<!DOCTYPE HTML><html>
<head>
<meta name="Generator" content="Amazon WorkMail v3.0-4510">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>RE: Single Service Provider with Multiple IDP's</title>
</head>
<body>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Julio,</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">The built-in metadata generator is only intended as a template or a starting point for actual metadata. In this case, since you've got two different websites behind a single EntityProvider, you'll need to modify your metadata manually so that wt.website.com is also considered a valid recipient of assertions. You'll need at least:</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://wt.website.com/Shibboleth.sso/SAML2/POST" index="7"/></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Look at the outbound AuthnRequest to see where it's requesting users be sent after they've successfully logged in. You'll likely see that it's still trying to send users to st.website.com/Shibboleth.sso/SAML2/POST, which is both wrong and should be explicitly prevented by policy, which probably means the SSO configuration is still off. A MetadataFilter whitelist inside each ApplicationOverride would be wise.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Take care,</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Nate.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">--------</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><img src="https://www.signet.id/wp-content/uploads/2019/08/signature-e1566142203123.png" /></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><font size="4">The Art of Access</font> <strong>®</strong></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><font size="2"><strong>Nate Klingenstein</strong> | Principal</font></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><font size="2"><a href="https://www.signet.id/">https://www.signet.id/</a> </font></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><blockquote style="border-left:2px solid #b0b0b7; margin-left:5px; margin-right:0px; padding-left:5px">-----Original message-----<br /><strong>From:</strong> Julio Lopez<br /><strong>Sent:</strong> Wednesday, October 9 2019, 4:06 pm<br /><strong>To:</strong> Shib Users<br /><strong>Subject:</strong> Re: Single Service Provider with Multiple IDP's<br /><br /><!-- begin sanitized html --><style type="text/css">P {margin-top:0;margin-bottom:0;}</style><div class="bodyclass"><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">Reporting back.</div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">I've upgraded to 3.0.4.1 and configured Shibboleth</div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">As before, Site ID 1 (st.website.com) works for users of Company A</div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt">Site ID </span><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt">1518374912 (wt.website.com) works for Company A but we would expect the URL to be redirected to Company B IDP.</span></div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt">When I connect to st.website.com/Shibboleth.sso/Metadata I get the metadata file with the following entries.</span></div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span> <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://st.website.com/Shibboleth.sso/Artifact/SOAP" index="1"/></span></span><div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://st.website.com/Shibboleth.sso/SLO/Artifact"/></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> </span><div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://st.website.com/Shibboleth.sso/SLO/POST"/></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> </span><div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://st.website.com/Shibboleth.sso/SLO/Redirect"/></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> </span><div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://st.website.com/Shibboleth.sso/SLO/SOAP"/></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> </span><div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://st.website.com/Shibboleth.sso/SAML2/POST" index="1"/></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> </span><div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://st.website.com/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> </span><div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://st.website.com/Shibboleth.sso/SAML2/Artifact" index="3"/></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> </span><div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://st.website.com/Shibboleth.sso/SAML2/ECP" index="4"/></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> </span><div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://st.website.com/Shibboleth.sso/SAML/POST" index="5"/></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> </span><div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://st.website.com/Shibboleth.sso/SAML/Artifact" index="6"/></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"> <span> </md:SPSSODescriptor></span></span></div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff">When I connect to wt.website.com/Shibboleth.sso/Metadata I get the metadata file with the same entries.</span></span></span></div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"><span style="background-color:#ffffff; margin:0px"> <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://st.website.com/Shibboleth.sso/Artifact/SOAP" index="1"/></span></span></span></span><div style="background-color:#ffffff; margin:0px"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://st.website.com/Shibboleth.sso/SLO/Artifact"/></span></span></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> </span></span></span><div style="background-color:#ffffff; margin:0px"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://st.website.com/Shibboleth.sso/SLO/POST"/></span></span></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> </span></span></span><div style="background-color:#ffffff; margin:0px"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://st.website.com/Shibboleth.sso/SLO/Redirect"/></span></span></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> </span></span></span><div