Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a RHEL 5.5 server in production with a few NameBasedVirtual hosts listening on port 80.

We have also have two (possibly mis-configured) SSL virtual hosts which use different Sockets as required by the Apache & the SSL protocol:

I am attempting to shibbolize only

After installing shibboleth 2.0 and configuring for a test identity provider, Shibboleth appears to be working on

Unfortunately, when i hit it also attempts to use shibboleth and throws an error.

Please note that and worked fine using this configuration until I installed shibboleth.

Is there some obvious place to enable or disable shibboleth on a per vhost basis?

Does anyone see any glaring mistakes in my virtual hosts, available here:

Or my shibboleth configuration:

EDIT 1: I'm thinking maybe I can specify whether to use Shibboleth or not using the AuthType derivative...still looking for documentation on this.

share|improve this question
up vote 1 down vote accepted

From the apache configuration you've posted, it appears that you've ended up with shibboleth enabled globally rather than within the virtual host you want it to work in. I say "appears", since neither AuthType nor Require appear in the file you've posted, which implies to me that the authorization is set up globally under mods-enabled/shib.conf (or something similar). You'll need to move the authorization bits from that file to the <VirtualHost> directive you want Shibboleth enabled on (or a <Location> or <Directory> directive within that vhost).

share|improve this answer
Yes...this. This makes sense. This is why I never ask questions on serverfault; It always ends up being something simple & makes me feel defeated. Irregardless - Thank you for solving – iainlbc Feb 16 '11 at 20:52

You need to use a certificate that is issued for both domains using subjectAltName. See also:

share|improve this answer
This seems to apply to "Name Based Virtual Hosts" which is not what I am attempting to achieve. Both SSL Virtual hosts have their own socket (IP+Port) and function correctly when shibboleth is not installed. My problem is that when shibboleth is installed it's attempting to function on all SSL hosts and I need it only on 1 of the 2. – iainlbc Feb 16 '11 at 19:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.