{margin:99.25pt 30.0mm 30.0mm 30.0mm}
div.x_WordSection1
{}
-->
</style>
<div lang="JA" link="#0563C1" vlink="#954F72" style="">
<div class="x_WordSection1">
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Hi gurus</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt">I'm new to shibboleth and want to setup an SSO environment for testing SSO through SAML2 in a single SaaS application supporting multi tenants.</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt">My SaaS application has ENTERPRISE_ID USER_ID and USER_PASS as needed parameters to login .</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt">I now want to use Shibboleth-sp for supporting SAML2 based SSO , users of each ENTERPRISE_ID will have a corresponding IDP for authentication.</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt">But my application has only one global URL, I want to know, whether I could add this SSO feature supporting multi tenant application (with only one server instance) by adding a virtual directory
for each ENTERPRISE_ID in shibboleth2.xml, like the following:</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt">[...]</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"><!-- To customize behavior, map hostnames and path components to applicationId and other settings. --></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> <RequestMapper type="Native"></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> <RequestMap applicationId="default"></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> <Host name="service.university.org" authType="shibboleth" requireSession="true"></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> <Path name="same-app_aliasA" applicationId="same-app_aliasA"/></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> <Path name="same-app_aliasB" applicationId="same-app_aliasB"/></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> <Path name="same-app_aliasC" applicationId="same-app_aliasC"/></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt">[...]</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </Host></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </RequestMap></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </RequestMapper></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt">[...]</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"><ApplicationDefaults id="default" policyId="default"</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> entityID="https://service.university.org/shibboleth"</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> homeURL="https://service.university.org/welcome/"</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> REMOTE_USER="eppn persistent-id targeted-id"</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> ></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> [...]</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> <!-- Overrides for other-app --></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> <ApplicationOverride id="same-app_aliasA" entityID="https://idp_A.university.org/shibboleth"></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> <Sessions lifetime="28800" timeout="3600" checkAddress="false"</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> handlerURL="/aliasA/Shibboleth.sso" handlerSSL="false"></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </ApplicationOverride></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"><ApplicationOverride id="same-app_aliasB" entityID="https://idp_B.university.org/shibboleth"></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> <Sessions lifetime="28800" timeout="3600" checkAddress="false"</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> handlerURL="/aliasB/Shibboleth.sso" handlerSSL="false"></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </ApplicationOverride></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"><ApplicationOverride id="same-app_aliasC" entityID="https://idp_C.university.org/shibboleth"></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> <Sessions lifetime="28800" timeout="3600" checkAddress="false"</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> handlerURL="/aliasC/Shibboleth.sso" handlerSSL="false"></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt">[...]</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </ApplicationOverride></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </ApplicationDefaults></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt">[...]</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
</div>
</div>
</body>
</html>