Shibboleth / Test IdP Config Change

This page documents the configuration change test procedure in the IAM Shibboleth installation. The Shibboleth installation has two servers (hanin and heald) in a master and hot standby configuration. Currently heald is the hot standby and hanin is the master. This procedure is meant to be a general guideline for all changes that might occur to an IdP. The example below is just that and does not reflect the actual change that might be tested.

1. Check out the appropriate directory from subversion on the hot standby Shibboleth server.

   [sxjpm@heald Junk]$ svn co svn+ssh://sxjpm@iron.alaska.edu/usr/local/iam/shib-svn/idp/trunk/conf
   A    conf/service.xml
   ...
   A    conf/login.config
   Checked out revision 1.
   

2. Copy the changed configuration file into place on the IdP.

   [root@heald ~]# cp ~sxjpm/Junk/conf/attribute-filter.xml /opt/shibboleth-idp/conf/attribute-filter.xml
   

3. Restart the IdP.

   [sxjpm@heald Junk]$ pbrun su -
   [root@heald ~]# su - tomcat
   -bash-3.2$ 
   -bash-3.2$ /opt/tomcat/bin/shutdown.sh
   -bash-3.2$ ps -ef | grep tomcat
   root      8811  8784  0 13:58 pts/1    00:00:00 grep tomcat
   tomcat   12756     1  0 Jun21 ?        00:03:50 /usr/lib/jvm/jre-1.6.0-sun.x86_64/bin/java -Djava.util.logging.config.file=/opt/tomcat/conf/logging.properties -Xmx1024m -XX:MaxPermSize=128m -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.endorsed.dirs=/opt/tomcat/endorsed -classpath /opt/tomcat/bin/bootstrap.jar -Dcatalina.base=/opt/tomcat -Dcatalina.home=/opt/tomcat -Djava.io.tmpdir=/opt/tomcat/temp org.apache.catalina.startup.Bootstrap start
   -bash-3.2$ /opt/tomcat/bin/startup.sh
   

4. Check the logs for startup anomalies and fix as necessary.

   -bash-3.2$ cat /opt/shibboleth-idp/logs/idp-process.log | grep "DEBUG"
   -bash-3.2$ cat /opt/shibboleth-idp/logs/idp-process.log | grep "ERROR"
   

5. Test with web browser and fix as necessary.
   • Linux: Modify local hosts file to point at standby IdP and then test SP/IdP interaction with local web browser.

     john@fearless:~$ sudo vi /etc/hosts
     ...
     # Heald
     137.229.114.189 idp.alaska.edu
     ...
     :wq!
     

   • Windows: TBD

6. If test results are good then repeat steps 1. and 2. from above on hanin. The IdP is configured to reload the attribute resolution, attribute filtering, and relying party configurations every 15 minutes. So wait 15 minutes or so and then revert hosts changes in step 5. and repeat step 5.