Changes between Version 1 and Version 2 of SamlSP2021/Agenda/WebappsSso

Timestamp:

Mar 29, 2021, 7:08:16 PM (4 years ago)

Author:

admin

Comment:

end of shib

SamlSP2021/Agenda/WebappsSso

@@ -10 +10 @@
 * SSL/ HTTPS Certificates issued ( May be using Letsencrypt or Otherwise)
 * Installed Wordpress and Moodle latest editions on above created virtual hosts.
+* sudo access to the server. All following commands have to be entered as the root user. Best way to do it is login as root by {{{ sudo su }}}
 
 == Apache Config recap ==
@@ -103 +104 @@
 </IfModule>
 }}}
+
+
+== Shibboleth SP Installation ==
+
+Install needed packages:
+
+{{{ apt install libapache2-mod-shib ntp --no-install-recommends }}}
+
+=== Shibboleth SP Configuration ===
+
+
+Both of these web apps will be connected to LIAF, therefore, download Federation Metadata Signing Certificate:
+
+{{{
+    cd /etc/shibboleth/
+    wget https://fr.ac.lk/signedmetadata/metadata-signer -O federation-cert.pem
+}}}
+
+Edit shibboleth2.xml opportunely: {{{ vim /etc/shibboleth/shibboleth2.xml }}}
+
+some code
+
+{{{
+#!xml
+. . .
+
+    <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
+    <ApplicationDefaults entityID="https://wp.Your-Domain/shibboleth"
+        REMOTE_USER="eppn subject-id pairwise-id persistent-id"
+        cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
+
+. . .
+
+        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
+                  checkAddress="false" handlerSSL="true" cookieProps="https">
+
+. . .
+
+            <SSO discoveryProtocol="SAMLDS" discoveryURL="https://fds.ac.lk">
+              SAML2
+            </SSO>
+
+. . .
+
+        <Errors supportContact="you@you-domain"
+             helpLocation="/about-this-service.html"
+             styleSheet="/shibboleth-sp/main.css"/>
+
+. . .
+
+        <MetadataProvider type="XML" url="https://fr.ac.lk/signedmetadata/metadata.xml" legacyOrgName="true" backingFilePath="test-metadata.xml" reloadInterval="600">
+
+                <MetadataFilter type="Signature" certificate="federation-cert.pem" verifyBackup="false"/>
+
+                <MetadataFilter type="RequireValidUntil" maxValidityInterval="864000" />
+        </MetadataProvider>
+
+. . .
+
+        <!-- Simple file-based resolvers for separate signing/encryption keys. -->
+        <CredentialResolver type="File" use="signing"
+            key="wp-signing-key.pem" certificate="wp-signing-cert.pem"/>
+        <CredentialResolver type="File" use="encryption"
+            key="wp-encrypt-key.pem" certificate="wp-encrypt-cert.pem"/>
+
+        <ApplicationOverride id="mdl" entityID="https://mdl.Your-Domain/shibboleth">
+                <CredentialResolver type="File" use="signing"
+                        key="mdl-signing-key.pem" certificate="mdl-signing-cert.pem"/>
+                <CredentialResolver type="File" use="encryption"
+                        key="mdl-encrypt-key.pem" certificate="mdl-encrypt-cert.pem"/>
+        </ApplicationOverride>
+    </ApplicationDefaults>
+
+    <!-- Policies that determine how to process and authenticate runtime messages. -->
+    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
+
+}}}
+
+Above snippet defines two service providers for shibboleth under two different entity id's. 
+
+Default application as {{{ entityID="https://wp.Your-Domain/shibboleth" }}} and the second as an override with id mdl {{{ <ApplicationOverride id="mdl" entityID="https://mdl.Your-Domain/shibboleth"> }}}
+
+Both entities will have common features like metadata providers, attribute maps. But they will have two different certificate sets.
+
+Now lets create those certificate pairs.
+
+* {{{ /usr/sbin/shib-keygen -n wp-signing -e https://wp.YOUR-DOMAIN/shibboleth }}}
+* {{{ /usr/sbin/shib-keygen -n wp-encrypt -e https://wp.YOUR-DOMAIN/shibboleth }}}
+* {{{ /usr/sbin/shib-keygen -n mdl-signing -e https://mdl.YOUR-DOMAIN/shibboleth }}}
+* {{{ /usr/sbin/shib-keygen -n mdl-encrypt -e https://mdl.YOUR-DOMAIN/shibboleth }}}
+
+Then check the shibboleth configuration for errors by, 
+
+{{{ shibd -t /etc/shibboleth/shibboleth2.xml }}}
+
+Next, enable apache shibboleth module and restart apache.
+
+{{{
+#!bash
+    a2enmod shib2
+    systemctl reload apache2.service
+}}}