Report of success with SP and IdP test servers, apache 1.3, nginx and SSL off-loading

Tue Apr 24 08:50:37 BST 2012

"Cantor, Scott" <cantor.2 at osu.edu> writes:

> On 4/23/12 12:06 AM, "Gernot Hassenpflug" <ha4h-grnt at asahi-net.or.jp>
> wrote:
> >
> >Interesting. I may be misunderstanding here, but perhaps the problem I
> >ran into is that some *-devel packages are created during the SRPM
> >rebuild, while others are not but are still needed.

Hi Scott,

> Sorry, I mis-spoke. The one you'd pull in to get most of the other bits is
> libsaml-devel.

I don't think this works, since libsaml-devel wants to pull in
libsaml7 which I had to remove initially anyway. I started out with
the shibboleth repo packages installed and had to remove everything in
order to either rebuild and/or install the rebuilt RPMs of the 2.4.3
SP and associated programs. Besides, as I note below, libsaml-devel
actually gets built during the SRPM rebuild.

I'm confused, but the process I documented did work (left in as
reference below).

> >Then I discovered I needed the following *-devel packages during the
> >rebuilding and installing of the new RPMs:
> >
> >libxerces-c-devel
> >libxml-security-c-devel
> >libxmltooling-devel
> >libxmltooling5
> >unixODBC-devel
> 
> libsaml-devel pulls in all those except the last, which is optional.
> 
> >However, the problem is that some of the devel packages are built
> >during the rebuild, and if one already has such a devel package
> >installed, there is a clash. Here devel packages are created during
> >the SRPM rebuilds, and must therefore not be installed separately:
> >
> >liblog4shib-devel
> >libsaml-devel
> >shibboleth-devel
> 
> I don't know which rebuild you mean, but the first two are the same as the
> others are.

Rebuild of the SP 2.4.3 code and dependencies:

  488673 Feb  1  2011 log4shib-1.0.4-2.2.el4.src.rpm
  873802 Jul 25 23:16 opensaml-2.4.3-3.2.el4.src.rpm
  862690 Jul 26 10:12 shibboleth-2.4.3-2.2.el4.src.rpm
   20211 May  8  2011 shibboleth-embedded-ds-1.0.1-2.1.el4.src.rpm
 5021184 Feb  1  2011 xerces-c-3.1.1-2.2.el4.src.rpm
  867027 Jul  7 09:20 xml-security-c-1.6.1-3.1.el4.src.rpm
  642118 Jul  7 10:13 xmltooling-1.4.2-2.1.el4.src.rpm

> The last comes from rebuilding the final SRPM, which is of course the
> goal, so obviously you can't start by installing it, my mistake.

If there is a chance for me to check this again---certainly with the
next release, but also before that, as I am setting up automated
shibboleth-enabled server setup scripts---I will post more information
if it turns out I can do things differently.

> >I did not realize that, so thanks, I searched the documentation and I see
> >in
> >https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPNoSSL
> >that this is a setting specific to IIS. I've removed the entire
> >InProcess section from my configurations now.
> 
> I'm talking about the documentation on the ISAPI element, and the comments
> in the example file.

OK, understood. I reread the example file several times to check it
matched the documentation. I wasn't careful enough to understand what
applied solely to IIS, and wasn't confident enough to remove things
until the SP/IdP combination was working.

> >I don't get this yet. I followed the instructions at
> >https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPGettingStarte
> >d
> >at the time, thought the logo and stylesheet were meant to be set that
> >way, and changed the email address only. It seemed logical that the
> >shibboleth logo should appear if there is a misconfiguration, and that
> >shibboleth is generating the appropriate error page for me.
> 
> I quote from that page: /../

Thanks for the explanation. I spent some time trying to figure out the
error page generation, and I understand the point better now (see below).

> >while obviously
> >important, hard to do if one is still tring to come to grips with
> >getting a working shibboleth SP and IdP.
> 
> Yes, but that doesn't mean you stop once you have a working SP and IdP.
> Most people do, so as a result, I tend to say that if you don't change
> them early, they won't get changed at all. I can't make people do it, but
> I can make the documentation say

I had trouble figuring out where the Errors section
/shibboleth-sp/{logo.jpg,main.css} files were on the SP
server. Located them in /usr/share/doc/shibboleth-2.4.3/ which
surprised me somewhat, I have no idea how that connection works,
internally-generated perhaps during the installation (I don't remember
if there was an option with such a default which I skipped), and the
documentation page
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPErrors
does not shed light on it for me.  However, by looking at examples
online, I see that unlike the ACS links which only allow relative
links, the Error section permits full URLs so I could put there the
SP-specific logo (and various other elements) using a web URL
https://....

> >Comparing the examples, I'm not sure if you are recommending that
> >Errors section be rewritten with a redirectErrors element to specify a
> >completely new page, or if you are recommending that the logo be
> >customized but that shibboleth should generate the appropriate page?
> 
> Most of the time, errors should be rare enough that redirects aren't an
> absolute requirement, unless you're imposing special requirements like
> isPassive or ForceAuthn or other advanced features. So in practice, I
> focus on the latter and simply making sure that if the user sees an error,
> it clearly expresses the system that's reporting the error.

Got it. Thanks a lot indeed. After perusing several online SP
installation tutorials I've got a better feel for how to proceed with
customizing the error pages, something we certainly need to do for our
clients, and which also needs to be automated (by me) for new servers.

Best regards,
-- 
Gernot Hassenpflug