Changes between Version 3 and Version 4 of Iam2023/Agenda/SP-Installation-VHosts


Ignore:
Timestamp:
Mar 30, 2023, 8:02:23 PM (20 months ago)
Author:
admin
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • Iam2023/Agenda/SP-Installation-VHosts

    v3 v4  
    268268
    269269Now we should be able to enter above URLs on the browser to check whether they are working. You may get empty web pages since we haven't yet installed our web sites.
     270
    270271
    271272
    … …  
    299300sudo systemctl restart apache2
    300301
    301 nano lms-ssl.conf
     302nano lms.YOUR-DOMAIN-ssl.conf
    302303
    303304<IfModule mod_ssl.c>
    … …  
    321322</IfModule>
    322323
    323 a2ensite lms-ssl.conf
     324a2ensite lms.YOUR-DOMAIN-ssl.conf
     325
     326Also create SSL site configuration file for Wordpress site too.
     327
     328nano wp.YOUR-DOMAIN-ssl.conf
     329
     330<IfModule mod_ssl.c>
     331        <VirtualHost *:443>
     332
     333                ServerName wp.YOUR-DOMAIN
     334                ServerAdmin you@YOUR-DOMAIN
     335                DocumentRoot /var/www/wp.YOUR-DOMAIN/public_html
     336
     337                ErrorLog ${APACHE_LOG_DIR}/wp-error.log
     338                CustomLog ${APACHE_LOG_DIR}/wp-access.log combined
     339       
     340
     341                SSLCertificateFile /etc/ssl/certs/ssl-lms.crt
     342                SSLCertificateKeyFile /etc/ssl/private/ssl-lms.key
     343
     344                RewriteEngine on
     345                RewriteCond %{SERVER_NAME} =wp.YOUR-DOMAIN
     346                RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent] # port 80 -- > 443 redirection
     347        </VirtualHost>
     348</IfModule>
     349
     350a2ensite wp.YOUR-DOMAIN-ssl.conf
    324351
    32535210. Let'sencrypt setup (Skip this step if you already configured SSL with self signed or CA provided certificates)
    … …  
    372399{{{
    373400...
    374 <ApplicationDefaults entityID="https://sp.YOUR-DOMAIN/shibboleth"
     401<ApplicationDefaults entityID="https://lms.YOUR-DOMAIN/shibboleth"
    375402        REMOTE_USER="eppn subject-id pairwise-id persistent-id"
    376403        cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
    … …  
    395422}}}
    396423
    397 13. Create SP metadata credentials:
     42413. Create SP metadata credentials for both sites:
    398425{{{
    399426
    400427    /usr/sbin/shib-keygen -n lms-signing -e https://lms.YOUR-DOMAIN/shibboleth
    401428    /usr/sbin/shib-keygen -n lms-encrypt -e https://lms.YOUR-DOMAIN/shibboleth
     429
     430    /usr/sbin/shib-keygen -n wp-signing -e https://wp.YOUR-DOMAIN/shibboleth
     431    /usr/sbin/shib-keygen -n wp-encrypt -e https://wp.YOUR-DOMAIN/shibboleth
     432
    402433    shibd -t /etc/shibboleth/shibboleth2.xml (Check Shibboleth configuration)
    403434
    404435}}}
     436
     437=== Enable Shibboleth on apache virtual hosts ===
     438
     439<IfModule mod_ssl.c>
     440        <VirtualHost *:443>
     441
     442                ServerName lms.YOUR-DOMAIN
     443                ServerAdmin you@YOUR-DOMAIN
     444                DocumentRoot /var/www/lms.YOUR-DOMAIN/public_html
     445
     446                ErrorLog ${APACHE_LOG_DIR}/lms-error.log
     447                CustomLog ${APACHE_LOG_DIR}/lms-access.log combined
     448       
     449
     450                SSLCertificateFile /etc/ssl/certs/ssl-lms.crt
     451                SSLCertificateKeyFile /etc/ssl/private/ssl-lms.key
     452
     453                <Location /moodle>
     454                           #ShibRequestSetting applicationId mdl
     455                </Location>
     456
     457                <Directory /var/www/html/moodle/auth/shibboleth/index.php>
     458                            AuthType shibboleth
     459                            #ShibRequestSetting applicationId mdl
     460                            ShibRequireSession On
     461                            require valid-user
     462                </Directory>
     463        </VirtualHost>
     464</IfModule>
     465
     466nano wp.YOUR-DOMAIN-ssl.conf
     467
     468<IfModule mod_ssl.c>
     469        <VirtualHost *:443>
     470
     471                ServerName wp.YOUR-DOMAIN
