<div dir="ltr"><div><div><div>Hello Peter, <br><br></div>Thanks for such quick reply.  I am using debian linux and apache webserver, my main confusion is that in the following configuration there is target = <a href="https://site1.example.com/auth/shibboleth/callback">https://site1.example.com/auth/shibboleth/callback</a>, for second website I need to set another target like target = <a href="https://site2.example.com/auth/shibboleth/callback">https://site2.example.com/auth/shibboleth/callback</a>". Where in the shibboleth configuration file I do that? <br><br><br><SessionInitiator type="Chaining"<br>                           Location="/Login"<br>                           id="Intranet"<br>                           relayState="cookie"<br>                           entityID="<a href="https://login.example.com/shibboleth">https://login.example.com/shibboleth</a>"    <br>                           target="<a href="https://site1.example.com/auth/shibboleth/callback">https://site1.example.com/auth/shibboleth/callback</a>"><br><br><br><br></div>Kind regards,<br></div>Asik<br><div><div><br><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 26, 2018 at 1:03 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">* asikbcc <<a href="mailto:shiblyxp@gmail.com">shiblyxp@gmail.com</a>> [2018-04-26 12:25]:<br>
> I have following configuration for a website <a href="https://site1.example.com" rel="noreferrer" target="_blank">https://site1.example.com</a>. After<br>
> the authentication is done the user is redirected to<br>
> <a href="https://site1.example.com/auth/shibboleth/callback" rel="noreferrer" target="_blank">https://site1.example.com/<wbr>auth/shibboleth/callback</a>. So far this is working<br>
> just fine. However, I need to configure shibboleth service provider for<br>
> another website  <a href="https://site2.example.com" rel="noreferrer" target="_blank">https://site2.example.com</a> and after successful<br>
> authentication the user should be redirected to<br>
> <a href="https://site2.example.com/auth/shibboleth/callback" rel="noreferrer" target="_blank">https://site2.example.com/<wbr>auth/shibboleth/callback</a>. How can I do this?<br>
<br>
How did you get it to work for the one vhost?<br>
That's how you'd do it for the other vhost.<br>
<br>
>        <InProcess logger="native.logger"><br>
>           <ISAPI normalizeRequest="true" safeHeaderNames="true"><br>
>              <Site id="1" name="<a href="http://site1.example.com" rel="noreferrer" target="_blank">site1.example.com</a>"/><br>
>           </ISAPI><br>
>        </InProcess><br>
>      <br>
>        <UnixListener address="shibd.sock"/><br>
<br>
Is this on MS-Windows using the MS-IIS web server? (ISAPI stuff above)<br>
Or is this on UNIX (socket listener)?<br>
<br>
>        <RequestMapper type="Native"><br>
>            <RequestMap applicationId="default"><br>
>               <Host name="<a href="http://site1.example.com" rel="noreferrer" target="_blank">site1.example.com</a>"/><br>
>            </RequestMap><br>
>         </RequestMapper><br>
<br>
What web server is this? You don't need the request map with Apache<br>
httpd, for example.<br>
<br>
>        <ApplicationDefaults entityID="<a href="https://site1.example.com/shibboleth" rel="noreferrer" target="_blank">https://site1.<wbr>example.com/shibboleth</a>"<br>
>                             REMOTE_USER="eppn persistent-id targeted-id"<br>
>                             homeURL="<a href="http://site1.example.com" rel="noreferrer" target="_blank">site1.example.com</a>"<br>
<br>
You're setting homeURL to what should be default anyway if RelayState<br>
was lost, so don't.<br>
<br>
>             <SSO entityID="<a href="https://login.example.com/shibboleth" rel="noreferrer" target="_blank">https://login.<wbr>example.com/shibboleth</a>"><br>
>                 SAML2<br>
>             </SSO><br>
>      <br>
>              <SessionInitiator type="Chaining"<br>
>                                Location="/Login"<br>
>                                id="Intranet"<br>
>                                relayState="cookie"<br>
<br>
That whole config is a mess, but I don't think that matters much for<br>
this question.<br>
<br>
>           <CredentialResolver type="File"<br>
>                               key="/etc/ssl/private/xca_www.<wbr>key"<br>
>                              <br>
> certificate="/etc/apache2/ssl/<wbr>www-chain-2018.pem"/><br>
<br>
There is no upside to re-using the browser-facing TLS certificate for<br>
HTTPS to secure SAML protocol messages, which are never seen by a<br>
browser.<br>
There are downsides, though. (Confusion about the trust model, and<br>
usually renwals based on the business model for selling commercial TLS<br>
certs, not security assessments of your deployment.)<br>
<span class="gmail-HOEnZb"><font color="#888888"><br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</font></span></blockquote></div><br></div></div></div></div></div></div>