<div dir="ltr"><div dir="ltr"><div>Hi,</div><div>i have 2 applications on separate servers.</div><div>i have a reverse web proxy server in front of them with Shibboleth installed on it.</div><div><a href="http://sp1.mcftestsite.com">sp1.mcftestsite.com</a> points to the first application</div><div><a href="http://sp3.mcftestsite.com">sp3.mcftestsite.com</a> points to the second application</div><div><br></div><div>i have EDS working as a discovery service for the 1st application.</div><div><br></div><div>when i added the 2nd application i made only 2 modifications:</div><div>I added the lines under <!--sp3--> to my sp-metadata.xml file</div><div><br></div><div>    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://sp1.mcftestsite.com/Shibboleth.sso/SAML2/POST">https://sp1.mcftestsite.com/Shibboleth.sso/SAML2/POST</a>" index="1"/></div><div>    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="<a href="https://sp1.mcftestsite.com/Shibboleth.sso/SAML2/POST-SimpleSign">https://sp1.mcftestsite.com/Shibboleth.sso/SAML2/POST-SimpleSign</a>" index="2"/></div><div>    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="<a href="https://sp1.mcftestsite.com/Shibboleth.sso/SAML2/ECP">https://sp1.mcftestsite.com/Shibboleth.sso/SAML2/ECP</a>" index="3"/></div><div>    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="<a href="https://sp1.mcftestsite.com/Shibboleth.sso/SAML/POST">https://sp1.mcftestsite.com/Shibboleth.sso/SAML/POST</a>" index="4"/></div><div><!--sp3--></div><div>    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://sp3.mcftestsite.com/Shibboleth.sso/SAML2/POST">https://sp3.mcftestsite.com/Shibboleth.sso/SAML2/POST</a>" index="5"/></div><div>    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="<a href="https://sp3.mcftestsite.com/Shibboleth.sso/SAML2/POST-SimpleSign">https://sp3.mcftestsite.com/Shibboleth.sso/SAML2/POST-SimpleSign</a>" index="6"/></div><div>    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="<a href="https://sp3.mcftestsite.com/Shibboleth.sso/SAML2/ECP">https://sp3.mcftestsite.com/Shibboleth.sso/SAML2/ECP</a>" index="7"/></div><div>    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="<a href="https://sp3.mcftestsite.com/Shibboleth.sso/SAML/POST">https://sp3.mcftestsite.com/Shibboleth.sso/SAML/POST</a>" index="8"/></div><div><br></div><div><span style="white-space:pre"> </span></div><div>and added the name <a href="http://sp3.mcftestsite.com">sp3.mcftestsite.com</a> to the idpselect_config.js file's  "this.returnWhiteList"</div><div><br></div><div><br></div><div>The issue i'm having is that after authentication existing IDPs are not able redirect me back to the sp3.  I'm sent back to the EDS page with the drop down. </div><div><br></div><div>If i test with a new IDP (which has the explicit ACS "<a href="http://sp3.mcftestsite.com/Shibboleth.sso/SAML2/POST">sp3.mcftestsite.com/Shibboleth.sso/SAML2/POST</a>"  i'm able to log in to the 2nd site without issues.</div><div>(in order to test with new IDP i ofcourse had to add the idps-metadata so shibboleth.xml is also modified at this point)</div><div><br></div><div>My questions are:</div><div><br></div><div>1a. Why I can't use the existing IDPs to authenticate to multiple applications behind my SP (reverse proxy server)?</div><div>1b. Can it be done without using the ApplicationOverride element?</div><div>2.  I had left  <ds:KeyName><a href="http://sp1.mcftestsite.com">sp1.mcftestsite.com</a></ds:KeyName> as still the same.  would it be best practice to re-generate the selfsigned key with and add <a href="http://sp3.mcftestsite.com">sp3.mcftestsite.com</a> as an Alt domain?  </div><div><br></div></div></div>