<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">So attempted to just add it to the Override and I’m getting what I believe is an odd error.
<br>
<br>
Note: This was originally a v2 SP and was upgraded with zero changes outside the required ones and it's Windows and IIS so all the best combinations.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">ERROR XMLTooling.ParserPool : error on line 109, column 31, message: element 'Sessions' is not allowed for content model
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Reading the docs it says Sessions is a valid child element to <ApplicationOveride> and I understand that the default attributes are mostly ignored, so I duplicated what was there. I’m assuming something else is blocking this configuration.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><ApplicationOverride id="APPNAME" entityID=<a href="https://APPNAME.uww.edu/shibboleth">https://APPNAME.uww.edu/shibboleth</a>>
<o:p></o:p></p>
<p class="MsoNormal"> <Sessions lifetime="40000" timeout="7200" relayState="ss:mem" checkAddress="false" handlerSSL="true" cookieProps="https"><o:p></o:p></p>
<p class="MsoNormal"> <SSO entityID=”######.okta.com/IDPID”><o:p></o:p></p>
<p class="MsoNormal"> SAML2<o:p></o:p></p>
<p class="MsoNormal"> </SSO><o:p></o:p></p>
<p class="MsoNormal"> </Sessions><o:p></o:p></p>
<p class="MsoNormal"></ApplicationOveride><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">--Joel<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Cantor, Scott via users <users@shibboleth.net><br>
<b>Date: </b>Monday, May 15, 2023 at 1:50 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Cantor, Scott <cantor.2@osu.edu><br>
<b>Subject: </b>Re: SP setup for multiple IDPs<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">*EXTERNAL EMAIL*<br>
<br>
> What is the recommended way to handle this type setup? <br>
<br>
If there wasn't a URL difference between the applications, then there couldn't have been any overrides (at least none being used) and it was just broken to begin with, or at least full of unused settings.<br>
<br>
I wouldn't use overrides but if it's there and working, then the only change required to migrate one of them to a different IdP is to...change the setting. That's it. If you're trying to get rid of the overrides then the entityID setting has to move over into
the RequestMap in the same places the original overridden applicationId was set. That's why overrides are almost always unneeded now.<br>
<br>
If instead you have a situation where one URL has to allow for 2 IdPs or 20, that's discovery. There is nothing that can be done except discovery (or moving to IdP-initiated SSO).<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<o:p></o:p></p>
</div>
</div>
</body>
</html>