Versions Compared

Old Version 5

changes.mady.by.user Xavier Haurie

Saved on

compared with

New Version Current

changes.mady.by.user Xavier Haurie

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

The following instructions are meant to get you going as quickly as possible. If you want a better understanding of what's going on, go to the next "More Details" sections of this document.

Software Installation

...

Configuration Directories

In summary, the directories containing configuration files which need to be modified are:

...

/opt/shrine/tomcat

...

/

...

  • The Shibboleth configuration files should be in /etc/shibboleth

...

conf/ ← Tomcat configuration files

/opt/shrine/tomcat ← Tomcat home/lib/ ← Shrine config files

/etc/shibboleth ← / ← Shibboleth configuration files

/etc/httpd/** ← Apache configuration files

/var/www/html/ ← Apache static content as set in, for instance, /etc/httpd/conf/httpd.conf

...

Configuration files to create from scratch or to import


Location on SPDescription
key pair

/etc/shibboleth/sp-key.pem

/etc/shibboleth/sp-cert.pem

If the Shibboleth installer has not already done so, create a key pair; include the content of the public key certificate (sp-cert.pem) in sp-metadata.xml (see below), and the paths of the key and certificate as xml attributes of the <CredentialResolver> element of shibboleth2.xml (see below)

To create a key pair, use /etc/shibboleth/keygen.sh; as per https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2067398706/keygen and also https://docs.shib.ncsu.edu/docs/configure/index.html.

You don't need to create separate key pairs for signing and for encryption.

idp-metadata.xml/etc/shibboleth/idp-metadata.xmlA copy of your idP's metadata. You'll need to ask the admin(s) of your idP for a copy of it, most likely over a secure channel. Rename it to idp-metadata.xml and put it in /etc/shibboleth

Configuration files based on samples in Git

Sample configuration files can be found in the Git repository in the nightly shrine-setup module, specifically at shrine-setup/src/main/resources/ssozip file located at https://repo.open.catalyst.harvard.edu/nexus/content/groups/public/net/shrine/shrine-setup/4.0.0/shrine-setup-4.0.0-dist.zip

  • sso/apache/sp.conf-sample
  • sso/apache/sp-metadata.xml-sample
  • sso/shibboleth/attribute-map.xml-sample
  • sso/shibboleth/shibboleth2.xml-sample
  • sso/tomcat/server.xml-sample
  • sso/shrine/shrine.conf-sample
  • sso/shrine/override.conf-sample

Copy these files to the location on the SP (i.e. your server) indicated in the table below. Remove the "-sample" from the file names. Overwrite the existing config files.


Then search Among the many configuration files, there are nine which need to be modified to reflect your installation, as follows in the table below. Search for the marker: 'ADJUST_FOR_YOUR_SITE' in those each of these files for indications of what / where you need to edit them.

The files ca be found in the following git repository: https://open.catalyst.harvard.edu/stash/scm/shrine/shrine-sso-configs.git in the "develop" branch (to be changed!)

5 Configuration files based on samples in the Git repository


Directory and Filename in Git RepoLocation in zip fileLocation on SPNotesDescription
sso/apache/sp-metadata.xml-sample

/var/www/html/sp-metadata.xml 

– if as long as your Apache configuration sets DocumentRoot to /var/www/html (for instance in /etc/httpd/conf/httpd.conf) 

To be shared dynamically with your site's Shibboleth IdP (i.e. make it available at a given URL as a document at the document root and share that URL with your IdP's maintainers/admins); or omit from the SP's (i.e. your) web server, and instead email it to / share it securely with the IdP admins whenever it changes (if it does)

In either case, populate the entityID, public key certificate, and consumer service location with yours.

sso/shibboleth/shibboleth2.xml-sample/etc/shibboleth/shibboleth2.xml

Populate the entityID attribute in<ApplicationDefaults> to match your entityID in sp-metadata.xml.

Populate the entityID attribute in <SSO> to match the idP's entityID in idp-metadata.xml. 

