Changes between Version 18 and Version 19 of idpiam2018


Ignore:
Timestamp:
Sep 12, 2018, 10:51:16 AM (6 years ago)
Author:
admin
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • idpiam2018

    v18 v19  
    33Installation assumes you have already installed Ubuntu Server 18.04 with default configuration and has a public IP connectivity with DNS setup
    44
    5 Lets Assume your server hostname as '''idp.YOUR-DOMAIN'''
     5Lets Assume your server hostname as '''idp.instXY.ac.lk'''
    66
    77All commands are to be run as root and you may use `sudo su` to become root
    … …  
    1818}}} 
    1919    {{{
    20      127.0.0.1 idp.YOUR-DOMAIN idp
     20     127.0.0.1 idp.instXY.ac.lk idp
    2121    }}}
    2222
    23    (Replace `idp.YOUR-DOMAIN` with your IdP FQDN)
     23   (Replace `idp.instXY.ac.lk` with your IdP FQDN)
    2424
    25253. Define the costants `JAVA_HOME` and `IDP_SRC` inside `/etc/environment`:
    … …  
    112112   Installation Directory: [/opt/shibboleth-idp]
    113113   Hostname: [localhost.localdomain]
    114    idp.YOUR-DOMAIN
    115    SAML EntityID: [https://idp.YOUR-DOMAIN/idp/shibboleth]
     114   idp.instXY.ac.lk
     115   SAML EntityID: [https://idp.instXY.ac.lk/idp/shibboleth]
    116116   Attribute Scope: [localdomain]
    117    YOUR-DOMAIN
     117   instXY.ac.lk
    118118   Backchannel PKCS12 Password: ###PASSWORD-FOR-BACKCHANNEL###
    119119   Re-enter password:           ###PASSWORD-FOR-BACKCHANNEL###
    … …  
    172172{{{
    173173   <VirtualHost *:80>
    174      ServerName idp.YOUR-DOMAIN
    175      ServerAdmin admin@YOUR-DOMAIN
     174     ServerName idp.instXY.ac.lk
     175     ServerAdmin admin@instXY.ac.lk
    176176     DocumentRoot /var/www/html
    177177   </VirtualHost>
    … …  
    218218      SSLStaplingCache        shmcb:/var/run/ocsp(128000)
    219219      <VirtualHost _default_:443>
    220         ServerName idp.YOUR-DOMAIN:443
     220        ServerName idp.instXY.ac.lk:443
    221221        ServerAdmin admin@example.org
    222222        DocumentRoot /var/www/html
    … …  
    270270{{{
    271271   <VirtualHost *:80>
    272         ServerName "idp.YOUR-DOMAIN"
    273         Redirect "/" "https://idp.YOUR-DOMAIN/"
     272        ServerName "idp.instXY.ac.lk"
     273        Redirect "/" "https://idp.instXY.ac.lk/"
    274274   </VirtualHost>
    275275}}}
    … …  
    286286*
    287287{{{
    288    certbot --apache -d idp.YOUR-DOMAIN
     288   certbot --apache -d idp.instXY.ac.lk
    289289}}}
    290290   
    … …  
    292292   Plugins selected: Authenticator apache, Installer apache
    293293   Enter email address (used for urgent renewal and security notices) (Enter 'c' to
    294    cancel): YOU@YOUR-DOMAIN
     294   cancel): YOU@instXY.ac.lk
    295295
    296296   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    … …  
    312312   Obtaining a new certificate
    313313   Performing the following challenges:
    314    http-01 challenge for idp.YOUR-DOMAIN
     314   http-01 challenge for idp.instXY.ac.lk
    315315   Waiting for verification...
    316316   Cleaning up challenges
    … …  
    333333   
    334334   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    335    Congratulations! You have successfully enabled https://idp.YOUR-DOMAIN
     335   Congratulations! You have successfully enabled https://idp.instXY.ac.lk
    336336}}}
    337337 
    … …  
    431431*
    432432{{{
    433    https://idp.YOUR-DOMAIN/idp/shibboleth
     433   https://idp.instXY.ac.lk/idp/shibboleth
    434434}}}
    435435(you should see the IdP metadata)
    … …  
    714714{{{
    715715       idp.authn.LDAP.authenticator = bindSearchAuthenticator
    716        idp.authn.LDAP.ldapURL = ldap://ldap.example.org:389
     716       idp.authn.LDAP.ldapURL = ldap://idp.instXY.ac.lk:389
    717717       idp.authn.LDAP.useStartTLS = true
    718718       idp.authn.LDAP.useSSL = false
    … …  
    731731{{{
    732732       idp.authn.LDAP.authenticator = bindSearchAuthenticator
    733        idp.authn.LDAP.ldapURL = ldap://ldap.example.org:389
     733       idp.authn.LDAP.ldapURL = ldap://idp.instXY.ac.lk:389
    734734       idp.authn.LDAP.useStartTLS = false
