Changes between Version 6 and Version 7 of SpSetup


Ignore:
Timestamp:
06/28/11 10:45:39 (13 years ago)
Author:
jpmitchell@…
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • SpSetup

    v6 v7  
    44 
    55UA Supported Configurations: 
    6 * Windows and Apache or IIS 
    7 * Linux and Apache or IIS 
     6* Apache or IIS on Windows  
     7* Apache on Linux 
    88* Shibboleth SP Version 2.4.2 
    99 
    … …  
    1313   * [[http://www.shibboleth.net/downloads/service-provider/latest/win32/|Latest 32-bit Windows Installer Packages]] 
    1414   * [[http://www.shibboleth.net/downloads/service-provider/latest/win64/|Latest 64-bit Windows Installer Packages]] 
    15  * Linux: (It is recommended to use a repo.) 
     15 * Linux: (It is recommended to use a binary repo.) 
    1616  * [[http://download.opensuse.org/repositories/security://shibboleth/|Binary RPMs]] 
    1717  * [[http://www.shibboleth.net/downloads/service-provider/latest/SRPMS/|Source RPMs]] 
    18182. Configure the SP 
    19  * Remove and regen the SP keys. 
     19 1. Remove and regen the SP keys. 
    2020  * Linux: 
    2121{{{ 
    … …  
    3131}}} 
    3232  * Windows: TBD 
    33  * Download and setup the IdP's metadata. 
     33 2. Download and setup the IdP's metadata. Check config for correct syntax. 
    3434  * Linux: 
    3535{{{ 
    … …  
    4949[root@idmt-1 shibboleth]# vi shibboleth2.xml 
    5050            --> 
    51             <SSO entityID="urn:mace:incommon:alaska.edu" 
     51            <SSO entityID="urn:mace:incommon:alaska.edu"> 
    5252              SAML2 SAML1 
    5353            </SSO> 
    … …  
    5959        <MetadataProvider type="XML" file="idp-metadata.xml"/> 
    6060:wq! 
     61[root@idmt-1 shibboleth]# shibd -t 
     62overall configuration is loadable, check console for non-fatal problems 
    6163}}} 
    6264  * Windows: TBD 
     65 3. Setup EntityID for SP. Note the entityID for the SP is _NOT_ a URL. It is a unique string that identifies your SP and is usually based off of the hostname of the system. It may also be a CNAME for the system. 
     66  * Linux: 
     67{{{ 
     68[root@idmt-1 shibboleth]# hostname 
     69idmt-1.alaska.edu 
     70[root@idmt-1 shibboleth]# pwd 
     71/etc/shibboleth 
     72[root@idmt-1 shibboleth]# vi shibboleth2.xml 
     73    <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. --> 
     74    <ApplicationDefaults entityID="https://idmt-1.alaska.edu/shibboleth" 
     75                         REMOTE_USER="eppn persistent-id targeted-id"> 
     76 
     77        <!-- 
     78:wq! 
     79[root@idmt-1 shibboleth]# shibd -t 
     80overall configuration is loadable, check console for non-fatal problems 
     81}}} 
     82  * Windows: TBD 
     83 4. Start Apache/IIS and Shibd and check function. 
     84  * Linux: 
     85{{{ 
     86[root@idmt-1 shibboleth]# service httpd start 
     87Starting httpd:                                            [  OK  ] 
     88[root@idmt-1 shibboleth]# service shibd start 
     89Starting shibd:                                            [  OK  ] 
     90[root@idmt-1 shibboleth]# curl -k https://localhost/Shibboleth.sso/Status | xmllint --format - | grep -C 3 "<Status>" 
     91  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current 
     92                                 Dload  Upload   Total   Spent    Left  Speed 
     93100  4889  100  4889    0     0   194k      0 --:--:-- --:--:-- --:--:-- 4774k 
     94      </ds:X509Data> 
     95    </ds:KeyInfo> 
     96  </md:KeyDescriptor> 
     97  <Status> 
     98    <OK/> 
     99  </Status> 
     100</StatusHandler> 
     101}}} 
     102  * Windows: TBD 
     103 5. Generate SP metadata. 
