Changes between Version 12 and Version 13 of idpiam2018


Ignore:
Timestamp:
Sep 3, 2018, 8:50:59 AM (6 years ago)
Author:
admin
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • idpiam2018

    v12 v13  
    781781       </resolver:DataConnector>
    782782}}}
    783 '''UTILITY FOR OPENLDAP ADMINISTRATOR:'''*ldapsearch -H ldap:// -x -b "dc=example,dc=it" -LLL dn`* the baseDN ==> `ou=people, dc=example,dc=org` (branch containing the registered users) * the bindDN ==> `cn=admin,dc=example,dc=org` (distinguished name for the user that can made queries on the LDAP)
     783'''UTILITY FOR OPENLDAP ADMINISTRATOR:''' *`ldapsearch -H ldap:// -x -b "dc=example,dc=it" -LLL dn`* the baseDN ==> `ou=people, dc=example,dc=org` (branch containing the registered users) * the bindDN ==> `cn=admin,dc=example,dc=org` (distinguished name for the user that can made queries on the LDAP)
    784784
    78578529. Enrich IDP logs with the authentication error occurred on LDAP:
    … …  
    79779730. Build the '''attribute-resolver.xml''' to define which attributes your IdP can manage. Here you can find the '''attribute-resolver-v1-LEARN.xml''' provided by LEARN:
    798798* Download the attribute resolver provided by LEARN:
    799       `wget https://fr-training.ac.lk/attribute-resolver-v1-LEARN.xml -O /opt/shibboleth-idp/conf/attribute-resolver-v1-LEARN.xml`
    800 * Modify `services.xml` file:
    801       `vim /opt/shibboleth-idp/conf/services.xml`
     799{{{
     800wget https://fr-training.ac.lk/attribute-resolver-v1-LEARN.xml -O /opt/shibboleth-idp/conf/attribute-resolver-v1-LEARN.xml
     801}}}
     802* Modify `services.xml` file: `vim /opt/shibboleth-idp/conf/services.xml`
    802803{{{
    803804      <value>%{idp.home}/conf/attribute-resolver.xml</value>
    … …  
    812813* Restart Tomcat8: `service tomcat8 restart`
    81381431. Enable the SAML2 support by changing the `idp-metadata.xml` and disabling the SAML v1.x deprecated support:
    814  *
    815 {{{
    816    vim /opt/shibboleth-idp/metadata/metadata.xml}}}{{{
     815*
     816{{{
     817   vim /opt/shibboleth-idp/metadata/metadata.xml
     818}}}
     819{{{
    817820      <IDPSSODescriptor> SECTION:
    818821        – From the list of "protocolSupportEnumeration" remove:
    … …  
    857860
    858861        - Remove all ":8443" from the existing URL (such port is not used anymore)
    859       }}}
     862
     863}}}
    86086432. Obtain your IdP metadata here:
    861     *  `https://idp.YOUR-DOMAIN/idp/shibboleth}}}
     865*
     866{{{
     867https://idp.YOUR-DOMAIN/idp/shibboleth
     868}}}
    86286933. Register you IdP on the test Federation:
    863  *
    864 {{{
    865    https://fr-training.ac.lk/}}}    > For production enviornments please use `https://fr.ac.lk`, Also make sure to remove `-training` from all urls.
     870*
     871{{{
     872   https://fr-training.ac.lk/
     873}}}   
     874> For production enviornments please use `https://fr.ac.lk`, Also make sure to remove `-training` from all urls.