Populate the supportContact attribute of the <Errors> element with an email address.Specifies many aspects of your SP. You need to populate the <ApplicationDefaults> element's entityID and the <SSO> element's entityID xml attribute. Note that we do not make use of the REMOTE_USER xml attribute in our implementation. Instead the remote user is specified in the attribute-map.xml. 

The <CredentialResolver> element specifies the private+public key to use for encryption and signing while communicating with the iDPidP. If you put the keys in the location specified above and the private key is not password-protected, then there is no need to modify this element. (. Otherwise edit this file to reflect the location of the keys and optionally the private key password.

The private key should be stored in a "safe" location and . If it is password protected. see what iTeam/Simon does)-protected, that should be reflected in the <CredentialResolver>'s password attribute.

sso/shibboleth/attribute-map.xml-sample

The <AttributeExtractor> element specifies the location of the file that specifies which attribute(s) returned by the iDP must be made available to the the Tomcat's java code as Servlet Request attributes.

attribute-map.xml 		/etc/shibboleth/attribute-map.xml The file name and path of this file is specified in the <AttributeExtractor> element's path xml attribute in shibboleth2.xml. This file specifies the SAML content that your SP turns into "attributes". In our implementation it specifies that the "ecommonsid" SAML attribute returned by the iDP upon successful login will be made available to the java code running on Tomcat as the Servlet Request attribute "remoteUser". Populate the idP's attribute name for the user; to be mapped to the attribute id "userId"
shrine-setup/src/main/resources/sso/apache/sp.conf-sample/etc/httpd/conf.d/sp.conf

Tells Apache to require Shibboleth login for Shrine Urls (/shrine-api/*), and to proxy all the relevant HTTP requests to the Shrine application using the AJP protocol.

Tomcat should open port 8009 only to localhost, and should reside on the same host as Apache.

Populate the ServerName, ProxyPass and Header set Access-Control-Allow-Origin directives with your hostname.

sso/tomcat/server.xml-sampleserver.xml/opt/shrine/tomcat/conf/server.xmlAready set up as the receiving end of AJP over NIO2 connection with Apache. No changes are needed.

4 More Configuration Files

Most likely the following 3 attributes of <Connector port="6443"... /> are already populated, but if not then populate certificateKeystoreFile, certificateKeystorePassword, certificateKeyAlias.

You will need to populate proxyName in the AjpNio2Protocol connector.

Once done, Merge the contents  of server.xml-sample into the existing /opt/shrine/tomcat/conf/server.xml.

sso/shrine/shrine.conf-sample

or

sso/shrine/override.conf-sample

idp-metadata.xml

/etc/shibboleth/idp-metadata.xml

A copy of your IdP's metadata. You'll need to ask the admin(s) of your iDP for a copy of it.key pair

/etc/shibboleth/sp-key.pem

/etc/shibboleth/sp-cert.pem

Create a key pair; include the content of the certificate (sp-cert.pem) in sp-metadata.xml (see below), and the paths of the key and certificate as xml attributes of the <CredentialResolver> element of shibboleth2.xml (see below) (private key should be in a "safe" location and password protected. see what iTeam/Simon does)

shrine.conf

override.conf

/opt/shrine/tomcat/lib/shrine.conf

or

/opt/shrine/tomcat/lib/override.conf

Set Shrine configuration

option for using "sso" for log in.server.xml

options for using SSO for login/logout.

In override.conf it would look like:

  • Specify that we are using SSO: shrine.queryEntryPoint.authenticationType = "sso"
  • Specify the logout URL (shrine.webclient.ssoLogoutUrl) = (see override.conf-sample)
  • Specify Shrine's session timeout as such: shrine.webclient.sessionTimeout = "30 minutes".

You should use either file and merge it into the existing shrine.conf or override.conf in /opt/shrine/tomcat/

conf/server.xmlAready set up as the receiving end of AJP over NIO2 connection with Apache. No changes are needed.

lib


Next Steps:

Fast forward to SHRINE 4.0.0 Appendix A.8 - Starting and Stopping the Software

or

Read the "More Details" pages that follow, starting with SHRINE 4.0.0 Appendix A.3 - More Details : Shibboleth Configuration