Changes between Version 4 and Version 5 of Iam2023/Agenda/SP-Installation-VHosts


Ignore:
Timestamp:
Mar 30, 2023, 11:57:18 PM (20 months ago)
Author:
admin
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • Iam2023/Agenda/SP-Installation-VHosts

    v4 v5  
    22
    33In this lab we are going to enable shibboleth login for Moodle and Wordpress web applications. Installation assumes you have already installed Ubuntu Server 22.04 with default configuration and has a public IP connectivity.
     4
     5Here we will install applications under below sub domains.
     6
     7Moodle => lms.YOUR-DOMAIN
     8Wordpress => wp.YOUR-DOMAIN
     9
    410
    511== Install Apache Web Server ==
    … …  
    175181[[Image(https://ws.learn.ac.lk/raw-attachment/wiki/Csle2022/Agenda/databaseandweb/web30.png)]]
    176182
    177 Now as below edit the hosts file and add you domains with the IP address of your guest VM.
    178 
    179 [[Image(https://ws.learn.ac.lk/raw-attachment/wiki/Csle2022/Agenda/databaseandweb/web31.png)]]
     183Now edit the hosts file.
     184
     185[[Image(https://ws.learn.ac.lk/raw-attachment/wiki/Iam2023/Agenda/SP-Installation-VHosts/web31.png)]]
     186
     187Add the below entries to the end of the file. IP is your SP virtual machine public IP given for the lab.
     188
     189192.248.6.X wp.YOUR-DOMAIN
     190192.248.6.X lms.YOUR-DOMAIN
    180191
    181192== Add domains to the hosts file in Linux ==
    … …  
    208219
    209220For Moodle,
     221{{{
    210222sudo mkdir -p /var/www/lms.YOUR-DOMAIN/public_html
     223}}}
    211224
    212225For Wordpress,
     226{{{
    213227sudo mkdir -p /var/www/wp.YOUR-DOMAIN/public_html
    214 
     228}}}
    215229
    216230Then add relevant apache configuration file for Moodle as below.
    … …  
    240254}}}
    241255
     256{{{
    242257<VirtualHost *:80>
    243258    ServerName wp.YOUR-DOMAIN
    … …  
    249264    CustomLog ${APACHE_LOG_DIR}/wp.YOUR-DOMAIN-access.log combined
    250265</VirtualHost>
     266}}}
    251267
    252268Once we do the configurations we have to enable the created sites as below,
    … …  
    269285Now we should be able to enter above URLs on the browser to check whether they are working. You may get empty web pages since we haven't yet installed our web sites.
    270286
    271 
     287== Securing Web Sites ==
    272288
    273289Here we have to create SSL certificates and assign them to the virtual hosts created. We can create SSL certificates using three methods.
    274 1. Generate a self-signed certificates (Steps 5 to 9)
    275 2. Create certificates using Let's Encrypt free SSL service. (Steps 10 to )
     2901. Generate a self-signed certificates
     2912. Create certificates using Let's Encrypt free SSL service.
    2762923. Receiving certificates from a Commercial Certificate Authority.
    277293
    278 As below you can use any of the above methods. Follow the steps as you prefer.
    279 
     294Here we will the method 1 and generate self-signed certificates for the domains.
     295
     296To generate self signed certificates for the Moodle LMS enter below command.
     297
     298{{{
    280299openssl req -x509 -newkey rsa:4096 -keyout /etc/ssl/private/ssl-lms.key -out /etc/ssl/certs/ssl-lms.crt -nodes -days 1095
    281 
    282 
     300}}}
     301
     302Here you will be prompted for some domain related informations and enter them as appropriately.
     303
     304{{{
    283305You are about to be asked to enter information that will be incorporated
    284306into your certificate request.
    … …  
    295317Common Name (e.g. server FQDN or YOUR name) []:lms.dhammikalalantha.com
    296318Email Address []:lalantha@learn.ac.lk
    297 
     319}}}
     320
     321After generating certificates you have to enable ssl module and restart apache.
     322{{{
    298323sudo a2enmod ssl
    299324
    300325sudo systemctl restart apache2
    301 
     326}}}
     327
     328Since we have now SSL certificates we will use them to enable SSL on our created web sites/domains.
