Changes between Version 44 and Version 45 of idpiam2018


Ignore:
Timestamp:
Sep 14, 2018, 6:01:44 AM (6 years ago)
Author:
admin
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • idpiam2018

    v44 v45  
    517517}}}
    518518
     519This will add additional security to your database engine. For the tutorial purposes we will use '''Iam@2018''' as passwords. Remember the capital '''I'''.
    519520
    520521{{{
    … …  
    539540Please set the password for root here.
    540541
    541 New password:
    542 
    543 Re-enter new password:
     542New password:Iam@2018
     543
     544Re-enter new password:Iam@2018
    544545
    545546Estimated strength of the password: 50
    … …  
    583584All done!
    584585}}}
    585 * log in to your MySQL Server with `mysql -u root -p` and continue. Make sure to replace `##ROOT-DB-PASSWORD##`, `##USERNAME##`, `##PASSWORD##` with your own
     586* log in to your MySQL Server with `mysql -u root -p` and continue.For your production servers,  Make sure to replace passwords `Iam@2018`. When creating passwords you should consider your password policy selected above.
    586587{{{#!mysql
    587588    SET NAMES 'utf8';
    … …  
    591592    CREATE DATABASE IF NOT EXISTS shibboleth CHARACTER SET=utf8;
    592593
    593     GRANT ALL PRIVILEGES ON shibboleth.* TO root@localhost IDENTIFIED BY '##ROOT-DB-PASSWORD##';
    594     GRANT ALL PRIVILEGES ON shibboleth.* TO ##USERNAME##@localhost IDENTIFIED BY '##PASSWORD##';
     594    GRANT ALL PRIVILEGES ON shibboleth.* TO root@localhost IDENTIFIED BY 'Iam@2018';
     595    GRANT ALL PRIVILEGES ON shibboleth.* TO shibbo@localhost IDENTIFIED BY 'Iam@2018';
    595596
    596597    FLUSH PRIVILEGES;
    … …  
    62762826. Enable the generation of the `persistent-id` :
    628629
    629 * Copy the output of the following for the next step.
     630* First you need to generate a password salt. Keep a copy of the output of following as your '''idp.persistentId.salt'''
    630631{{{
    631632   openssl rand -base64 36
    632633}}}
    633634
    634 *
     635* Edit the following file and modify the lines containing below variables.
    635636{{{
    636637   vim /opt/shibboleth-idp/conf/saml-nameid.properties
    637638}}}   
    638    (the //sourceAttribute// MUST BE an attribute, or a list of comma-separated attributes, that uniquely identify the subject of the generated `persistent-id`. It MUST BE: '''Stable''', '''Permanent''' and '''Not-reassignable''')
     639   (the //sourceAttribute// used in the configuration MUST BE an ldap attribute, or a list of comma-separated attributes, that uniquely identify the subject of the generated `persistent-id`. It MUST BE: '''Stable''', '''Permanent''' and '''Not-reassignable''')
    639640
    640641{{{
    641642     idp.persistentId.sourceAttribute = uid
    642643     ...
    643      idp.persistentId.salt = ### result of 'openssl rand -base64 36'###
     644     idp.persistentId.salt = Replace_these_with_your_salt_generated_earlier
    644645     ...
    645646     idp.persistentId.generator = shibboleth.StoredPersistentIdGenerator
    … …  
    674675           p:driverClassName="com.mysql.jdbc.Driver"
    675676           p:url="jdbc:mysql://localhost:3306/shibboleth?autoReconnect=true"
    676            p:username="##USER_DB_NAME##"
    677            p:password="##PASSWORD##"
     677           p:username="shibbo"
     678           p:password="Iam@2018"
    678679           p:maxActive="10"
    679680           p:maxIdle="5"
    … …  
    701702     </bean>
    702703     }}}     
    703 (and modify the "'''USER_DB_NAME'''" and "'''PASSWORD'''" for your "'''shibboleth'''" DB)
     704   > You may need to change the  '''password''' for your "'''shibboleth'''" DB in production servers)
    704705
    705706* Modify the IdP configuration file:
    … …  
    729730   vim /opt/shibboleth-idp/conf/ldap.properties
    730731}}}
    731 * Solution 1: LDAP + STARTTLS:
     732* Solution 1: LDAP + STARTTLS: (We recommend continuing with this option)
    732733
    733734{{{
    … …  
    777778       </resolver:DataConnector>
    778779}}}
    779 '''UTILITY FOR OPENLDAP ADMINISTRATOR:'''
    780 `ldapsearch -H ldap:// -x -b "dc=instXY,dc=ac,dc=lk" -LLL dn`
     780* utility to ldap searching: `ldapsearch -H ldap:// -x -b "dc=instXY,dc=ac,dc=lk" -LLL dn`
    781781* the baseDN ==> `ou=people, dc=instXY,dc=ac,dc=lk` (branch containing the registered users)
    782782* the bindDN ==> `cn=admin,dc=instXY,dc=ac,dc=lk` (distinguished name for the user that can made queries on the LDAP)
    … …  
    808808      <value>%{idp.home}/conf/attribute-resolver-v1-LEARN.xml</value>
    809809}}}
    810 * Configure the LDAP Data Connector to be compliant to the values put on `ldap.properties`. (See above suggestions)
    811810
    812811* Restart Tomcat8: `service tomcat8 restart`
     812
    81381331. Enable the SAML2 support by changing the `idp-metadata.xml` and disabling the SAML v1.x deprecated support:
    814814*