     104  * Linux: 
     105{{{ 
     106[root@idmt-1 shibboleth]# curl -k https://idmt-1.alaska.edu/Shibboleth.sso/Metadata > idmt1-metadata.xml 
     107  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current 
     108                                 Dload  Upload   Total   Spent    Left  Speed 
     109100  3807  100  3807    0     0   169k      0 --:--:-- --:--:-- --:--:-- 3717k 
     110[root@idmt-1 shibboleth]# xmllint --format idmt1-metadata.xml  
     111<?xml version="1.0"?> 
     112<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_657cf08a6730ac2e70ce094b8262cdf79ce25120" entityID="https://sp.example.org/shibboleth"> 
     113  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol"> 
     114    <md:Extensions> 
     115      <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://idmt-1.alaska.edu/Shibboleth.sso/Login"/> 
     116    </md:Extensions> 
     117    <md:KeyDescriptor> 
     118      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> 
     119        <ds:KeyName>idmt-1.alaska.edu</ds:KeyName> 
     120        <ds:X509Data> 
     121          <ds:X509SubjectName>CN=idmt-1.alaska.edu</ds:X509SubjectName> 
     122          <ds:X509Certificate>MIIC+jCCAeKgAwIBAgIJAKzKVe8S5t3gMA0GCSqGSIb3DQEBBQUAMBwxGjAYBgNV 
     123BAMTEWlkbXQtMS5hbGFza2EuZWR1MB4XDTExMDYyNzIzNDkxOVoXDTIxMDYyNDIz 
     124NDkxOVowHDEaMBgGA1UEAxMRaWRtdC0xLmFsYXNrYS5lZHUwggEiMA0GCSqGSIb3 
     125DQEBAQUAA4IBDwAwggEKAoIBAQDNwFn9fHtwKalW2gExxaSoodjwZSreNJxppMVa 
     126gkUyDsvJ2tBezONFz+fvt6eWFOrkrYiwYeLMKB26ee6Uf8XgZRGrGGNtZ3rN6+pw 
     127popxMQ0bVvko68fK0gZpWrKzrtDdLes+K51HZOd+FZ9bYDV+sM6kpaVpQDtSI5OT 
     128PkwEWjXtctkTTX48YUe5hCbwprBMEL5KZqiyjqfeXLNDcYrioTyxZXemeHzRtISK 
     129zNRgUgGbUFO64OAiaziSn6RB2gOoJqIZMmDaedo3QY8yaC56EJ6krrMFNb6wIUog 
     130RpxQxllxiKzmjufGk2up6KHUjQBmovhnY1/hy/fvvevIKFwLAgMBAAGjPzA9MBwG 
     131A1UdEQQVMBOCEWlkbXQtMS5hbGFza2EuZWR1MB0GA1UdDgQWBBQfTV+1yqucG5kM 
     132FJA4qttIwfLEBjANBgkqhkiG9w0BAQUFAAOCAQEAu/8zEVFsI4oDCVwbhnGuF154 
     133iKevamYhgsfJxWHt4fKIwGUnsl7H7TdBjLaCnRNiaLeuV0CIB+hGjbcl6JV7O/PO 
     134XopY/gzNF4uSAL9Lh8EWBNBSU7OmLgi6cpyWRpsGVvf+bhj2/TiOaiDSUGCgk7NN 
     1351/oys7bFnlA605UANXg/u9T5od9Hz01YInwEhGflN5ZfrrIdyZuCXbEVcmo/Z2p4 
     136FUMQ7Wd2nDk3g7fx50Sv9TIg7IIM2QI6L4+popFmJRy1p78r1yXQoz0tplfYgRek 
     137/LG0ZB9VqEErdx5fDE90IZVF7OHh1UzyTHl8+ZXTKnSQsLIfcfZb9j8GmjtMtg== 
     138</ds:X509Certificate> 
     139        </ds:X509Data> 
     140      </ds:KeyInfo> 
     141    </md:KeyDescriptor> 
     142    <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idmt-1.alaska.edu/Shibboleth.sso/Artifact/SOAP" index="0"/> 
     143    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idmt-1.alaska.edu/Shibboleth.sso/SLO/SOAP"/> 
     144    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idmt-1.alaska.edu/Shibboleth.sso/SLO/Redirect"/> 
     145    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idmt-1.alaska.edu/Shibboleth.sso/SLO/POST"/> 
     146    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://idmt-1.alaska.edu/Shibboleth.sso/SLO/Artifact"/> 
     147    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idmt-1.alaska.edu/Shibboleth.sso/SAML2/POST" index="0"/> 
     148    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://idmt-1.alaska.edu/Shibboleth.sso/SAML2/POST-SimpleSign" index="1"/> 
     149    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://idmt-1.alaska.edu/Shibboleth.sso/SAML2/Artifact" index="2"/> 
     150    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://idmt-1.alaska.edu/Shibboleth.sso/SAML2/ECP" index="3"/> 
     151    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://idmt-1.alaska.edu/Shibboleth.sso/SAML/POST" index="4"/> 
     152    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://idmt-1.alaska.edu/Shibboleth.sso/SAML/Artifact" index="5"/> 
     153  </md:SPSSODescriptor> 
     154</md:EntityDescriptor> 
     155}}} 
     156  * Windows: TBD 
     1573. Email SP metadata to iam@alaska.edu and request integration with UA IdP. Once the metadata is registered with the UA IdP integration can be tested at the https://idmt-1.alaska.edu/secure test URL that is configured by default with most installations. 
     1584. Decide which attributes your application will need to authorize access then email iam@alaska.edu and request those attributes be released to your SP from the UA IdP.