Changes between Version 3 and Version 4 of idpiam2018


Ignore:
Timestamp:
Sep 3, 2018, 7:59:38 AM (6 years ago)
Author:
admin
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • idpiam2018

    v3 v4  
    2424
    25253. Define the costants `JAVA_HOME` and `IDP_SRC` inside `/etc/environment`:
    26  *
     26*
    2727{{{
    2828update-alternatives --config java
    2929}}}
    3030 (copy the path without /bin/java)
    31  *
     31*
    3232{{{
    3333vim /etc/environment```
    … …  
    3737     IDP_SRC=/usr/local/src/shibboleth-identity-provider-3.3.2
    3838}}}
    39  *
     39*
    4040{{{
    4141source /etc/environment
    4242}}}
    43  *
     43*
    4444{{{
    4545export JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64
    4646}}}
    47  *
     47*
    4848{{{
    4949export IDP_SRC=/usr/local/src/shibboleth-identity-provider-3.3.2
    … …  
    5151
    52524. Configure '''/etc/default/tomcat8''':
    53  *
     53*
    5454{{{
    5555update-alternatives --config java
    5656}}}
    5757 (copy the path without /bin/java)
    58  *
     58*
    5959{{{
    6060update-alternatives --config javac
    6161}}}
    62  *
     62*
    6363{{{
    6464vim /etc/default/tomcat8
    … …  
    7676
    77775. Download the Shibboleth Identity Provider v3.3.2:
    78  *
     78*
    7979{{{
    8080cd /usr/local/src
    8181}}}
    82  *
     82*
    8383{{{
    8484wget http://shibboleth.net/downloads/identity-provider/3.3.2/shibboleth-identity-provider-3.3.2.tar.gz
    8585}}}
    86  *
     86*
    8787{{{
    8888tar -xzvf shibboleth-identity-provider-3.3.2.tar.gz
    8989}}}
    90  *
     90*
    9191{{{
    9292cd shibboleth-identity-provider-3.3.2
    … …  
    9595
    96966. Generate Passwords for later use in the installation
    97  *
     97*
    9898{{{
    9999   tr -c -d '0123456789abcdefghijklmnopqrstuvwxyz' </dev/urandom | dd bs=32 count=1 2>/dev/null;echo
    … …  
    103103   
    1041047. Run the installer `install.sh` to install Shibboleth Identity Provider v3.3.2:
    105  *
     105*
    106106{{{
    107107   ./bin/install.sh
    … …  
    125125
    1261268. Import the JST libraries to visualize the IdP `status` page:
    127  *
     127*
    128128{{{
    129129   cd /opt/shibboleth-idp/edit-webapp/WEB-INF/lib
    130130}}}
    131  *
     131*
    132132{{{
    133133   wget https://build.shibboleth.net/nexus/service/local/repositories/thirdparty/content/javax/servlet/jstl/1.2/jstl-1.2.jar
    134134 }}}
    135  *
     135*
    136136{{{
    137137   cd /opt/shibboleth-idp/bin ; ./build.sh -Didp.target.dir=/opt/shibboleth-idp
    … …  
    139139
    1401409. Change the owner to enable '''tomcat8''' user to access on the following directories:
    141  *
     141*
    142142{{{
    143143   chown -R tomcat8 /opt/shibboleth-idp/logs/
    144144}}}
    145  *
     145*
    146146{{{
    147147   chown -R tomcat8 /opt/shibboleth-idp/metadata/
    148148}}}
    149  *
     149*
    150150{{{
    151151   chown -R tomcat8 /opt/shibboleth-idp/credentials/
    152152}}}
    153  *
     153*
    154154{{{
    155155   chown -R tomcat8 /opt/shibboleth-idp/conf/
    … …  
    160160
    16116110. Disable default apache configuration:
    162  *
     162*
    163163{{{
    164164   a2dissite 000-default
    … …  
    166166   
    16716711. Create a new configuration file as `idp.conf` with the following:
    168  *
     168*
    169169{{{
    170170   vim /etc/apache2/site-available/idp.conf
    171171}}}
    172  
    173172{{{
    174173   <VirtualHost *:80>
    … …  
    178177   </VirtualHost>
    179178}}}
    180    
    181    Enable Apache2 modules:
    182  *
     179Enable Apache2 modules:
     180*
    183181{{{
    184182   a2enmod proxy_http ssl headers alias include negotiation
    185183}}}
    186    Restart the Apache service:
     184Restart the Apache service:
     185*
    187186{{{
    188187   service apache2 restart
    189188}}}
    190189
     190
    19119112. Install Letsencrypt and enable HTTPS:
    192 
    193  *
     192*
    194193{{{
    195194   add-apt-repository ppa:certbot/certbot
    196195}}}
    197  *
     196*
    198197{{{
    199198   apt install python-certbot-apache
    200199}}}
    201  *
     200*
    202201{{{
    203202   certbot --apache -d idp.YOUR-DOMAIN
    … …  
    254253
    25525413. (OPTIONAL) If you haven't follow the letsencrypt method Create a Certificate and a Key self-signed for HTTPS
    256  *
     255*
    257256{{{
    258257   mkdir /root/certificates
    259258}}}
    260  *
     259*
    261260{{{
    262261   openssl req -x509 -newkey rsa:4096 -keyout /root/certificates/idp-key-server.key -out /root/certificates/idp-cert-server.crt -nodes -days 1095
    … …  
    264263   If you purchased SSL certificates from a Public CA, move the Certificate and the Key file for HTTPS server to `/root/certificates`:
    265264   
    266  *
     265*
    267266{{{
    268267   mv /location-to-crts/idp-cert-server.crt /root/certificates
    269268}}}
    270  *
     269*
    271270{{{
    272271   mv /location-to-crts/idp-key-server.key /root/certificates
    273272}}}
    274  *
     273*
    275274{{{
    276275   mv /location-to-crts/PublicCA.crt /root/certificates
    … …  
    279278   Then,
    280279   
    281  *
     280*
    282281{{{
    283282   chmod 400 /root/certificates/idp-key-server.key
    284283}}}
    285  *
     284*
    286285{{{
    287286   chmod 644 /root/certificates/idp-cert-server.crt
    288287}}}
    289  *
     288*
    290289{{{
    291290   chmod 644 /root/certificates/PublicCA.crt
    … …  
    329328}}}
    330329   Enable '''proxy_http''', '''SSL''' and '''headers''' Apache2 modules:
    331  *
     330*
    332331{{{
    333332   a2enmod proxy_http ssl headers alias include negotiation
    334333}}}
    335  *
     334*
    336335{{{
    337336   a2ensite idp-ssl.conf
    338337}}}
    339  *
     338*
    340339{{{
    341340   service apache2 restart
    … …  
    343342
    344343   Configure Apache2 to redirect all on HTTPS:
    345  *
     344*
    346345{{{
    347346   vim /etc/apache2/sites-enabled/000-default.conf
    … …  
    359358
    36035914. Modify `server.xml`:
    361  *
     360*
    362361{{{
    363362   vim /etc/tomcat8/server.xml