     329
     330Go to the directory below and create the SSL configuration file,
     331
     332{{{
     333cd /etc/apache2/sites-available
    302334nano lms.YOUR-DOMAIN-ssl.conf
    303 
     335}}}
     336
     337{{{
    304338<IfModule mod_ssl.c>
    305339        <VirtualHost *:443>
    … …  
    312346                CustomLog ${APACHE_LOG_DIR}/lms-access.log combined
    313347       
    314 
    315348                SSLCertificateFile /etc/ssl/certs/ssl-lms.crt
    316349                SSLCertificateKeyFile /etc/ssl/private/ssl-lms.key
    317350
    318                 RewriteEngine on
    319                 RewriteCond %{SERVER_NAME} =lms.YOUR-DOMAIN
    320                  RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent] # port 80 -- > 443 redirection
    321351        </VirtualHost>
    322352</IfModule>
    323 
     353}}}
     354
     355Then to enable the site
     356
     357{{{
    324358a2ensite lms.YOUR-DOMAIN-ssl.conf
     359}}}
    325360
    326361Also create SSL site configuration file for Wordpress site too.
    327362
     363{{{
    328364nano wp.YOUR-DOMAIN-ssl.conf
    329 
     365}}}
     366
     367{{{
    330368<IfModule mod_ssl.c>
    331369        <VirtualHost *:443>
    … …  
    338376                CustomLog ${APACHE_LOG_DIR}/wp-access.log combined
    339377       
    340 
    341378                SSLCertificateFile /etc/ssl/certs/ssl-lms.crt
    342379                SSLCertificateKeyFile /etc/ssl/private/ssl-lms.key
    343 
    344                 RewriteEngine on
    345                 RewriteCond %{SERVER_NAME} =wp.YOUR-DOMAIN
    346                 RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent] # port 80 -- > 443 redirection
    347380        </VirtualHost>
    348381</IfModule>
    349 
     382}}}
     383
     384Enable SSL site,
     385
     386{{{
    350387a2ensite wp.YOUR-DOMAIN-ssl.conf
    351 
    352 10. Let'sencrypt setup (Skip this step if you already configured SSL with self signed or CA provided certificates)
    353 
    354 
    355 Install Letsencypt and enable https
    356 {{{
    357 apt install certbot python3-certbot-apache
    358 certbot --apache
    359 }}}
    360 
    361 Go through the interactive prompt and include your server details. Make sure you select redirect option when asked.
    362 
    363 Let's forward http traffic to https
    364 
    365         RewriteEngine on
    366         RewriteCond %{SERVER_NAME} =lms.YOUR-DOMAIN
    367         RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent] # port 80 -- > 443 redirection
    368 
    369 Then enable the Apache rewrite module.
    370 
    371 sudo a2enmod rewrite
     388}}}
     389
     390Now check whether you can browse the SSL sites in your web browser
     391
     392https://lms.YOUR-DOMAIN/
     393https://wp.YOUR-DOMAIN/
    372394
    373395
    374396== Install Shibboleth Service Provider ==
    375397
    376 3. Install Shibboleth SP:
     398Now we will install Shibboleth SP software.
    377399
    378400{{{
    … …  
    380402}}}
    381403
    382 From this point the location of the SP directory is: /etc/shibboleth
     404SP configuration directory should be created at /etc/shibboleth
    383405
    384406
    385407== Configure Shibboleth SP ==
    386408
    387 11. Download Federation Metadata Signing Certificate:
     409Now we need to download Federation Metadata Signing Certificate:
    388410{{{
    389411cd /etc/shibboleth/
    … …  
    391413}}}
    392414
    393 12. Edit shibboleth2.xml opportunely:
     415Edit shibboleth2.xml opportunely. Make sure to change fields entityID, discoveryURL
    394416
    395417{{{
    … …  
    397419}}}
    398420
    399 {{{
    400 ...
    401 <ApplicationDefaults entityID="https://lms.YOUR-DOMAIN/shibboleth"
     421Do the modifications as described below.
     422
     423Change the ApplicationDefaults tag to your domain name.
     424{{{
     425    <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
     426    <ApplicationDefaults entityID="https://lms.YOUR-DOMAIN/shibboleth"
    402427        REMOTE_USER="eppn subject-id pairwise-id persistent-id"
    403428        cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
    404 ...
    405 <Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerSSL="true" cookieProps="https">
    406 ...