style="background-color:#ffffff; margin:0px"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://st.website.com/Shibboleth.sso/SLO/SOAP"/></span></span></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> </span></span></span><div style="background-color:#ffffff; margin:0px"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://st.website.com/Shibboleth.sso/SAML2/POST" index="1"/></span></span></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> </span></span></span><div style="background-color:#ffffff; margin:0px"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://st.website.com/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/></span></span></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> </span></span></span><div style="background-color:#ffffff; margin:0px"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://st.website.com/Shibboleth.sso/SAML2/Artifact" index="3"/></span></span></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> </span></span></span><div style="background-color:#ffffff; margin:0px"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://st.website.com/Shibboleth.sso/SAML2/ECP" index="4"/></span></span></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> </span></span></span><div style="background-color:#ffffff; margin:0px"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://st.website.com/Shibboleth.sso/SAML/POST" index="5"/></span></span></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> </span></span></span><div style="background-color:#ffffff; margin:0px"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://st.website.com/Shibboleth.sso/SAML/Artifact" index="6"/></span></span></span></div><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff"> </span></span></span></div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff">It appears that Shibboleth (or IIS) is not redirecting the request to the correct IDP.</span></span></span></div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff">I have attached my Shibboleth2.xml file to get a fresh set of eyes on it.</span></span></span></div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff">As before, we have a single IIS site (listed in IIS as site number "2" with IP (example 65.55.12.11) where st.website.com and wt.website.com both point to.</span></span></span></div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff">Thank you</span></span></span></div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><span style="background-color:rgba(0, 0, 0, 0); color:#000000; font-family:calibri,helvetica,sans-serif; font-size:12pt"><span><span style="background-color:#ffffff">-Julio</span></span></span></div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div id="appendonsend"> </div><hr style="width:98%" /><div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif"><strong>From:</strong> Julio Lopez <julz@outlook.com><br /><strong>Sent:</strong> Wednesday, October 2, 2019 7:11 AM<br /><strong>To:</strong> Shib Users <users@shibboleth.net><br /><strong>Subject:</strong> Re: Single Service Provider with Multiple IDP's</font><div> </div></div><div dir="auto">Thank you Nate. <br /><br />I’ll upgrade to 3.0.4, get our main site work and report back.<div> </div><div>-Julio<div dir="ltr"> <blockquote type="cite">On Oct 1, 2019, at 4:56 PM, Nate Klingenstein <ndk@signet.id> wrote:<br /> </blockquote></div><blockquote type="cite"><div dir="ltr"><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Julio,</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">You'll first need to upgrade. 2.6 is really unsupported at this point and has a range of vulnerabilities.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Second, you need a mapping from the Site ID in IIS to the hostname in Shibboleth. You have one for st, but not for wt.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> <Site id="1" name="st.website.com"/></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> <Site id="1518374912" name="wt.website.com"/></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Third, you'll need to explicitly protect that location using the RequestMap.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><a title="This external link opens in a new window" href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fdisplay%2FSP3%2FRequestMap&data=02%7C01%7C%7Ca8aa1dc708ff4b0ff72d08d746cb00fe%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637055710024523506&sdata=LJt8fGJ42KfO99I0TZcP0Sf0CzMxLcFWDGhUz17esFA%3D&reserved=0">https://wiki.shibboleth.net/confluence/display/SP3/RequestMap</a></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">You might have done that but omitted it from your email.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">You shouldn't hardcode one of the IdP names in your shibboleth2.xml file. Instead, have no entityID attribute and pass it in on the query string:</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">https://wt.website.com/Shibboleth.sso/Login?entityID=https://wt.website.com/shibboleth</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">https://st.website.com/Shibboleth.sso/Login?entityID=https://st.website.com/shibboleth</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">It might work after those changes are made, but there's a good chance you'll hit another unexpected issue. ApplicationOverrides are hard, especially on IIS.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Take care,</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Nate.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">--------</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><img src="https://www.signet.id/wp-content/uploads/2019/08/signature-e1566142203123.png" /></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><font size="4">The Art of Access</font> <strong>®</strong></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><font size="2"><strong>Nate Klingenstein</strong> | Principal</font></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><font size="2"><a title="This external link opens in a new window" href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.signet.id%2F&data=02%7C01%7C%7Ca8aa1dc708ff4b0ff72d08d746cb00fe%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637055710024523506&sdata=uiITo5VA8UHQ%2Fp%2BhZK7xq%2Bj7xmR6BhT085UkI7zO518%3D&reserved=0">https://www.signet.id/</a> </font></p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><blockquote style="border-left:2px solid #b0b0b7; margin-left:5px; margin-right:0px; padding-left:5px">-----Original message-----<br /><strong>From:</strong> Julio Lopez<br /><strong>Sent:</strong> Tuesday, October 1 2019, 4:47 pm<br /><strong>To:</strong> users@shibboleth.net<br /><strong>Subject:</strong> Single Service Provider with Multiple IDP's<br /> <div class="x_bodyclass"><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">Hello everyone, first time post here and I hope it makes sense.