I am looking for some recommendation / advice, with the following scenario:
- Using apache 2.4 and Shib 2.
- The setup is SP initiated.
- Only one Apache web server
- I am protecting two resources.
- SiteA's IDP is OKTA, while siteB's IDP is Auth0.
- SiteA user base is different to Site B
- We do not want siteA's user base access SiteB's resources.
At the moment I have pretty much a traditional setup:
Shibboleth2.xml loads the IDP meta data for both sites in the Application default attribute:
In my ssl.conf I have the following:
<Location /siteA> AuthType shibboleth ShibRequestSetting requireSession 1 ShibRequestSetting entityID http://www.auth0.com/abcd require valid-user </Location> <Location /siteB> AuthType shibboleth ShibRequestSetting requireSession 1 ShibRequestSetting entityID http://www.okta.com/defgh require valid-user </Location>
So, based on the current set up, user one logs into siteA and authenticates via Auth0 IDP, this process will eventually create the Shibboleth cookie. Now, user one from siteA attempts to access SiteB, and they gain access because they already have the Shibboleth cookie.
So, how does one ensure the cookie is bound to the end points, i.e., if the Shib cookie is created for SiteA, I don't want that cookie to be valid for SiteB, I want to force the user to have to authenticate, and in this case user one from SiteA wont be able to authenticate as they don't have an account in SiteB OKTA IDP.