<div dir="ltr"><div dir="ltr">We have a lot of sub-sites that need differing levels of attribute release.  In the past, we've been doing it via ApplicationOverride blocks like so:<br><br>  <ApplicationOverride id="rectangles" REMOTE_USER="Shib-uid"><br>         <Sessions lifetime="28800" timeout="3600" checkAddress="false"<br>                   handlerURL="/rectangles/chipper/dandelion/Shibboleth.sso" handlerSSL="true"<br>                   cookieProps="; secure; HttpOnly; path=/rectangles/chipper/dandelion"/><br>         <AttributeExtractor type="XML" validate="true" path="attribute-map-rectangles.xml"/><br>  </ApplicationOverride><br><br> However, we have found that for the applicationId above to work, the IDP needs to have additional lines within the <md:SPSSODescriptor like this:<br><br>   <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" <br>       Location="<a href="https://www.x.org/rectangles/chipper/dandelion/Shibboleth.sso/SAML2/POST">https://www.x.org/rectangles/chipper/dandelion/Shibboleth.sso/SAML2/POST</a>" index="1"/><br><br>This seems to work fine, but does require adding the required definitions on both the SP and the IDP.  I tried putting that <md:AssertionConsumerService block into the <Sessions> section of shibboleth2.xml on the SP, but then discovered that the Location field is relative.  Consequently, this of course didn't work.  OK, so I wondered if I could do something like this:<br><br>  <ApplicationOverride id="rectangles" REMOTE_USER="Shib-uid"><br>         <Sessions lifetime="28800" timeout="3600" checkAddress="false"<br>                   handlerURL="/rectangles/chipper/dandelion/Shibboleth.sso" handlerSSL="true"<br>                   cookieProps="; secure; HttpOnly; path=/rectangles/chipper/dandelion"><br>            <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<br>                   Location="/rectangles/chipper/dandelion/Shibboleth.sso/SAML2/POST" index="1"/><br>         </Sessions><br>         <AttributeExtractor type="XML" validate="true" path="attribute-map-rectangles.xml"/><br>  </ApplicationOverride><br><br>The shibboleth SP doesn't complain, but this doesn't seem to work either.  Can this be done so all the IDP has to do is periodically retrieve the metadata from the SP?<br><br>Thanks.<br><br>Amos<br><br></div></div>