    407 <SSO discoveryProtocol="SAMLDS" discoveryURL="https://fds.ac.lk">
    408    SAML2
    409 </SSO>
    410 ...
    411 <MetadataProvider type="XML" url="https://fr.ac.lk/signedmetadata/metadata.xml" legacyOrgName="true" backingFilePath="test-metadata.xml" maxRefreshDelay="7200">
    412      
    413       <MetadataFilter type="Signature" certificate="federation-cert.pem" verifyBackup="false"/>
    414      
    415       <MetadataFilter type="RequireValidUntil" maxValidityInterval="864000" />
    416 </MetadataProvider>
    417 <!-- Simple file-based resolvers for separate signing/encryption keys. -->
    418 <CredentialResolver type="File" use="signing"
    419       key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
    420 <CredentialResolver type="File" use="encryption"
    421       key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>
    422 }}}
    423 
    424 13. Create SP metadata credentials for both sites:
     429}}}
     430
     431Modify the SSO tag as below.
     432{{{
     433            <SSO  discoveryProtocol="SAMLDS" discoveryURL="https://fds.ac.lk">
     434              SAML2
     435            </SSO>
     436}}}
     437
     438Change the MetadataProvider section as well.
     439{{{
     440        <MetadataProvider type="XML" url="https://fr.ac.lk/signedmetadata/metadata.xml" legacyOrgName="true" backingFilePath="test-metadata.xml" maxRefreshDelay>
     441
     442                <MetadataFilter type="Signature" certificate="federation-cert.pem" verifyBackup="false"/>
     443
     444                <MetadataFilter type="RequireValidUntil" maxValidityInterval="864000" />
     445        </MetadataProvider>
     446}}}
     447
     448Change the key and certificate fields as given. We will later generate these keys and certificates.
     449{{{
     450        <!-- Simple file-based resolvers for separate signing/encryption keys. -->
     451        <CredentialResolver type="File" use="signing"
     452            key="lms-signing-key.pem" certificate="lms-signing-cert.pem"/>
     453        <CredentialResolver type="File" use="encryption"
     454            key="lms-encrypt-key.pem" certificate="lms-encrypt-cert.pem"/>
     455}}}
     456
     457Add below section just before the </ApplicationDefaults> tag.
     458{{{
     459        <ApplicationOverride id="wp" entityID="https://wp.YOUR-DOMAIN/shibboleth">
     460                <CredentialResolver type="File" use="signing"
     461                        key="wp-signing-key.pem" certificate="wp-signing-cert.pem"/>
     462                <CredentialResolver type="File" use="encryption"
     463                        key="wp-encrypt-key.pem" certificate="wp-encrypt-cert.pem"/>
     464        </ApplicationOverride>
     465}}}
     466
     467
     468Create SP metadata credentials for both sites:
    425469{{{
    426470
    … …  
    431475    /usr/sbin/shib-keygen -n wp-encrypt -e https://wp.YOUR-DOMAIN/shibboleth
    432476
    433     shibd -t /etc/shibboleth/shibboleth2.xml (Check Shibboleth configuration)
    434 
     477}}}
     478
     479Now check the shibboleth configuration,
     480{{{
     481shibd -t /etc/shibboleth/shibboleth2.xml
    435482}}}
    436483
    437484=== Enable Shibboleth on apache virtual hosts ===
    438485
     486Now to enable shibboleth login of our install applications we need to modify the relevant configurations files as below.
     487
     488First for the Moodle application.
     489{{{
     490cd /etc/apache2/sites-available
     491nano lms.YOUR-DOMAIN-ssl.conf
     492}}}
     493
     494{{{
    439495<IfModule mod_ssl.c>
    440496        <VirtualHost *:443>
    … …  
    463519        </VirtualHost>
    464520</IfModule>
    465 
     521}}}
     522
     523Then change the Wordpress configuration file.
     524
     525{{{
    466526nano wp.YOUR-DOMAIN-ssl.conf
    467 
     527}}}
     528
     529{{{
    468530<IfModule mod_ssl.c>
    469531        <VirtualHost *:443>
    … …  
    488550        </VirtualHost>
    489551</IfModule>
    490 
    491 14. Enable Shibboleth Apache2 configuration:
    492 {{{
    493 
     552}}}
     553
     554Then enable Shibboleth Apache2 configuration:
     555{{{
    494556    a2enmod shib
    495557    systemctl reload apache2.service
    496558}}}
    497559
    498 15. We have now set up shibboleth SP for two different entities. They have to be registered with LIAF before using the Federation discovery Service to point different IDP's.