</div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">We run Shibboleth SP 2.6.</div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">We have an application that runs on a windows iis webserver (7)</div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">The application is hosted on a single website in IIS but responds to multiple DNS names. All DNS names point to the same external IP</div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><a id="LPlnk724950" title="This external link opens in a new window" href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fst.website.com&data=02%7C01%7C%7Ca8aa1dc708ff4b0ff72d08d746cb00fe%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637055710024533515&sdata=nKPQDDHEsnzDkqZgX9iPK8YgmCcRC5WCAKaSpVoZbR4%3D&reserved=0">https://st.website.com</a> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><a id="LPlnk417967" title="This external link opens in a new window" href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwt.wbsite.com&data=02%7C01%7C%7Ca8aa1dc708ff4b0ff72d08d746cb00fe%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637055710024533515&sdata=5Bun%2FGqWe1FwjtULPj2PCOjr8Ug0dfyLPJ%2F5j4LLoec%3D&reserved=0">https://wt.website.com</a></div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">Shibboleth2.xml contains the follwing</div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><span> <InProcess logger="native.logger"></span><div> <ISAPI normalizeRequest="true" safeHeaderNames="true"></div><div> <Site id="1" name="st.website.com"/></div><div> </ISAPI></div> <span> </InProcess></span></div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><a id="LPlnk484941" title="This external link opens in a new window" href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fst.website.com&data=02%7C01%7C%7Ca8aa1dc708ff4b0ff72d08d746cb00fe%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637055710024543520&sdata=2peGfhS7XcB9PBlYE2%2B2v0LZYEmgEm1phIBPT2kpf54%3D&reserved=0">https://st.website.com</a> is configured (and working with Okta IDP) for Company A. Staff can login via SSO.</div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><a id="LPlnk119377" title="This external link opens in a new window" href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwt.website.com&data=02%7C01%7C%7Ca8aa1dc708ff4b0ff72d08d746cb00fe%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637055710024543520&sdata=KkOY3hwrF2N%2BWwO9u3zs7vJYTrt4oQzU9YAKM9SlnwY%3D&reserved=0">https://wt.website.com</a> is configured in the shibboleth2.xml (not working with Okta IDP) for Company B a completely separate IDP instance. </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">The following is what I have listed for both sites in the Shibboleth2.xml</div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><span>https://st.website.com/SSOLogin"></span><div> <Sessions lifetime="28800" timeout="3600" checkAddress="false" relayState="cookie" handlerSSL="false"></div><div> <SSO entityID="http://www.okta.com/UNIQUEIDforCorpA"></div><div> SAML2 SAML1</div><div> </SSO></div><div> </Sessions></div><div> <!-- If you can provide a URL to your metadata file, use the line below: --></div><div> <MetadataProvider type="XML" file="C:\opt\shibboleth-sp\etc\shibboleth\st.website.com-idpMetadata.xml" /></div><div> <AttributeExtractor type="XML" validate="true" path="attribute-map-stwebsite.xml"/></div><div> <CredentialResolver type="File" key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/></div><div> </ApplicationOverride></div><div> <ApplicationOverride id="wt.website.com" entityID="https://wt.website.com/shibboleth" REMOTE_USER="eppn" homeURL="https://wt.website.com/SSOLogin"></div><div> <Sessions lifetime="28800" timeout="3600" checkAddress="false" relayState="cookie" handlerSSL="false"></div><div> <SSO entityID="http://www.okta.com/<span style="background-color:#ffffff; font-family:Calibri,Helvetica,sans-serif">UNIQUEIDforCorpB</span>"></div><div> SAML2 SAML1</div><div> </SSO></div><div> </Sessions></div><div> <!-- If you can provide a URL to your metadata file, use the line below: --></div><div> <MetadataProvider type="XML" file="C:\opt\shibboleth-sp\etc\shibboleth\wt.website.com-idpMetadata.xml" /></div><div> <AttributeExtractor type="XML" validate="true" path="attribute-map-wtwebsite.xml"/></div><div> <CredentialResolver type="File" key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/></div><div> </ApplicationOverride></div> <span></ApplicationDefaults></span></div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">When someone from Corp B goes to the wt.website.com/SSOLogin, they're redirected to Corp A's Okta instance and not to Corp B's Okta instance.</div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">I'm stuck and would appreciate some help as we will be bringing on more companies in the near future. </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">Thank you!</div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">-Julio</div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div><div style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"> </div></div><pre>--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</pre></blockquote> <span>-- </span><br /><span>For Consortium Member technical support, see https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7C%7Ca8aa1dc708ff4b0ff72d08d746cb00fe%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637055710024563534&sdata=HRS%2F7fPKVwWxd2xKNcMM9yMaDUZImd1hUuVWuI3qhdQ%3D&reserved=0</span><br /><span>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</span></div></blockquote></div></div></div><pre>--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</pre> <!-- end sanitized html --></blockquote>
</body>
</html>