Changes between Version 1 and Version 2 of GrouperUIInstall

Timestamp:

06/15/13 08:53:29 (11 years ago)

Author:

uaguest_SPatel1@…

Comment:

--

GrouperUIInstall

@@ -97 +97 @@
 == Configure Shibboleth ==
 
-1.  In the /etc/shibboleth/shibboleth2.xml file, set the entityID of the SP:
+1.  Add the metadata for the UA IdP to a new file called /etc/shibboleth/alaska-metadata.xml.  It just needs to contain a single EntityDescriptor element for the UA IdP that can be copied from the InCommon metadata.  And then that simply needs to be wrapped around a EntitiesDescriptor element.  Note that I would have simply referenced the InCommon metadata from the SP, but grinnell doesn't have access to connect to the InCommon site to retrieve it.  Therefore, I created a local copy.
+
+2.  In the /etc/shibboleth/shibboleth2.xml file:
+
+a) Set the entityID of the SP.  And add "bannerid" to the front of the REMOTE_USER values.  This is done so that REMOTE_USER gets set as the authenticated users' BannerID, which then gets passed to Tomcat and available for the Grouper UI.  Authentication in the Grouper UI will work if REMOTE_USER is either the subject id (which is the case here) or a subject identifier.
 
 {{{
     <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
     <ApplicationDefaults entityID="https://grinnell.alaska.edu/shibboleth"
+                         REMOTE_USER="bannerid eppn persistent-id targeted-id">
 }}}
+
+
+b) Add the reference to the metadata file.  Replace the following:
+
+{{{
+        <!-- Example of locally maintained metadata. -->
+        <!--
+        <MetadataProvider type="XML" file="partner-metadata.xml"/>
+        -->
+}}}
+
+.. with this:
+
+{{{
+        <MetadataProvider type="XML" file="alaska-metadata.xml"/>
+}}}
+
+
+c) Add the entityID of the IdP.  Replace the following:
+
+{{{
+            <SSO entityID="https://idp.example.org/idp/shibboleth"
+                 discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
+              SAML2 SAML1
+            </SSO>
+}}}
+
+.. with this:
+
+{{{
+            <SSO entityID="urn:mace:incommon:alaska.edu"
+                 discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
+              SAML2 SAML1
+            </SSO>
+}}}
+
+
+3.  In the /etc/shibboleth/attribute-map.xml file, add the mapping for the BannerID attribute.
+
+{{{
+    <Attribute name="urn:mace:alaska.edu:attributes:bannerid" id="bannerid" />
+}}}
+
+
+4.  Restart the SP:
+
+{{{
+[root@grinnell shibboleth]# /etc/init.d/shibd restart
+Stopping shibd:                                            [  OK  ]
+Starting shibd: /sbin/restorecon:  Warning no default label for /var/run/shibboleth/shibd.pid
+                                                           [  OK  ]
+}}}