Changes between Version 21 and Version 22 of spiam2018

Timestamp:

Sep 18, 2018, 10:23:10 AM (6 years ago)

Author:

admin

Comment:

--

spiam2018

@@ -407 +407 @@
 }}}
 === Enable Attribute Support on Shibboleth SP ===
-20. Enable attribute by remove comment from the related content into "`/etc/shibboleth/attribute-map.xml`" Disable First deprecated/incorrect version of `persistent-id` from `attribute-map.xml`
-    
+20. Enable attributes by remove comment from the related content into `/etc/shibboleth/attribute-map.xml`
+
+      Also you have to Disable `First deprecated/incorrect version` from `attribute-map.xml`
+{{{
+<!-- <Attribute name="urn:mace:dir:attribute-def:eduPersonTargetedID" id="targeted-id">
+        <AttributeDecoder xsi:type="ScopedAttributeDecoder"/>
+         <AttributeDecoder xsi:type="NameIDFromScopedAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
+</Attribute> -->
+}}}
 === Enable Single Logout ===
 21. Change <Logout> element in /etc/shibboleth/shibboleth2.xml. They get passed as attributes to the SAML2 logoutInitiator that gets created by the Logout element.  The fully unfolded configuration with settings identical to default is:
@@ -449 +456 @@
 
 
-* To release specific attributes for a SP you can add it to `/opt/shibboleth-idp/conf/attribute-filter.xml`
+23. Now you may visit https://sp.instXY.ac.lk/secure and try login using your IDP's credentials, check out the consent page at the first login.
+
+      You will only see the `Scoped Affiliation` attribute of the user as by default other attributes are not included in your attribute filter file.
+
+* To release specific attributes for a SP you can add it to `/opt/shibboleth-idp/conf/attribute-filter.xml` of your '''IDP'''
 
    Consult Service Provider guidelines and https://fr-training.ac.lk/attribute-filter-LEARN-Production.xml on deciding what attributes you should release.
 
+   As an example lets allow EPPN, CN, mail and mobile  for your sp. 
+
+   On your IDP,
+
+{{{
+vim /opt/shibboleth-idp/conf/attribute-filter.xml
+}}}
+
+   Add the following to the tail before the closing `</AttributeFilterPolicyGroup>` tag.
+{{{
+   <!-- Release some attributes to SP. -->
+    <AttributeFilterPolicy id="sp.instXY">
+            <PolicyRequirementRule xsi:type="Requester" value="https://sp.instXY.ac.lk/shibboleth" />
+
+        <AttributeRule attributeID="eduPersonPrincipalName">
+            <PermitValueRule xsi:type="ANY" />
+        </AttributeRule>
+
+        <AttributeRule attributeID="commonName">
+            <PermitValueRule xsi:type="ANY" />
+        </AttributeRule>
+
+        <AttributeRule attributeID="mobile">
+            <PermitValueRule xsi:type="ANY" />
+        </AttributeRule>
+
+        <AttributeRule attributeID="mail">
+            <PermitValueRule xsi:type="ANY" />
+        </AttributeRule>
+    </AttributeFilterPolicy>
+
+}}}
+
    Reload shibboleth.!AttributeFilterService to apply the new SP
 
-23. Now you may visit https://sp.instXY.ac.lk/secure and try login using your IDP's credentials, check out the consent page at the first login.
+{{{
+/opt/shibboleth-idp/bin/reload-service.sh -id shibboleth.AttributeFilterService
+}}}
+
+
+   Re-visit `https://sp.instXY.ac.lk/secure` ,  at the login consent page you can check the attributes that are released by the filter created above.
+
+   Once you accept the consent you can see the attributes that were used by your SP. If you can't see attributes like `mobile` in your page, you need to allow them on your attribute-map of the SP.
+
+   To do that edit `/etc/shibboleth/attribute-map.xml` on your '''SP'''
+
+{{{
+vim /etc/shibboleth/attribute-map.xml
+}}}
+
+   Uncomment '''Examples of LDAP-based attributes''' section at the end and before the closing `</Attributes>` line,  include,
+
+{{{
+<Attribute name="urn:oid:0.9.2342.19200300.100.1.41" id="mobile"/>
+<Attribute name="urn:mace:dir:attribute-def:mobile" id="mobile"/>
+}}}
+   
+  And restart shibd and apache2 services.