Changes between Version 4 and Version 5 of spiam2018

Timestamp:

Sep 12, 2018, 11:15:52 AM (6 years ago)

Author:

admin

Comment:

--

spiam2018

@@ -3 +3 @@
 Installation assumes you have already installed Ubuntu Server 18.04 with default configuration and has a public IP connectivity with DNS setup
 
-Lets Assume your server hostname as '''sp.YOUR-DOMAIN'''
+Lets Assume your server hostname as '''sp.instXY.ac.lk'''
 
 All commands are to be run as root and you may use `sudo su` to become root
@@ -19 +19 @@
 }}}
 {{{
-     127.0.0.1 sp.YOUR-DOMAIN sp
-}}}
-(Replace `sp.YOUR-DOMAIN` with your sp FQDN)
+     127.0.0.1 sp.instXY.ac.lk sp
+}}}
+(Replace `sp.instXY.ac.lk` with your sp FQDN)
 
 == Install Shibboleth Service Provider ==
@@ -45 +45 @@
 * 
 {{{
-vim /etc/systemd/system/shibd.service.d/override.conf`
+vim /etc/systemd/system/shibd.service.d/override.conf
 }}}
 {{{
@@ -64 +64 @@
 
 5. These configurations are based for test purposes with self generated ssl certificates. 
-   If you have purchased ssl certificate from a commercial CA substitute those with the self signed files. If you wish to get '''letsencrypt''' certificates //Skip //to '''Step 10'''.
+   If you have purchased ssl certificate from a commercial CA substitute self signed files with those. If you wish to get '''letsencrypt''' certificates on your production, //Skip //to '''Step 10'''.
 
 Create a Certificate and a Key self-signed for HTTPS:
@@ -78 +78 @@
       SSLStaplingCache        shmcb:/var/run/ocsp(128000)
       <VirtualHost _default_:443>
-        ServerName sp.YOUR-DOMAIN:443
-        ServerAdmin admin@YOUR-DOMAIN
+        ServerName sp.instXY.ac.lk:443
+        ServerAdmin admin@instXY.ac.lk
         DocumentRoot /var/www/html
         ...
@@ -102 +102 @@
         SSLCertificateFile /etc/ssl/certs/ssl-sp.crt
         SSLCertificateKeyFile /etc/ssl/private/ssl-sp.key
-        SSLCertificateChainFile /root/certificates/ssl-ca.pem
+        #SSLCertificateChainFile /root/certificates/ssl-ca.pem
         ...
       </VirtualHost>
@@ -149 +149 @@
 {{{
      <VirtualHost *:80>
-        ServerName "sp.YOUR-DOMAIN"
-        Redirect permanent "/" "https://sp.YOUR-DOMAIN/"
-        RedirectMatch permanent ^/(.*)$ https://sp.YOUR-DOMAIN/$1
+        ServerName "sp.instXY.ac.lk"
+        Redirect permanent "/" "https://sp.instXY.ac.lk/"
+        RedirectMatch permanent ^/(.*)$ https://sp.instXY.ac.lk/$1
      </VirtualHost>
 }}}
-10. '''Let'sencrypt''' setup (//Skip this step if you already configured SSL with self signed or CA provided certificates//)
+10. '''Let'sencrypt''' setup (//Skip this step if you already configured SSL with self signed or CA provided certificates//) (Optional)
 
 Disable the default configuration
@@ -182 +182 @@
 <VirtualHost *:80>
  
-        ServerName sp.YOUR-DOMAIN
+        ServerName sp.instXY.ac.lk
         ServerAdmin YOUR-Email
         DocumentRoot /var/www/html
@@ -199 +199 @@
 * 
 {{{
-systemctl reload apache2`
+systemctl reload apache2
 }}}   
 Install Letsencypt and enable https
@@ -205 +205 @@
 add-apt-repository ppa:certbot/certbot
 apt install python-certbot-apache
-certbot --apache -d sp.YOUR-DOMAIN
+certbot --apache -d sp.instXY.ac.lk
 }}}
 {{{
 Plugins selected: Authenticator apache, Installer apache
 Enter email address (used for urgent renewal and security notices) (Enter 'c' to
-cancel): YOU@YOUR-DOMAIN
+cancel): YOU@instXY.ac.lk
 
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
@@ -230 +230 @@
 Obtaining a new certificate
 Performing the following challenges:
-http-01 challenge for sp.YOUR_DOMAIN
+http-01 challenge for sp.instXY.ac.lk
 Waiting for verification...
 Cleaning up challenges
@@ -251 +251 @@
 
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Congratulations! You have successfully enabled https://sp.YOUR-DOMAIN
+Congratulations! You have successfully enabled https://sp.instXY.ac.lk
 
 }}}
@@ -271 +271 @@
 {{{
      ...
-     <ApplicationDefaults entityID="https://sp.YOUR-DOMAIN/shibboleth"
+     <ApplicationDefaults entityID="https://sp.instXY.ac.lk/shibboleth"
           REMOTE_USER="eppn persistent-id targeted-id">
      ...
@@ -309 +309 @@
 * 
 {{{
-https://sp.YOUR-DOMAIN/Shibboleth.sso/Metadata
-}}}
-(change `sp.YOUR-DOMAIN` to you SP full qualified domain name)
+https://sp.instXY.ac.lk/Shibboleth.sso/Metadata
+}}}
+(change `sp.instXY.ac.lk` to you SP full qualified domain name)
 16. Register you SP on LEARN test federation:
 * Go to `https://fr-training.ac.lk/rr3/providers/sp_registration` and continue registration with pasting the content of your metadata file 
@@ -352 +352 @@
        <body>
          <p>
-          <a href="https://YOUR-DOMAIN/privacy.html">Privacy Policy</a>
+          <a href="https://www.instXY.ac.lk/privacy.html">Privacy Policy</a>
          </p>
          <?php
@@ -391 +391 @@
 
 
-To initiate, create a button or link to go to a URL on the SP of the form: https://sp.example.org/Shibboleth.sso/Logout
-
-The SLO would use an asynchronous message to the IdP and the flow would end at the IdP Logout page.  The user would be returned to the return URL only if the SLO is done in synchronous mode and the flow returns back to the SP.  To set the return URL, pass it in the return parameter as a query string to the Logout initiator - e.g.: https://sp.example.org/Shibboleth.sso/Logout?return=https://sp.example.org/logout-completed.html
+To initiate, create a button or link to go to a URL on the SP of the form: https://sp.instXY.ac.lk/Shibboleth.sso/Logout
+
+The SLO would use an asynchronous message to the IdP and the flow would end at the IdP Logout page.  The user would be returned to the return URL only if the SLO is done in synchronous mode and the flow returns back to the SP.  To set the return URL, pass it in the return parameter as a query string to the Logout initiator - e.g.: https://sp.instXY.ac.lk/Shibboleth.sso/Logout?return=https://sp.instXY.ac.lk/logout-completed.html