    735735       idp.authn.LDAP.useSSL = false
    … …  
    797797
    798798        – Remove the endpoint:
    799           <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://idp.YOUR-DOMAIN:8443/idp/profile/SAML1/SOAP/ArtifactResolution" index="1"/>
     799          <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://idp.instXY.ac.lk:8443/idp/profile/SAML1/SOAP/ArtifactResolution" index="1"/>
    800800          (and modify the index value of the next one to “1”)
    801801
    … …  
    810810
    811811        - Remove the endpoint:
    812           <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://idp.YOUR-DOMAIN/idp/profile/Shibboleth/SSO"/>       
     812          <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://idp.instXY.ac.lk/idp/profile/Shibboleth/SSO"/>       
    813813        - Remove all ":8443" from the existing URL (such port is not used anymore)
    814814       
    815815        - Uncomment SingleLogoutService:
    816816       
    817           <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.YOUR-DOMAIN/idp/profile/SAML2/Redirect/SLO"/>
    818           <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp.YOUR-DOMAIN/idp/profile/SAML2/POST/SLO"/>
    819           <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://idp.YOUR-DOMAIN/idp/profile/SAML2/POST-SimpleSign/SLO"/>
    820           <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idp.YOUR-DOMAIN/idp/profile/SAML2/SOAP/SLO"/>
     817          <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.instXY.ac.lk/idp/profile/SAML2/Redirect/SLO"/>
     818          <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp.instXY.ac.lk/idp/profile/SAML2/POST/SLO"/>
     819          <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://idp.instXY.ac.lk/idp/profile/SAML2/POST-SimpleSign/SLO"/>
     820          <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idp.instXY.ac.lk/idp/profile/SAML2/SOAP/SLO"/>
    821821
    822822
    … …  
    828828
    829829        - Remove the comment from:
    830           <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idp.YOUR-DOMAIN/idp/profile/SAML2/SOAP/AttributeQuery"/>
     830          <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idp.instXY.ac.lk/idp/profile/SAML2/SOAP/AttributeQuery"/>
    831831        - Remove the endpoint:
    832           <AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://idp.YOUR-DOMAIN:8443/idp/profile/SAML1/SOAP/AttributeQuery"/>
     832          <AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://idp.instXY.ac.lk:8443/idp/profile/SAML1/SOAP/AttributeQuery"/>
    833833
    834834        - Remove all ":8443" from the existing URL (such port is not used anymore)
    … …  
    838838*
    839839{{{
    840 https://idp.YOUR-DOMAIN/idp/shibboleth
     840https://idp.instXY.ac.lk/idp/shibboleth
    841841}}}
    84284233. Register you IdP on the test Federation:
    … …  
    881881}}}
    882882* Retrive the Federation Certificate used to verify its signed metadata:
    883 *  `wget https://fr-training.ac.lk/metadata-signer -O /opt/shibboleth-idp/metadata/federation-cert.pem'
     883*  `wget https://fr-training.ac.lk/metadata-signer -O /opt/shibboleth-idp/metadata/federation-cert.pem`
    884884   
    885885 
    … …  
    979979Besides the logo, the login page (and several other pages) display a toolbox on the right with placeholders for links to password-reset and help-desk pages, these can be customized by adding following to the `/opt/shibboleth-idp/messages/messages.properties`
    980980{{{
    981 idp.url.password.reset = http://helpdesk.YOUR-DOMAIN/ChangePassword/
    982 idp.url.helpdesk = http://help.YOUR-DOMAIN/
     981idp.url.password.reset = http://helpdesk.instXY.ac.lk/ChangePassword/
     982idp.url.helpdesk = http://help.instXY.ac.lk/
    983983}}}
    984984Alternatively, it is also possible to hide the whole toolbox (the whole element) from all of the relevant pages (essentially, login.vm and all (three) logout pages: logout.vm, logout-complete.vm and logout.propagate). This can be easily done by adding the following CSS snippet into /opt/shibboleth-idp/edit-webapp/css/main.css: