<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello all, I apologize in advance if this message is lengthy but I would like to be explicit in explaining my issue.<div class=""><br class=""></div><div class="">For a while my webapp has run under one Shibboleth SP and IDP. The SP being <a href="http://app1.website.com/shibboleth" class="">app1.website.com/shibboleth</a> and the idp being <a href="http://app1.website.com/idp/shibboleth" class="">app1.website.com/idp/shibboleth</a>, This worked fine until users are required to login to one of the apps provided under <a href="http://app1.website.com/shibboleth" class="">app1.website.com/shibboleth</a> on another device (their phone) while logged in on a browser. Doing this causes an issue, as shibboleth will attempt to log out with the incorrect session ID on the second session, never logging them out and throwing a SAML profile exception. The solution I came to after reading through the documentation was to separate my apache/ShibSP setup into multiple virtual hosts and logical service providers, but still use the same IDP to authenticate.</div><div class=""><br class=""></div><div class="">I have read through many mailing lists and documentation, and I believe I have set up my configurations correctly, yet I still receive errors related to my new SP’s metadata, even though I created it by copying a working, existing SP metadata and changing the hostnames.</div><div class=""><br class=""></div><div class="">So first: Here is my log excerpt upon trying to visit a page that should redirect to a login:</div><div class=""><br class=""></div><div class=""><div class="">17:51:30.260 - DEBUG [PROTOCOL_MESSAGE:113] -</div><div class=""><?xml version="1.0" encoding="UTF-8"?></div><div class=""><samlp:AuthnRequest</div><div class=""> AssertionConsumerServiceURL="<a href="https://app2.website.com/Shibboleth.sso/SAML2/POST" class="">https://app2.website.com/Shibboleth.sso/SAML2/POST</a>"</div><div class=""> Destination="<a href="https://app1.website.com/idp/profile/SAML2/Redirect/SSO" class="">https://app1.website.com/idp/profile/SAML2/Redirect/SSO</a>"</div><div class=""> ID="_64038eb8ca0725cbe1f1df29e686a0f4"</div><div class=""> IssueInstant="2018-03-27T17:51:30Z"</div><div class=""> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</div><div class=""> Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"></div><div class=""> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://app2.website.com/shibboleth</saml:Issuer>" class="">https://app2.website.com/shibboleth</saml:Issuer></a></div><div class=""> <samlp:NameIDPolicy AllowCreate="1"/></div><div class=""></samlp:AuthnRequest></div><div class=""><br class=""></div><div class="">17:51:30.260 - WARN [org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] - SPSSODescriptor role metadata for entityID '<a href="https://app2.website.com/shibboleth" class="">https://app2.website.com/shibboleth</a>' could not be resolved</div><div class="">17:51:30.260 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:305] - No metadata for relying party <a href="https://app2.website.com/shibboleth" class="">https://app2.website.com/shibboleth</a>, treating party as anonymous</div><div class="">17:51:30.260 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:222] - SAML 2 SSO profile is not configured for relying party <a href="https://app2.website.com/shibboleth" class="">https://app2.website.com/shibboleth</a></div></div><div class=""><br class=""></div><div class="">I also receive an “INVALID IDP URL (404)” webpage after the above log messages are generated.</div><div class=""><br class=""></div><div class="">My Shibboleth2.xml Config:</div><div class=""><br class=""></div><div class=""><ApplicationOverride id=“app2" entityID="<a href="https://app2.website.com/shibboleth" class="">https://app2.website.com/shibboleth</a>" /></div><div class=""><br class=""></div><div class="">My Apache config is set up to ShibRequestSetting applicationId app2, to map to this override.</div><div class=""><br class=""></div><div class="">My metadata-providers.xml config:</div><div class=""><br class=""></div><div class=""><div class=""><MetadataProvider xsi:type="FilesystemMetadataProvider"</div><div class=""> id=“app2Metadata"</div><div class=""> metadataFile="/opt/shibboleth-idp/metadata/mc-generated-md.xml" /></div></div><div class=""><br class=""></div><div class="">And I should note that this tag is inside a ChainingMetadataProvider, right after a working SP metadata.</div><div class=""><br class=""></div><div class="">So my questions are: Given the situation, is this a viable solution? I’ve seen a lot on the internet about multiple IdPs to a single SP, but not about the reverse. Can I use an IdP on the same server, but a different virtual host with my logically separated SP? Is there a better way to prevent logout errors from the same sign-on on two different browsers?