<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">No load balancer is involved. The vhosts are for different domains in our CMS and aren't through a load balancer. They need to be distinct.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On 5/21/19 4:58 PM, Ray Bon wrote:<br>
</div>
<blockquote type="cite" cite="mid:f262a12f7a241a09d93fca2ece428605cedf0762.camel@uvic.ca">
<div>Richard,</div>
<div><br>
</div>
<div>The redirect pattern sounds like a load balancer in round robin configuration (switching among hosts on each request).
</div>
<div>If this is the case, set the load balancer to sticky sessions.</div>
<div><br>
</div>
<div>Ray</div>
<div><br>
</div>
<div>On Tue, 2019-05-21 at 21:42 +0000, Richard Frovarp wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px
#729fcf solid;padding-left:1ex">
<pre>Trying to figure out if I've ran into a bug, or I'm doing it wrong. </pre>
<pre>Figured I would start here. I'm following the UW[1] and Oxford[2] </pre>
<pre>instructions for setting up a single SP with multiple vhosts. I don't </pre>
<pre>need the vhosts to be treated differently, it's even the same app, but </pre>
<pre>they are on vastly different domains, which might what is causing the </pre>
<pre>problem.</pre>
<pre>
</pre>
<pre>The generated metadata has both domains in the generated metadata, of </pre>
<pre>course with the same single entityID. I am using CAS 5.1 as my IdP.</pre>
<pre>
</pre>
<pre>1) I hit domain2.edu</pre>
<pre>
</pre>
<pre>2) Sent to CAS</pre>
<pre>
</pre>
<pre>3) Auth</pre>
<pre>
</pre>
<pre>4) CAS sends me back to domain1.edu</pre>
<pre>
</pre>
<pre>5) Shib SP validates data and gives me a cookie for domain1.edu</pre>
<pre>
</pre>
<pre>6) SP redirects me to domain2.edu</pre>
<pre>
</pre>
<pre>7) My SP cookie was issued for domain1, so it isn't being sent to </pre>
<pre>domain2, so goto #2</pre>
<pre>
</pre>
<pre>
</pre>
<pre>In general, how does the IdP know where to send the user back to if </pre>
<pre>there are multiple listed domains? It's possible the version of CAS I am </pre>
<pre>on doesn't support this. But I'm wondering in general how this is </pre>
<pre>supposed to work, or if I'm missing something other than just having two </pre>
<pre>EndpointBase values.</pre>
<pre>
</pre>
<pre> From where I'm at, it looks like the best option for me is different </pre>
<pre>entityIDs via the entityIDSelf param in HTTPD. That is certainly doable, </pre>
<pre>I just want to make sure that I'm not missing something.</pre>
<pre>
</pre>
<pre>Thanks,</pre>
<pre>
</pre>
<pre>Richard</pre>
<pre>
</pre>
<pre>
</pre>
<pre>1: </pre>
<a href="https://wiki.cac.washington.edu/pages/viewpage.action?pageId=61703128" moz-do-not-send="true">
<pre>https://wiki.cac.washington.edu/pages/viewpage.action?pageId=61703128</pre>
</a>
<pre>
</pre>
<pre>
</pre>
<pre>2: </pre>
<a href="https://help.it.ox.ac.uk/iam/federation/using-one-shibboleth-service-provider-multiple-virtual-hosts" moz-do-not-send="true">
<pre>https://help.it.ox.ac.uk/iam/federation/using-one-shibboleth-service-provider-multiple-virtual-hosts</pre>
</a>
<pre>
</pre>
</blockquote>
<div><span>
<pre>--
</pre>
<div>Ray Bon</div>
<div>Programmer Analyst</div>
<div>Development Services, University Systems</div>
<div>2507218831 | CLE 019 | <a class="moz-txt-link-abbreviated" href="mailto:rbon@uvic.ca">
rbon@uvic.ca</a></div>
</span></div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset> </blockquote>
<p><br>
</p>
</body>
</html>