<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]-->
<title>RE: Use single shibboleth as SP for multiple sites</title>
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-IN" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi Nate,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Thanks for the help. I followed the documentation and was able to configure two different SP with one installation of Shibboleth using “ApplicationOverride”. But for second SP I am stuck in a loop
after successful IDP login. Request is going to IDP, getting 200 response from IDP and then again a new request is triggered to IDP and so on.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">I have configured the second SP using configuration given below -<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><ApplicationOverride id="envstage" entityID="https://env-stage.xyz.com/index.php"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <Sessions lifetime="28800" timeout="3600" checkAddress="false" handlerSSL="true" cookieName=" envstage " cookieProps="; domain= env-stage.xyz.com; path=/envstage; secure; HttpOnly"
handlerURL="/envstage/Shibboleth.sso" ><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <SSO entityID="urn:xyz:stage:idp" postArtifact="true" encryption="true" discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> SAML2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> </SSO><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> </Sessions><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <MetadataProvider type="XML" validate="true" path="stage-partner-metadata.xml"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"></ApplicationOverride><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">I have checked shibd.log as well but not able to find any error there as well. Please suggest what I am missing.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Ravresh Kumar <o:p>
</o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Nate Klingenstein<br>
<b>Sent:</b> 25 March 2020 03:07<br>
<b>To:</b> Shib Users <users@shibboleth.net>; users@shibboleth.net<br>
<b>Subject:</b> RE: Use single shibboleth as SP for multiple sites<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Ravresh,<o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">It's not just possible; it's what a large portion of the SP was written for. Depending on how differently you want the second site to behave and how you
want to partition things, it's either a simple or a complex configuration change.<o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">First, you'll need to protect the new URL path. Then spend a little time thinking whether you want this to look like one logical application to the IdP's.
If not, you'll need to set a unique entityID for the second SP, which will require a little further configuration. If you want it to behave differently than the other SP in other ways, then you have some more intricate configuration to do. This is all well-documented
in the Wiki.<o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><a href="https://wiki.shibboleth.net/confluence/display/SP3/ApplicationOverride">https://wiki.shibboleth.net/confluence/display/SP3/ApplicationOverride</a><o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><a href="https://wiki.shibboleth.net/confluence/display/SP3/AddIdP">https://wiki.shibboleth.net/confluence/display/SP3/AddIdP</a><o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Take care,<o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Nate.<o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">--------<o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><img border="0" id="_x0000_i1025" src="https://www.signet.id/wp-content/uploads/2019/08/signature-e1566142203123.png"><o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:13.5pt;font-family:"Arial",sans-serif">The Art of Access</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif">
<strong><span style="font-family:"Arial",sans-serif">®</span></strong><o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><strong><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Nate Klingenstein</span></strong><span style="font-size:10.0pt;font-family:"Arial",sans-serif"> | Principal</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><a href="https://www.signet.id/">https://www.signet.id/</a>
</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #B0B0B7 1.5pt;padding:0cm 0cm 0cm 4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<p class="MsoNormal">-----Original message-----<br>
<strong><span style="font-family:"Calibri",sans-serif">From:</span></strong> Ravresh Kumar<br>
<strong><span style="font-family:"Calibri",sans-serif">Sent:</span></strong> Tuesday, March 24 2020, 3:27 pm<br>
<strong><span style="font-family:"Calibri",sans-serif">To:</span></strong> <a href="mailto:users@shibboleth.net">
users@shibboleth.net</a><br>
<strong><span style="font-family:"Calibri",sans-serif">Subject:</span></strong> Use single shibboleth as SP for multiple sites<br>
<br>
<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal">Hi,<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I want to use the single installation of shibboleth as SP for two different sites which are configured on the same server on which shibboleth is installed and configured. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">e.g. site1.example.org is protected by shibboleth as SP. Now, I want site2.example.org to be protected by same shibboleth installation as SP. Is it possible to to do this? <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Regards, <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Ravresh Kumar<o:p></o:p></p>
</div>
<p class="MsoNormal">This email (including any attachments) contains confidential, privileged or legally protected information, and is meant solely for its intended recipients. Any review, use, copying, forwarding or other disclosure or distribution of the
email or its contents by anyone else is strictly prohibited. If you received this email in error, please immediately notify the sender by reply email and then delete the email (and all attachments) from your system. Thank you in advance for your cooperation.<o:p></o:p></p>
</div>
<pre>-- <o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">https://wiki.shibboleth.net/confluence/x/coFAAg</a><o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><o:p></o:p></pre>
</blockquote>
</div>
This email (including any attachments) contains confidential, privileged or legally protected information, and is meant solely for its intended recipients. Any review, use, copying, forwarding or other disclosure or distribution of the email or its contents
by anyone else is strictly prohibited. If you received this email in error, please immediately notify the sender by reply email and then delete the email (and all attachments) from your system. Thank you in advance for your cooperation.
</body>
</html>