<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 8/6/20 2:28 PM, Donald Lohr wrote:<br>
</div>
<blockquote type="cite"
cite="mid:fe8b29bf-44e4-1d5d-367c-e1b3225a4a49@jmu.edu">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
By adding the a <tt><b>p:responderId</b></tt> to the section of
my relying-party.xml specifically for this SP, login now works:<br>
<br>
<tt><bean parent="RelyingPartyByName" c:relyingPartyIds=<a
class="moz-txt-link-rfc2396E"
href="https://acme.com/sp/shibboleth" moz-do-not-send="true">"https://acme.com/sp/shibboleth"</a>
</tt><tt><b>p:responderId=<a class="moz-txt-link-rfc2396E"
href="https://xxxx.yyyy.zzzz/idp/shibboleth"
moz-do-not-send="true">"https://xxxx.yyyy.zzzz/idp/shibboleth"</a></b></tt><tt>></tt><tt><br>
</tt><tt> .....<br>
.....<br>
</bean></tt><tt><br>
</tt><br>
Right/wrong/indifferent<br>
<br>
Thanks,<br>
Don<br>
<br>
</blockquote>
<p>If your actual requirement was to use a different cert/key AND a
different entityID, then that would be correct.</p>
<p>As someone else already pointed out, if all you needed to do was
use a different signing key/cert for that SP, then you can do that
with the same entityID:</p>
<p><a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP4/SecurityConfiguration">https://wiki.shibboleth.net/confluence/display/IDP4/SecurityConfiguration</a></p>
<p>the "Per-Profile Credential" example.</p>
<p>This is not rare - although maybe not terribly common either.
Most SPs don't care what cert/key you use - they use what you tell
them.<br>
</p>
<p><br>
</p>
</body>
</html>