/etc/shibboleth/idp-metadata.xml

/etc/shibboleth/sp-key.pem

/etc/shibboleth/sp-cert.pem

Create a key pair; include the content of the certificate (sp-cert.pem) in sp-metadata.xml, and the paths of the key and certificate as xml attributes of the <CredentialResolver> element of shibboleth2.xml

/var/www/html/sp-metadata.xml 

– if your Apache sets DocumentRoot to /var/www/html (for instance in /etc/httpd/conf/httpd.conf) 

To be shared dynamically with your site's Shibboleth IdP (i.e. make it available at a given URL and share that URL with your IdP's maintainers/admins); or omit from the SP's web server, and instead email it to the IdP admins whenever it changes (if it does)

In either case, populate the entityID, public key certificate, and consumer service location with yours

Specifies many aspects of your SP. You need to populate the <ApplicationDefaults> element's entityID and the <SSO> element's entityID xml attribute. Note that we do not make use of the REMOTE_USER xml attribute in our implementation. The remote user is specified in the attribute-map.xml instead of in shibboleth2.xml. 

The <CredentialResolver> element specifies the private+public key to use for encryption and signing while communicating with the iDP. If you put the keys in the location specified above, there is no need to modify this element.

The <AttributeExtractor> element specifies the location of the file that specifies which attribute returned by the iDP must be made available to the the Tomcat's java code as Servlet Request attributes.

Tells Apache to require Shibboleth login for Shrine Urls (/shrine-api/*), and to proxy all the relevant HTTP requests to the Shrine application using the AJP protocol.

Tomcat should open port 8009 only to localhost, and should reside on the same host as your SP.

shrine.conf

override.conf

/opt/shrine/tomcat/lib/shrine.conf

/opt/shrine/tomcat/lib/override.conf

replace "shrine-sso-node01" with your own node name

add the following element under the top-level "shrine" element:

  queryEntryPoint {
   authenticationType = "sso"
 }

OR add the following line to override.conf:

shrine.queryEntryPoint.authenticationType = "sso"