     472                ServerAdmin you@YOUR-DOMAIN
     473                DocumentRoot /var/www/wp.YOUR-DOMAIN/public_html
     474
     475                ErrorLog ${APACHE_LOG_DIR}/wp-error.log
     476                CustomLog ${APACHE_LOG_DIR}/wp-access.log combined
     477       
     478
     479                SSLCertificateFile /etc/ssl/certs/ssl-lms.crt
     480                SSLCertificateKeyFile /etc/ssl/private/ssl-lms.key
     481
     482                <Location />
     483                           AuthType Shibboleth
     484                           ShibRequestSetting requireSession false
     485                           Require shibboleth
     486                </Location>
     487                #Wordpress shibboleth plugin needs requireSession to be false
     488        </VirtualHost>
     489</IfModule>
    405490
    40649114. Enable Shibboleth Apache2 configuration:
    … …  
    411496}}}
    412497
    413 15. Now you are able to reach your Shibboleth SP Metadata on:
    414 {{{
    415 https://sp.YOUR-DOMAIN/Shibboleth.sso/Metadata (change sp.YOUR-DOMAIN to you SP full qualified domain name)
    416 }}}
     49815. We have now set up shibboleth SP for two different entities. They have to be registered with LIAF before using the Federation discovery Service to point different IDP's.
     499
     500Download the metadata from both applications by going to the following URL's.
     501{{{
     502https://lms.YOUR-DOMAIN/Shibboleth.sso/Metadata
     503https://wp.YOUR-DOMAIN/Shibboleth.sso/Metadata
     504}}}
     505
     506Now register them with LIAF separately.
    417507
    41850816. Register your SP on LEARN test federation:
    … …  
    422512You may have to answer several questions describing your service to the federation provider.
    423513
    424 == Configure Moodle as an Federated Resource ==
    425 
    426 Here as a prerequisite you need a working moodle installation at the path https://sp.YOUR-DOMAIN/moodle. For this please refer to the link [https://ws.learn.ac.lk/wiki/Csle2022/Agenda/databaseandweb here].
     514== Enabling Wordpress plugin ==
     515
     516Install and activate the shibboleth plugin by Michael !McNeill, mitcho (Michael 芳貴 Erlewine), Will Norris {{{ https://wordpress.org/plugins/shibboleth/ }}}
     517
     518Then go to '''Settings''' -> '''Shibboleth'''
     519
     520
     521On General Tab:
     522
     523Login URL: {{{ https://wp.YOUR-DOMAIN/Shibboleth.sso/Login }}}
     524
     525Logout URL: {{{ https://wp.YOUR-DOMAIN/Shibboleth.sso/Logout }}}
     526
     527Attribute Access: Environment Variables
     528
     529
     530On User Tab:
     531
     532Tick Automatically Create Accounts.
     533Check the attribute map as well. If you ticked any attribute Manage tick, user will not be able to change the values once they logged in.
     534
     535
     536On Authorization Tab:
     537
     538Select Subscriber as the Default Role.
     539
     540
     541On Logging Tab:
     542
     543Enable all Logging.
     544
     545
     546
     547Click Save.
     548
     549
     550== Enabling Moodle Plugin ==
     551
     552As Moodle admin, go to the '''Site administration''' >>> '''Plugins''' >>> '''Authentication''' and click on the '''Shibboleth''' enable '''eye'''. Next go to its settings.
     553
     554
     555Fill in the fields of the form.
     556
     557The fields 'Username', 'First name', 'Surname', etc. should contain the name of the environment variables of the Shibboleth attributes that you want to map onto the corresponding Moodle variable. Especially the 'Username' field is of great importance because this attribute is used for the Moodle authentication of Shibboleth users.
     558
     559Username: eppn
     560
     561Moodle WAYF service: No
     562
     563Shibboleth Service Provider logout handler URL: /Shibboleth.sso/Logout
     564
     565Data mapping (First name): givenName
     566
     567Data mapping (Surname): surname
     568
     569Data mapping (Email address): mail
     570
     571Update local (Email address): On Creation
     572
     573Lock value (Email address): Locked
     574
     575
     576Click Save.
     577
     578
     579Now using a private browser, try to log in to both systems using your IDP test user.
    427580
    428581