SAML configuration for multiple websites on same AEM 6.1 SP2 instance | Community
Skip to main content
arvindk091986
arvindk091986
Level 2
May 21, 2018
Solved

SAML configuration for multiple websites on same AEM 6.1 SP2 instance

  • May 21, 2018
  • 5 replies
  • 5788 views

Hi all,

As per the business requirement, I am working on providing login functionality for multiple websites on same AEM 6.1 SP2 Instance. We already have a website which is configured with an IDP and SPID accordingly. Now that there are few more websites added to the same instance, we are in a process of providing login functionality for them. We have a single IDP and multiple SPID's with respective rankings for the websites. So upon creation of multiple SAML Configurations, the handler picks up the highest ranking configuration and processes it, for whatever the website it is with the "Path" configured to "/" for all the SAML configurations. Is there a way for us to say that www.aaa.com has to use SAML handler 1, www.bbb.com has to use SAML handler 2? Or is it something which we need to extend the existing SAML auth handler for doing it so?

My requirement is something near to this topic: Multiple Domains and SAML

Have followed the below mentioned forum threads, but no luck in getting through. Please suggest

Multiple SAML Configurations on Same AEM 6.1 Instance

Multiple Authentication handlers

AEM integration with multiple identity provider

Thanks,

Arvind

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by anushap40132887

We can handle multiple domain login with OOB adobe saml configuration itself. No need of custom handler.
Just make sure that the "path" property in the saml configuration should match with assertion consumer URL in IDP side.

Eg :  if we have two domains www.abc.com with root path /content/abc and www.xyz.com with /content/xyz, then in the saml configuration for www.abc.com path should be conifgured as /content/abc and assertion consumer URL should be as https://www.abc.com/content/abc/saml_login and configure the other domain in similar way. Also configure the default redirect url for both domains as required.

5 replies

smacdonald2008
smacdonald2008
Level 10
May 21, 2018

We have a SAML article here -- Integrating SAML with Adobe Experience Manager

For multiple ones - looks like you are correct - a custom handler is needed.

akhoury
Adobe Employee
akhouryAdobe Employee
Adobe Employee
May 22, 2018

Why have "/" configured as the path for all of them.  To avoid having to do some special handling you could have each handler configured with "Path" pointing to the site (e.g. for the www.aaa.com handler the Path field would be /content/aaa).  Then when the user goes to the site (they should be visiting /content/aaa anyway), they would get sent to the correct IDP for login.

arvindk091986
arvindk091986Author
Level 2
May 23, 2018

Hi Andrew,

Upon changing the the path to "/content/aaa" and "/content/bbb" it still picks up the highest ranking SAML configuration for all the websites login. As I said, its single IDP and multiple SPID's in our scenario.


Thanks,
Arvind

A
anushap40132887Accepted solution
Level 3
June 13, 2018

We can handle multiple domain login with OOB adobe saml configuration itself. No need of custom handler.
Just make sure that the "path" property in the saml configuration should match with assertion consumer URL in IDP side.

Eg :  if we have two domains www.abc.com with root path /content/abc and www.xyz.com with /content/xyz, then in the saml configuration for www.abc.com path should be conifgured as /content/abc and assertion consumer URL should be as https://www.abc.com/content/abc/saml_login and configure the other domain in similar way. Also configure the default redirect url for both domains as required.

srikanthp689160
srikanthp689160
Level 4
November 27, 2019

Hi,

Our requirement is similar but when user moves onto other domain, user must not be asked to login again since IDP is same for both domains i.e. user is on a page with domain www.xyz.com and tries to navigate to www.xyz.co.uk user must not be asked to login again since already logged in and has access to co.uk as well. Is it possible? Are there any configurations required at IDP end to achieve this?

We are using Salesforce as Identity Provider.

Any suggestions would be really helpful.

Thanks,

Srikanth Pogula.

Terms & ConditionsAccessibility statement

Loading footer...