Beginners guide.

[David Gersic]

>>> On 1/20/2012 at 09:54 AM, Friedrich Clausen <fred at derf.nl> wrote: 
> I understand the concepts behind Shibboleth but I am having trouble
> getting to grips setting up a test environment in which to test things
> further. I would like to setup a test environment containing 1) an IdP
> and 2) a SP. The SP can be authenticated with something simple such as
> IP based authentication.

I'm new to Shibboleth, so anything I say here is suspect, but maybe I can help with at least part of your question.
 

> I have been reading through the Wiki but I figure out in which order
> to do things as the Wiki is very comprehensive. Is there a basic guide
> or book out there that can walk me through bootstrapping a Shibboleth
> infrastructure?

None that I know of. From my notes on building an IdP (linux) here, though:

0. Establish the IP address and DNS name your IdP will be known by. Use a name like "idp.yourorg.edu" for the DNS name. Assume that once established, this name can never change, and plan appropriately.

1. Install Tomcat6. I'm using Tomcat 6.0.35 here (apache-tomcat-6.0.35.tar.gz). Depending on what you're planning to do, you should be able to follow the directions from Apache for installing. If you want it to run, also follow the directions for building 'jsvc'. They don't provide a script for init.d, but I can send you a copy of one I bodged together that works.

2. Get to know your iptables commands. Tomcat runs as a non-root user, and the IdP must respond on ports 80 and 443 which are not available to non-root user processes. There is a page in the wiki on setting up non-root Tomcat and IdP. Here, I'm on SLES10 as the base OS, so the relevant magic is binding a public and private IP address (131.156.21.44 and 10.0.0.1) using "ip addr add ..." to the interface (eth3), then using "iptables -t nat -A PREROUTING -i eth3 -p tcp --destination 131.156.21.44 --dport 80 -j DNAT --to 10.0.01:8080" (and repeat for ports 443 / 8443).

3. Follow the Shib IdP install instructions from the wiki.
3a. Copy /usr/share/shibboleth/shibboleth-identity-provider-2.3.5/endorsed/* to /usr/share/apache-tomcat-6.0.35/endorsed
3b. Create your context deploy fragment /usr/share/apache-tomcat-6.0.35/conf/catalina/localhost/ipd.xml
3c. Run the install.sh script
path: /opt/shibboleth-idp
host: (your dns name goes here)
password: your keystore password

4. SAML metadata
Edit /opt/shibboleth-idp/conf/relying-party.xml
Here my goal was to join InCommon, so I defined their metadata here. If you haven't done this before, you might want to sign up over at testshib.org first. Get the metadata for sp.testshib.org. Define it here.

5. Configure login authentication
Here, I'm using LDAP. Others may want something else.
5a. Edit /opt/shibboleth-idp/conf/login.conf
Define the LDAP server here.
5b. Edit /opt/shibboleth-idp/conf/handler.xml
Uncomment the "ph:UsernamePassword" block.
5c. Export your LDAP server's trusted root certificate.
5d. Use keytool to import the cert from 5c in to the keystore for your JVM. Mine is in /usr/lib/jvm/java_1.6.0_ibm_1.600/jre/lib/security/cacerts.

6. Certificate management.
For InCommon, upload /opt/shibboleth-idp/credentials/idp.crt to the federation site administrator page.
For testshib.org, cat idp.crt and put it in to the form for registering an IdP.

7. Customize the login page.
Get somebody who knows what they're doing to edit the /usr/share/shibboleth/shibboleth-identity-provider-2.3.5/src/main/webapp/login.jsp page. If your organization has a "standard" for how things are supposed to look, this is the page they're going to care the most about. After editing, run the Shibboleth install.sh script again (overwrite: no). This redeploys the IdP with the changed login page.

8. Attribute release
Edit /opt/shibboleth-idp/conf/attribute-filter.xml and /opt/shibboleth-idp/conf/attribute-resolver.xml to define what attributes your IdP will release, and what SPs it releases them to.


Test all of this with https://sp.testshib.org as your Service Provider. That's a quick and easy way to get your IdP up and working and to learn about it.