     560== Register both services with LIAF ==
     561
     562We have now set up shibboleth SP for two different entities. They have to be registered with LIAF before using the Federation discovery Service to point different IDP's.
    499563
    500564Download the metadata from both applications by going to the following URL's.
    … …  
    506570Now register them with LIAF separately.
    507571
    508 16. Register your SP on LEARN test federation:
    509 
    510572Go to https://liaf.ac.lk/#join and follow the Service provider registration. Once the federation operator approves your request, you will be asked to use the content of your metadata file on federation registry registration.
    511573
    512574You may have to answer several questions describing your service to the federation provider.
     575
     576Once you registered successfully you have enable the Shibboleth support in the application itself. For that Moodle and Wordpress has pluggins to be enabled and configured.
     577
     578
     579== Enabling Moodle Plugin ==
     580
     581As Moodle admin, go to the '''Site administration''' >>> '''Plugins''' >>> '''Authentication''' and click on the '''Shibboleth''' enable '''eye'''. Next go to its settings.
     582
     583
     584Fill in the fields of the form.
     585
     586The fields 'Username', 'First name', 'Surname', etc. should contain the name of the environment variables of the Shibboleth attributes that you want to map onto the corresponding Moodle variable. Especially the 'Username' field is of great importance because this attribute is used for the Moodle authentication of Shibboleth users.
     587
     588Username: eppn
     589
     590Moodle WAYF service: No
     591
     592Shibboleth Service Provider logout handler URL: /Shibboleth.sso/Logout
     593
     594Data mapping (First name): givenName
     595
     596Data mapping (Surname): surname
     597
     598Data mapping (Email address): mail
     599
     600Update local (Email address): On Creation
     601
     602Lock value (Email address): Locked
     603
     604
     605Click Save.
    513606
    514607== Enabling Wordpress plugin ==
    … …  
    544637
    545638
    546 
    547639Click Save.
    548640
    549641
    550 == Enabling Moodle Plugin ==
    551 
    552 As Moodle admin, go to the '''Site administration''' >>> '''Plugins''' >>> '''Authentication''' and click on the '''Shibboleth''' enable '''eye'''. Next go to its settings.
    553 
    554 
    555 Fill in the fields of the form.
    556 
    557 The fields 'Username', 'First name', 'Surname', etc. should contain the name of the environment variables of the Shibboleth attributes that you want to map onto the corresponding Moodle variable. Especially the 'Username' field is of great importance because this attribute is used for the Moodle authentication of Shibboleth users.
    558 
    559 Username: eppn
    560 
    561 Moodle WAYF service: No
    562 
    563 Shibboleth Service Provider logout handler URL: /Shibboleth.sso/Logout
    564 
    565 Data mapping (First name): givenName
    566 
    567 Data mapping (Surname): surname
    568 
    569 Data mapping (Email address): mail
    570 
    571 Update local (Email address): On Creation
    572 
    573 Lock value (Email address): Locked
    574 
    575 
    576 Click Save.
    577 
    578 
    579 Now using a private browser, try to log in to both systems using your IDP test user.
    580 
    581 
    582 17. Create the Apache2 configuration for Moodle:
    583 
    584 {{{
    585 nano /etc/apache2/sites-available/moodle.conf
    586 }}}
    587 
    588 {{{
    589 <Location /moodle>
    590         #ShibRequestSetting applicationId mdl
    591 </Location>
    592 
    593 <Directory /var/www/html/moodle/auth/shibboleth/index.php>
    594         AuthType shibboleth
    595         #ShibRequestSetting applicationId mdl
    596         ShibRequireSession On
    597         require valid-user
    598 </Directory>
    599 }}}
    600 
    601 18. Then enable the site and restart the apache and shibboleth daemon to make changes to effect.
    602 
    603 {{{
    604 a2ensite mooodle
    605 
    606 systemctl restart shibd
    607 
    608 systemctl restart apache2
    609 }}}
    610 
    611 Now you may browse to https://sp.YOUR-DOMAIN/moodle and select your IDP to log in.
     642Now you may browse to https://sp.YOUR-DOMAIN/ and select your preferred IDP to log in.