    866875
    86787634. Configure the IdP to retrieve the Federation Metadata:
    868  *
    869 {{{
    870    cd /opt/shibboleth-idp/conf}}} *
    871 {{{
    872    vim metadata-providers.xml}}}
     877*
     878{{{
     879   cd /opt/shibboleth-idp/conf
     880}}}
     881*
     882{{{
     883   vim metadata-providers.xml
     884}}}
    873885{{{
    874886      <MetadataProvider
    … …  
    894906            </MetadataFilter>
    895907      </MetadataProvider>
    896       }}}
    897     * Retrive the Federation Certificate used to verify its signed metadata:
    898     *  `wget https://fr-training.ac.lk/metadata-signer -O /opt/shibboleth-idp/metadata/federation-cert.pem}}}
     908}}}
     909* Retrive the Federation Certificate used to verify its signed metadata:
     910*  `wget https://fr-training.ac.lk/metadata-signer -O /opt/shibboleth-idp/metadata/federation-cert.pem'
    899911   
    900912 
    90191335. Reload service with id `shibboleth.MetadataResolverService` to retrieve the Federation Metadata:
    902     *  `cd /opt/shibboleth-idp/bin}}}    *  `./reload-service.sh -id shibboleth.MetadataResolverService}}}
     914*
     915{{{
     916cd /opt/shibboleth-idp/bin
     917}}}
     918*
     919{{{
     920./reload-service.sh -id shibboleth.MetadataResolverService
     921}}}
    903922
    904923
    90592436. The day after the Federation Operators approval you, check if you can login with your IdP on the following services:
    906     * https://sp-training.ac.lk/secure   (Service Provider provided for testing the LEARN Training Federation)
    907     * https://sp-test.learn.ac.lk/secure (Service Provider provided for testing the LEARN Production Federation)
    908 
    909 
    910 ### Configure Attribute Filters to release the mandatory attributes to the default IDEM Resources:
     925* https://sp-training.ac.lk/secure   (Service Provider provided for testing the LEARN Training Federation)
     926* https://sp-test.learn.ac.lk/secure (Service Provider provided for testing the LEARN Production Federation)
     927
     928
     929== Configure Attribute Filters to release the mandatory attributes to the default IDEM Resources: ==
    911930
    91293137. Make sure that you have the "`tmp/httpClientCache`" used by "`shibboleth.FileCachingHttpClient`":
    913  *
    914 {{{
    915    mkdir -p /opt/shibboleth-idp/tmp/httpClientCache ; chown tomcat8 /opt/shibboleth-idp/tmp/httpClientCache}}}
     932*
     933{{{
     934   mkdir -p /opt/shibboleth-idp/tmp/httpClientCache ; chown tomcat8 /opt/shibboleth-idp/tmp/httpClientCache
     935}}}
    91693638. Modify your `services.xml`:
    917  *
    918 {{{
    919    vim /opt/shibboleth-idp/conf/services.xml}}}
     937*
     938{{{
     939   vim /opt/shibboleth-idp/conf/services.xml
     940}}}
    920941{{{
    921942      <bean id="Default-Filter" class="net.shibboleth.ext.spring.resource.FileBackedHTTPResource"
    … …  
    934955         <ref bean="Production-Filter"/>
    935956       </util:list>
    936       }}}
     957}}}
    93795839. Reload service with id `shibboleth.AttributeFilterService` to refresh the Attribute Filter followed by the IdP:
    938     *  `cd /opt/shibboleth-idp/bin}}}    *  `./reload-service.sh -id shibboleth.AttributeFilterService}}}
     959*
     960{{{
     961cd /opt/shibboleth-idp/bin
     962}}}
     963*
     964{{{
     965./reload-service.sh -id shibboleth.AttributeFilterService
     966}}}
    939967
    940968
    … …  
    942970
    9439711. Tomcat 8 Logs:
    944 *
     972* 
    945973{{{
    946974   cd /var/log/tomcat8
    947975}}}
    948 *
     976* 
    949977{{{
    950978   vim catalina.out}}}
    9519792. Shibboleth IdP Logs:
    952 *
    953 {{{
    954    cd /opt/shibboleth-idp/logs}}}   * '''Audit Log:''' `vim idp-audit.log}}}   * '''Consent Log:''' `vim idp-consent-audit.log}}}   * '''Warn Log:''' `vim idp-warn.log}}}   * '''Process Log:''' `vim idp-process.log}}}
     980*
     981{{{
     982   cd /opt/shibboleth-idp/logs
     983}}}
     984* '''Audit Log:''' `vim idp-audit.log'   
     985* '''Consent Log:''' `vim idp-consent-audit.log`   
     986* '''Warn Log:''' `vim idp-warn.log`
     987* '''Process Log:''' `vim idp-process.log`