Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a RHEL 5.5 server in production with a few NameBasedVirtual hosts listening on port 80.

We have also have two (possibly mis-configured) SSL virtual hosts which use different Sockets as required by the Apache & the SSL protocol:

I am attempting to shibbolize only https://redcap-test.xyz.org.

After installing shibboleth 2.0 and configuring for a test identity provider, Shibboleth appears to be working on https://redcap.xyz.org.

Unfortunately, when i hit https://jira.xyz.org it also attempts to use shibboleth and throws an error.

Please note that jira.xyz.org and redcap-test.xyz.org worked fine using this configuration until I installed shibboleth.

Is there some obvious place to enable or disable shibboleth on a per vhost basis?

Does anyone see any glaring mistakes in my virtual hosts, available here:

Or my shibboleth configuration:

EDIT 1: I'm thinking maybe I can specify whether to use Shibboleth or not using the AuthType derivative...still looking for documentation on this.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

From the apache configuration you've posted, it appears that you've ended up with shibboleth enabled globally rather than within the virtual host you want it to work in. I say "appears", since neither AuthType nor Require appear in the file you've posted, which implies to me that the authorization is set up globally under mods-enabled/shib.conf (or something similar). You'll need to move the authorization bits from that file to the <VirtualHost> directive you want Shibboleth enabled on (or a <Location> or <Directory> directive within that vhost).

share|improve this answer
    
Yes...this. This makes sense. This is why I never ask questions on serverfault; It always ends up being something simple & makes me feel defeated. Irregardless - Thank you for solving –  iainlbc Feb 16 '11 at 20:52

You need to use a certificate that is issued for both domains using subjectAltName. See also: http://wiki.cacert.org/VhostTaskForce

share|improve this answer
    
This seems to apply to "Name Based Virtual Hosts" which is not what I am attempting to achieve. Both SSL Virtual hosts have their own socket (IP+Port) and function correctly when shibboleth is not installed. My problem is that when shibboleth is installed it's attempting to function on all SSL hosts and I need it only on 1 of the 2. –  iainlbc Feb 16 '11 at 19:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.