Changes between Version 38 and Version 39 of idpiam2018

Timestamp:

Sep 13, 2018, 10:59:01 AM (6 years ago)

Author:

admin

Comment:

--

idpiam2018

@@ -722 +722 @@
 
 28. Connect the openLDAP to the IdP to allow the authentication of the users:
-* use `openssl x509 -outform der -in /etc/ssl/certs/ldap_server.pem -out /opt/shibboleth-idp/credentials/ldap_server.crt` to load the ldap certificate.
+* use `openssl x509 -outform der -in /etc/ssl/certs/ldap_server.pem -out /opt/shibboleth-idp/credentials/ldap-server.crt` to load the ldap certificate.
     
 If you host ldap in a seperate machine, copy the ldap_server.crt to  `/opt/shibboleth-idp/credentials`
@@ -738 +738 @@
        idp.authn.LDAP.sslConfig = certificateTrust
        idp.authn.LDAP.trustCertificates = %{idp.home}/credentials/ldap-server.crt
+       #idp.authn.LDAP.trustStore  = %{idp.home}/credentials/ldap-server.truststore
+       idp.authn.LDAP.returnAttributes   = *
        idp.authn.LDAP.baseDN = ou=people,dc=instXY,dc=ac,dc=lk
        idp.authn.LDAP.userFilter = (uid={user})
@@ -744 +746 @@
        idp.authn.LDAP.dnFormat = uid=%s,ou=people,dc=instXY,dc=ac,dc=lk
        idp.attribute.resolver.LDAP.trustCertificates   = %{idp.authn.LDAP.trustCertificates:undefined}
+       idp.attribute.resolver.LDAP.returnAttributes    = %{idp.authn.LDAP.returnAttributes}
 }}}
 
@@ -754 +757 @@
        idp.authn.LDAP.useStartTLS = false
        idp.authn.LDAP.useSSL = false
+       idp.authn.LDAP.returnAttributes   = *
        idp.authn.LDAP.baseDN = ou=people,dc=instXY,dc=ac,dc=lk
        idp.authn.LDAP.userFilter = (uid={user})
@@ -759 +763 @@
        idp.authn.LDAP.bindDNCredential = ###LDAP_ADMIN_PASSWORD###
        idp.authn.LDAP.dnFormat = uid=%s,ou=people,dc=instXY,dc=ac,dc=lk
+       idp.attribute.resolver.LDAP.returnAttributes    = %{idp.authn.LDAP.returnAttributes}
 }}}       
 (If you decide to use the Solution 2, you have to remove (or comment out) the following code from your Attribute Resolver file:
@@ -872 +877 @@
 > For production enviornments please use `https://fr.ac.lk`, Also make sure to remove `-training` from all urls.
 
+When Applying for the membership of the federation the form will ask lot of questions to identify your service. Therefore, answer all of them as per the following,
+
+On the IDP registration page start with pasting the whole xml metadata from `https://idp.instXY.ac.lk/idp/shibboleth`
+
+
+
+
 34. Configure the IdP to retrieve the Federation Metadata:
 *