</div><div class=""><br class=""></div><div class="">If it is a viable solution: Why does my metadata refuse to be recognized by the IdP? I’ve gone as far as copying and modifying one that works, modifying the provided example from testshib, and even modifying the auto generated metadata from <a href="http://app2.website.com/Shibboleth.sso/Metadata" class="">app2.website.com/Shibboleth.sso/Metadata</a></div><div class=""><br class=""></div><div class="">I’ll leave the metadata that fails to load beneath and I appreciate any help or insight I receive!!</div><div class=""><br class=""></div><div class=""><div class=""><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_fe261a8a7093587c1db68e373e4bf344cf1e1442" entityID="<a href="https://app2.website.com/shibboleth" class="">https://app2.website.com/shibboleth</a>"></div><div class=""><br class=""></div><div class=""> <md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"></div><div class=""> <alg:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha512" class="">http://www.w3.org/2001/04/xmlenc#sha512</a>"/></div><div class=""> <alg:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#sha384" class="">http://www.w3.org/2001/04/xmldsig-more#sha384</a>"/></div><div class=""> <alg:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha256" class="">http://www.w3.org/2001/04/xmlenc#sha256</a>"/></div><div class=""> <alg:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#sha224" class="">http://www.w3.org/2001/04/xmldsig-more#sha224</a>"/></div><div class=""> <alg:DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1" class="">http://www.w3.org/2000/09/xmldsig#sha1</a>"/></div><div class=""> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512" class="">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512</a>"/></div><div class=""> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384" class="">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384</a>"/></div><div class=""> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256" class="">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256</a>"/></div><div class=""> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224" class="">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224</a>"/></div><div class=""> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" class="">http://www.w3.org/2001/04/xmldsig-more#rsa-sha512</a>"/></div><div class=""> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" class="">http://www.w3.org/2001/04/xmldsig-more#rsa-sha384</a>"/></div><div class=""> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" class="">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>"/></div><div class=""> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2009/xmldsig11#dsa-sha256" class="">http://www.w3.org/2009/xmldsig11#dsa-sha256</a>"/></div><div class=""> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1" class="">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1</a>"/></div><div class=""> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" class="">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"/></div><div class=""> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#dsa-sha1" class="">http://www.w3.org/2000/09/xmldsig#dsa-sha1</a>"/></div><div class=""> </md:Extensions></div><div class=""><br class=""></div><div class=""> <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol urn:oasis:names:tc:SAML:2.0:protocol"></div><div class=""> <md:Extensions></div><div class=""> <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="<a href="https://app2.website.com/Shibboleth.sso/Login" class="">https://app2.website.com/Shibboleth.sso/Login</a>"/></div><div class=""> <idpdisc:DiscoveryResponse xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="<a href="https://app1.website.com/Shibboleth.sso/Login" class="">https://app1.website.com/Shibboleth.sso/Login</a>" index="1"/></div><div class=""> </md:Extensions></div><div class=""> <md:KeyDescriptor></div><div class=""> <ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig" class="">http://www.w3.org/2000/09/xmldsig</a>#"></div><div class=""> <ds:KeyName><a href="http://app1.website.com" class="">app1.website.com</a></ds:KeyName></div><div class=""> <ds:X509Data></div><div class=""> <ds:X509SubjectName>CN=<a href="http://app1.website.com" class="">app1.website.com</a></ds:X509SubjectName></div><div class=""> <ds:X509Certificate>MIIDADCCAeigAwIBAgIJAIMOvKesRgyuMA0GCSqGSIb3DQEBBQUAMB4xHDAaBgNV</div><div class="">BAMTE3JodGVzdC5vdHN1a2FkbS5jb20wHhcNMTgwMTIyMTkzMDE2WhcNMjgwMTIw</div><div class="">MTkzMDE2WjAeMRwwGgYDVQQDExNyaHRlc3Qub3RzdWthZG0uY29tMIIBIjANBgkq</div><div class="">hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsBHB4YrkzCJfxun8XDB6hJB4EYiM5idO</div><div class="">63kbu8kGrravySZfKYp8/oCoMhG8zF6Blfp+70U08UVH/dncGTvFL86RbTsmZEpa</div><div class="">rCeW34ndXuEF7xwHZCIqHEIIL6N6NFjpLTqgbENzrGNHe9kAGgoOuFr+S8PFri2l</div><div class="">kLjKNQsuh8j+a3ukbXcc7ZU2YLoi69aWqy8NVHx0sDOC8+tpKRdlPUGngslYHxmO</div><div class="">fi4M3GF3FdN0kLnL9aTcWgpsmqNLztBEWjYrxoaLb7cnmZgiuIJTiHIb4nVpHOS7</div><div class="">DxB885DcsRSlgYZCmav3Ge9k/GOj1eXj8WT/pf/NMJ13XgjKw/p/dQIDAQABo0Ew</div></div><div class=""><div class="">PzAeBgNVHREEFzAVghNyaHRlc3Qub3RzdWthZG0uY29tMB0GA1UdDgQWBBRoxqL6</div><div class="">ylQI6VPsaXZ7tygkXGEK/jANBgkqhkiG9w0BAQUFAAOCAQEAByWM3MJbTxx3Jftb</div><div class="">4EB2Hcl9mdLgOCzpJcOP7+6rHxSoYSxHz1m0wuFgEYTReGGKu45AFW4J1mNBA0LO</div><div class="">J3EBx9JQ7mMV1d5FLgI33GHkxxqmABvgy/1uP8dGV1DTp31RNUhrQSIpG83NPaOi</div><div class="">PkIPcjz3jwM3slujsDtRCCqeptFFqESDMxVlacqgnhEPvWbd5KufOH2ePfxecC66</div><div class="">R1cZ+6Gbk9yxjCcAHMBXDzly1wH1zi1C4Q/dx9GND7QPPWYS9oRu2jAfwNZguFGg</div><div class="">E1Lwb+kGIqZEh2G/+oOGspvYE0N6Dc/rfl32AY3LPTPv18nmPyKfAOcWYCfi2b1Q</div><div class="">rl+U4w==</div><div class=""></ds:X509Certificate></div><div class=""> </ds:X509Data></div><div class=""> </ds:KeyInfo></div><div class=""> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2009/xmlenc11#aes128-gcm" class="">http://www.w3.org/2009/xmlenc11#aes128-gcm</a>"/></div><div class=""> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2009/xmlenc11#aes192-gcm" class="">http://www.w3.org/2009/xmlenc11#aes192-gcm</a>"/></div><div class=""> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2009/xmlenc11#aes256-gcm" class="">http://www.w3.org/2009/xmlenc11#aes256-gcm</a>"/></div><div class=""> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#aes128-cbc" class="">http://www.w3.org/2001/04/xmlenc#aes128-cbc</a>"/></div><div class=""> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#aes192-cbc" class="">http://www.w3.org/2001/04/xmlenc#aes192-cbc</a>"/></div><div class=""> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#aes256-cbc" class="">http://www.w3.org/2001/04/xmlenc#aes256-cbc</a>"/></div><div class=""> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" class="">http://www.w3.org/2001/04/xmlenc#tripledes-cbc</a>"/></div><div class=""> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2009/xmlenc11#rsa-oaep" class="">http://www.w3.org/2009/xmlenc11#rsa-oaep</a>"/></div><div class=""> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" class="">http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p</a>"/></div><div class=""> </md:KeyDescriptor></div><div class=""> <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://app2.website.com/Shibboleth.sso/Artifact/SOAP" class="">https://app2.website.com/Shibboleth.sso/Artifact/SOAP</a>" index="1"/></div><div class=""> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="<a href="https://app2.website.com/Shibboleth.sso/SLO/Artifact" class="">https://app2.website.com/Shibboleth.sso/SLO/Artifact</a>"/></div><div class=""> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://app2.website.com/Shibboleth.sso/SLO/POST" class="">https://app2.website.com/Shibboleth.sso/SLO/POST</a>"/></div><div class=""> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://app2.website.com/Shibboleth.sso/SLO/Redirect" class="">https://app2.website.com/Shibboleth.sso/SLO/Redirect</a>"/></div><div class=""> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://app2.website.com/Shibboleth.sso/SLO/SOAP" class="">https://app2.website.com/Shibboleth.sso/SLO/SOAP</a>"/></div><div class=""> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="<a href="https://app2.website.com/Shibboleth.sso/SAML/Artifact" class="">https://app2.website.com/Shibboleth.sso/SAML/Artifact</a>" index="6"/></div><div class=""> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="<a href="https://app2.website.com/Shibboleth.sso/SAML/POST" class="">https://app2.website.com/Shibboleth.sso/SAML/POST</a>" index="7”/></div></div><div class=""><div class=""> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="<a href="https://app2.website.com/Shibboleth.sso/SAML2/Artifact" class="">https://app2.website.com/Shibboleth.sso/SAML2/Artifact</a>" index="8"/></div><div class=""> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="<a href="https://app2.website.com/Shibboleth.sso/SAML2/ECP" class="">https://app2.website.com/Shibboleth.sso/SAML2/ECP</a>" index="9"/></div><div class=""> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://app2.website.com/Shibboleth.sso/SAML2/POST" class="">https://app2.website.com/Shibboleth.sso/SAML2/POST</a>" index="10"/></div><div class=""> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="<a href="https://app2.website.com/Shibboleth.sso/SAML2/POST-SimpleSign" class="">https://app2.website.com/Shibboleth.sso/SAML2/POST-SimpleSign</a>" index="11"/></div><div class=""> </md:SPSSODescriptor></div><div class=""><br class=""></div><div class=""></md:EntityDescriptor></div></div></body></html>