Report of success with SP and IdP test servers, apache 1.3, nginx and SSL off-loading

[Cantor, Scott]

On 4/23/12 12:06 AM, "Gernot Hassenpflug" <ha4h-grnt at asahi-net.or.jp>
wrote:
>
>Interesting. I may be misunderstanding here, but perhaps the problem I
>ran into is that some *-devel packages are created during the SRPM
>rebuild, while others are not but are still needed.

Sorry, I mis-spoke. The one you'd pull in to get most of the other bits is
libsaml-devel.

>Then I discovered I needed the following *-devel packages during the
>rebuilding and installing of the new RPMs:
>
>libxerces-c-devel
>libxml-security-c-devel
>libxmltooling-devel
>libxmltooling5
>unixODBC-devel

libsaml-devel pulls in all those except the last, which is optional.

>However, the problem is that some of the devel packages are built
>during the rebuild, and if one already has such a devel package
>installed, there is a clash. Here devel packages are created during
>the SRPM rebuilds, and must therefore not be installed separately:
>
>liblog4shib-devel
>libsaml-devel
>shibboleth-devel

I don't know which rebuild you mean, but the first two are the same as the
others are.

The last comes from rebuilding the final SRPM, which is of course the
goal, so obviously you can't start by installing it, my mistake.

>I did not realize that, so thanks, I searched the documentation and I see
>in
>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPNoSSL
>that this is a setting specific to IIS. I've removed the entire
>InProcess section from my configurations now.

I'm talking about the documentation on the ISAPI element, and the comments
in the example file.

>OK, I reread the RequestMapper documentation at
>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapper
>and while I was using it to map a request to a URL, apache would do
>the same for me, so yes, I understand I do not need this section
>(again, it seems it is important for IIS). I removed it from my
>configurations now.

It's required for IIS, there is no htaccess equivalent.

>I don't get this yet. I followed the instructions at
>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPGettingStarte
>d
>at the time, thought the logo and stylesheet were meant to be set that
>way, and changed the email address only. It seemed logical that the
>shibboleth logo should appear if there is a misconfiguration, and that
>shibboleth is generating the appropriate error page for me.

I quote from that page:
"Customize the various HTML error templates and error properties specified
in the <Errors> element. Obviously the software will still run if you skip
this, but
frankly if you don't do it up front there's a decent chance you won't do
it later, and that looks bad for you and the software project as a whole.
At least provide a suitable email address in the supportContact property."

>while obviously
>important, hard to do if one is still tring to come to grips with
>getting a working shibboleth SP and IdP.

Yes, but that doesn't mean you stop once you have a working SP and IdP.
Most people do, so as a result, I tend to say that if you don't change
them early, they won't get changed at all. I can't make people do it, but
I can make the documentation say

>Comparing the examples, I'm not sure if you are recommending that
>Errors section be rewritten with a redirectErrors element to specify a
>completely new page, or if you are recommending that the logo be
>customized but that shibboleth should generate the appropriate page?

Most of the time, errors should be rare enough that redirects aren't an
absolute requirement, unless you're imposing special requirements like
isPassive or ForceAuthn or other advanced features. So in practice, I
focus on the latter and simply making sure that if the user sees an error,
it clearly expresses the system that's reporting the error.

-- Scott