title: SSO-plus-SSL and Shibboleth: What options for sites with numerous virtual hosts?
body: <p><strong>Background:</strong> Customer X is a low-budget non-profit outfit that nonetheless has a lot of activity configured on virtual hosts, and the virtual hosts multiply very frequently. Customer X also has a lot of users and is interested in getting them over to a single sign on solution. This way, all the users can use the same credentials on all the virtual hosts.</p>
  
  <p>It has also pretty much been mandated that we use [Shibboleth Single-Sign-on](<a href="http://en.wikipedia.org/wiki/Shibboleth_(Internet2)" rel="nofollow noreferrer">http://en.wikipedia.org/wiki/Shibboleth_(Internet2)</a> to handle the authentication.</p>
  
  <p><strong>Problem:</strong> Shibboleth Single Sign On uses SSL as part of its protocol, but getting multiple virtual hosts to use SSL is not a walk in the park. 
  <a href="https://stackoverflow.com/questions/276134/how-can-i-setup-different-ssl-certificates-for-vhosts-on-apache">This question about virtual-hosts with SSL details some of the pitfalls</a>.</p>
  
  <p><strong>Question:</strong> What is the best way to proceed with this scenario (summary):</p>
  
  <ul>
  <li>multiple virtual hosts on apache</li>
  <li>setting up a distinct IP and NIC for each virtual host is pretty much not an option</li>
  <li>SSL pretty much requires a separate IP</li>
  <li>they all need some kind of SSO</li>
  <li>we are being heavily pressured to use Shibboleth as the SSO provider</li>
  </ul>
  
  <p>Is there anything we may be missing here or some way to resolve this, short of requiring a separate IP for all vhosts?</p>