Page History

/etc/shibboleth/idp-metadata.xml

/etc/shibboleth/sp-key.pem

/etc/shibboleth/sp-cert.pem

Create a key pair; include the content of the certificate (sp-cert.pem) in sp-metadata.xml, and the paths in the <CredentialResolver> element of shibboleth2.xml

/var/www/html/sp-metadata.xml 

– if your Apache sets DocumentRoot to /var/www/html (for instance in /etc/httpd/conf/httpd.conf) 

To be shared dynamically with your site's Shibboleth IdP (i.e. make it available at a given URL and share that URL with your IdP's maintainers/admins; or omit from the SP, and instead email it to the IdP admins

In either case, populate the public key certificate with yours

Tells Apache to require Shibboleth login for Shrine Urls (/shrine-api/*), and to proxy all the relevant requests to the Shrine application.

Tomcat should open port 8080 8009 only to localhost(???), and should reside on the same host as your SP.

shrine.conf

override.conf

/opt/shrine/tomcat/lib/shrine.conf

/opt/shrine/tomcat/lib/override.conf

replace "shrine-sso-node01" with your own node name

add the following element under the top-level "shrine" element:

  queryEntryPoint {
   authenticationType = "sso"
 }

OR add the following line to override.conf:

shrine.queryEntryPoint.authenticationType = "sso"