I am looking for some recommendation / advice, with the following scenario:

  • Using apache 2.4 and Shib 2.
  • The setup is SP initiated.
  • Only one Apache web server
  • I am protecting two resources.
    • example.com/siteA
    • example.com/siteB
  • SiteA's IDP is OKTA, while siteB's IDP is Auth0.
  • SiteA user base is different to Site B
  • We do not want siteA's user base access SiteB's resources.

At the moment I have pretty much a traditional setup:

Shibboleth2.xml loads the IDP meta data for both sites in the Application default attribute:

In my ssl.conf I have the following:

<Location /siteA>
        AuthType shibboleth
        ShibRequestSetting requireSession 1
    ShibRequestSetting entityID  http://www.auth0.com/abcd
        require valid-user

<Location /siteB>
        AuthType shibboleth
        ShibRequestSetting requireSession 1
    ShibRequestSetting entityID  http://www.okta.com/defgh
        require valid-user

So, based on the current set up, user one logs into siteA and authenticates via Auth0 IDP, this process will eventually create the Shibboleth cookie. Now, user one from siteA attempts to access SiteB, and they gain access because they already have the Shibboleth cookie.

So, how does one ensure the cookie is bound to the end points, i.e., if the Shib cookie is created for SiteA, I don't want that cookie to be valid for SiteB, I want to force the user to have to authenticate, and in this case user one from SiteA wont be able to authenticate as they don't have an account in SiteB OKTA IDP.

1 Answer 1


There are several solutions to this problem:

  • Instead of "require valid-user" use a different authorization rule. E.g. if you know that users from IdP 1 have a common attribute (e.g. schachHomeOrganisation=company1.com) that only they have and users from the other IdP 2 have another common attribute (e.g. o=Company-XY) then use these attributes for access control with "Require shib-attr schachHomeOrganisation company1.com" and "Require shib-attr schachHomeOrganisation o Company-XY". Obviously, your SP would need an entry in attribute-map.xml for these attributes.
  • The better and safer solution would be to configure a separate logical Shibboleth application for the two sites, the default one that you already have in ApplicationDefaults which has metadata only for the auth0 IdP, and another one with an ApplicationOverride (e.g. with id="myotherappname"), which has metadata only for the okta IdP. This can be configured by using an ApplicationOverride element in shibboleth2.xml for the second application. In apache for the second application you then would add to the apache directive "ShibRequestSetting applicationId myotherappname"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .