shibboleth-spで複数ホスト運用

SPのshibdの設定でApplicationOverrideを使うと複数のホストを運用できます
https://spaces.internet2.edu/display/SHIB2/NativeSPApplicationOverride
ApplicationOverrideでサイトごとに
サーバ証明書や提供したい情報の制限や環境変数名やIdPを変えれるので便利です
以下の情報は単なる"オレはこうしてるぜ"的な情報で忘れないためのメモです(サーバ証明書だけoverride)
shibboleth2.xml抜粋

...
<RequestMap applicationId="default">
    <Host name="www1.example.net" authType="shibboleth"
    requireSession="true"/>
    <Host name="www2.example.net" applicationId="vhost1"
    authType="shibboleth" requireSession="true"/>
</RequestMap>
...
<ApplicationDefaults id="default" policyId="default"
    entityID="https://www1.example.net/shibboleth-sp"
    REMOTE_USER="eppn persistent-id targeted-id"
    signing="false" encryption="false">
    <CredentialResolver type="File"
        key="/etc/pki/tls/private/www1.example.net.key"
        certificate="/etc/pki/tls/certs/www1.example.net.cer"/>
    <ApplicationOverride id="vhost1"
    entityID="https://www2.example.net/shibboleth-sp">
        <CredentialResolver type="File"
            key="/etc/pki/tls/private/www2.example.net.key"
            certificate="/etc/pki/tls/certs/www2.example.net.cer"/>
    </ApplicationOverride>
</ApplicationDefaults>
...

httpd.conf抜粋

LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_22.so
...
<VirtualHost 192.0.2.1:443>
    ServerName   www1.example.net
    ...
    SSLEngine on
    SSLCertificateFile /etc/pki/tls/certs/www1.example.net.cer
    SSLCertificateKeyFile /etc/pki/tls/private/www1.example.net.key
    ...
    <Location /secure>
        AuthType shibboleth
        ShibRequestSetting requireSession 1
        require valid-user
    </Location>
</VirtualHost>
<VirtualHost 192.0.2.2:443>
    ServerName   www2.example.net
    ...
    SSLEngine on
    SSLCertificateFile /etc/pki/tls/certs/www2.example.net.cer
    SSLCertificateKeyFile /etc/pki/tls/private/www2.example.net.key
    ...
    <Location /secure>
        AuthType shibboleth
        ShibRequestSetting requireSession 1
        require valid-user
    </Location>
</VirtualHost>