Changes between Version 7 and Version 8 of IdPSetup

Timestamp:

04/01/13 14:46:57 (12 years ago)

Author:

dabantz@…

Comment:

--

IdPSetup

@@ -23 +23 @@
 === UA localization ===
 
+==== Customize login.jsp ====
 2012: IdP distribution is at howkan:/home/sxjpm/Shib/shibboleth-identityprovider-2.3.0/src...
 
@@ -28 +29 @@
 
 production !IdPs (heald, hanin) do not have 2.3.0 src...
+==== Import private CAs as needed ====
+As of 2013-04-01 UA AD is using certificates signed by a local private CA.  Unless that CA's certificate is imported, the IdP will fail to establish connection to the AD server, potentially causing authN failure, but certainly causing a failure in attribute resolution.
 
+Import the CA certificate, per https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass with the following command that MUST be run by root (to write the cacerts file):
+{{{
+
+keytool -import -trustcacerts -alias "sensible-name-for-ca"
+        -file directory.crt -keystore $JAVA_HOME/lib/security/cacerts
+}}}
+
+==== !DataConnector Failover ====
+If the data connector encounters an error when trying to retrieve attribute information from the database, one or more failover data connectors can be defined. These connectors are only invoked if this data connector fails (not if simply finds no results) and they are invoked in the order they are listed until one succeeds.
+
+N.B.: if the !DataConnector as a whole fails, UA experience has been that the attribute resolution process aborts and the SAML assertion has no attributes.  A possible more robust solution is to define a failover "static data connector" that will return no attributes or static-value attributes, bu not abort the attribute resolver.
+
+Failover connectors are defined by the <resolver:FailoverDataConnector> element with a ref attribute whose value is the unique ID of the data connector to use in the event that this one fails.
+
+Basic Relational Database Data Connector Definition with Dependencies
+{{{
+<resolver:DataConnector xsi:type="dc:RelationalDatabase" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
+                                          id="UNIQUE_ID">
+ 
+     <resolver:Dependency ref="DEFINITION_ID_1" />
+     <resolver:Dependency ref="DEFINITION_ID_2" />
+     <resolver:Dependency ref="CONNECTOR_ID_3" />
+     <resolver:Dependency ref="CONNECTOR_ID_4" />
+ 
+     <resolver:FailoverDataConnector ref="CONNECTOR_ID_1" />
+ 
+     <!-- Remaining configuration from the next steps goes here -->
+ 
+</resolver:DataConnector>
+}}}
 === IdP Install (not upgrade) Recipe ===