Versions Compared

Old Version 26

changes.mady.by.user Xavier Haurie

Saved on

compared with

New Version 27

changes.mady.by.user Xavier Haurie

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Then search for the marker: 'ADJUST_FOR_YOUR_SITE' in each of these files for indications of what / where you need to edit.

Configuration files based on samples in the Git repository

Location in Git Repo (under shrine-setup/src/main/resources)Location on SPDescription
sso/apache/sp-metadata.xml-sample

/var/www/html/sp-metadata.xml 

– as long as your Apache configuration sets DocumentRoot to /var/www/html (for instance in /etc/httpd/conf/httpd.conf) 

To be shared dynamically with your site's IdP (i.e. make it available at a given URL and share that URL with your IdP's maintainers/admins); or omit from the SP's web server, and instead share it securely with the IdP admins whenever it changes (if it does)

In either case, populate the entityID, public key certificate, and consumer service location with yours

sso/shibboleth/shibboleth2.xml-sample/etc/shibboleth/shibboleth2.xml

Specifies many aspects of your SP. You need to populate the <ApplicationDefaults> element's entityID and the <SSO> element's entityID xml attribute. Note that the REMOTE_USER xml attribute is set to "userId" which should match the id of exactly one attribute in attribute-map.xml.

The <CredentialResolver> element specifies the private+public key to use for encryption and signing while communicating with the idP. If you put the keys in the location specified above, there is no need to modify this element. Otherwise edit this file to reflect the location of the keys. Private key should be in a "safe" location. what if it is password-protected?

The <AttributeExtractor> element specifies the location of the file that specifies which attribute(s) returned by the idP must be made available to the Tomcat Servlet as Servlet Request attributes (namely attribute-map.xml)

sso/shibboleth/attribute-map.xml-sample/etc/shibboleth/attribute-map.xml The file name and path of this file is specified in the <AttributeExtractor> element's path xml attribute in shibboleth2.xml. This file specifies the SAML content that your SP turns into "attributes". These will be made available to the java code running on Tomcat as Servlet Request attribute.  Also, the attribute whose id is "userId" will be used to populate the REMOTE_USER header.
sso/apache/sp.conf-sample/etc/httpd/conf.d/sp.conf

Tells Apache to proxy all the HTTP requests for URLs under /shrine-api/* to the Shrine application using the AJP protocol.

For security reasons, Tomcat should open port 8009 only to localhost, and should reside on the same host as Apache.

Also tells Shibboleth to require SSO login before accessing URLs starting with /shrine-api/(staticData|ontology|qep|steward|shrine-webclient) 

Also: sets no-cache headers, sets isSsoMode cookie, and sets Access-Control-Allow-Origin, which needs to be populated with the correct hostname


sso/tomcat/server.xml-sample/opt/shrine/tomcat/conf/server.xml

Merge it into the existing server.xml.

Sets up the receiving end of AJP over NIO2 connection with Apache. 

sso/shrine/shrine.conf-sample

or

sso/shrine/override.conf-sample

/opt/shrine/tomcat/lib/shrine.conf

or

/opt/shrine/tomcat/lib/override.conf

Set Shrine configuration options for using SSO for log in. Specify the logout URL. Specify Shrine's session timeout in ms. You should use either file and merge it into the existing shrine.conf or override.conf

...