Convert native Shibboleth SP installation to Shibboleth SP using InCommon metadata
Jason Johnson
jasonaj at gmail.com
Thu Mar 15 20:09:58 GMT 2012
Here is my sample shibboleth2.xml file
<!--
This is an example shibboleth2.xml generated for you by TestShib Two. It's
reduced and recommented
specifically for testing. You don't need to change anything, but you may
want to explore the file
to learn about how your SP works. Uncomment attributes in your
attribute-map.xml file to test them.
If you want to test advanced functionality, start from the distribution
shibboleth2.xml and add the
MetadataProvider, TestShib credentials, the right entityID, and a
SessionInitiator. More information:
https://spaces.internet2.edu/display/SHIB2/NativeSPConfiguration
-->
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
logger="syslog.logger" clockSkew="1800">
<!-- You might want to increase the top-level log sensitivity in these
files. -->
<OutOfProcess logger="shibd.logger" />
<InProcess logger="native.logger">
<ISAPI normalizeRequest="true">
<!-- Maps IIS Instance ID values to the host name. -->
<Site id="12345" name="sampleidp.nowhere.com"/>
</ISAPI>
</InProcess>
<!-- Settings for session storage and internal communication. -->
<TCPListener address="127.0.0.1" port="12345" acl="127.0.0.1"/>
<StorageService type="Memory" id="mem" cleanupInterval="900"/>
<SessionCache type="StorageService" StorageService="mem"
cacheTimeout="3600" inprocTimeout="900" cleanupInterval="900"/>
<ReplayCache StorageService="mem"/>
<RequestMapper type="Native">
<RequestMap applicationId="default">
<Host name="sampleidp.nowhere.com" applicationId="auth-sample">
<Path name="secure" authType="shibboleth"
requireSession="true" requireSessionWith="SampleIdP" />
</Host>
</RequestMap>
</RequestMapper>
<!-- The entityID is the name TestShib made for your SP. -->
<ApplicationDefaults id="default" policyId="default" REMOTE_USER="eppn"
entityID="https://myspd.nowhere.com/shibboleth-sp"
homeURL="https://myspd.nowhere.com/index.html">
<Sessions lifetime="28800" timeout="3600" checkAddress="false"
handlerURL="/Shibboleth.sso" handlerSSL="false">
<SessionInitiator type="Chaining" Location="/Login"
isDefault="false" id="SampleIdP" relayState="cookie" entityID="
https://sampleidp.nowhere.com/idp/shibboleth">
<SessionInitiator type="SAML2" acsIndex="1"
template="bindingTemplate.html"/>
<SessionInitiator type="Shib1" acsIndex="5"/>
</SessionInitiator>
<!-- How and where the SP listens. -->
<md:AssertionConsumerService Location="/SAML2/POST" index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
<md:AssertionConsumerService Location="/SAML/POST" index="6"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
<Handler type="MetadataGenerator" Location="/Metadata"
signing="false"/>
<Handler type="Status" Location="/Status" acl="127.0.0.1"/>
<Handler type="Session" Location="/Session"/>
<!-- LogoutInitiators enable SP-initiated local or
global/single logout of sessions. -->
<LogoutInitiator type="Chaining" Location="/Logout">
<LogoutInitiator type="SAML2"
template="bindingTemplate.html"/>
<LogoutInitiator type="Local"/>
</LogoutInitiator>
<!-- md:SingleLogoutService locations handle single logout
(SLO) protocol messages. -->
<!--
<md:SingleLogoutService Location="/SLO/SOAP"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
<md:SingleLogoutService Location="/SLO/Redirect"
conf:template="bindingTemplate.html"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
<md:SingleLogoutService Location="/SLO/POST"
conf:template="bindingTemplate.html"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
<md:SingleLogoutService Location="/SLO/Artifact"
conf:template="bindingTemplate.html"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
-->
</Sessions>
<!-- Error pages to display to yourself if something goes horribly
wrong. -->
<Errors session="sessionError.html" metadata="metadataError.html"
access="accessError.html" ssl="sslError.html"
supportContact="root at localhost"
logoLocation="/shibboleth-sp/logo.jpg"
styleSheet="/shibboleth-sp/main.css"/>
<!-- Loads and trusts a metadata file from InCommon. -->
<!--
<MetadataProvider type="XML" uri="
https://wayf.incommonfederation.org/InCommon/InCommon-metadata.xml"
backingFilePath="incommon-metadata.xml" reloadInterval="7200">
<MetadataFilter type="RequireValidUntil"
maxValidityInterval="2419200"/>
<MetadataFilter type="Signature" certificate="incommon.pem"/>
</MetadataProvider>
-->
<!-- Attribute and trust options you shouldn't need to change. -->
<TrustEngine type="ExplicitKey"/>
<AttributeExtractor type="XML" path="attribute-map.xml"/>
<AttributeResolver type="Query"/>
<AttributeFilter type="XML" path="attribute-policy.xml"/>
<!-- Your SP generated these credentials. They're used to talk to
IdP's. -->
<CredentialResolver type="File" key="sp-key.pem"
certificate="sp-cert.pem"/>
<ApplicationOverride id="auth-sample" entityID="sampleidp.nowhere.com">
<MetadataProvider type="XML" file="sampleidp-idp-metadata.xml"/>
</ApplicationOverride>
</ApplicationDefaults>
<!-- Security policies you shouldn't change unless you know what you're
doing. -->
<SecurityPolicies>
<Policy id="default" validate="false">
<Rule type="MessageFlow" checkReplay="true" expires="60"/>
<Rule type="ClientCertAuth" errorFatal="true"/>
<Rule type="XMLSigning" errorFatal="true"/>
</Policy>
</SecurityPolicies>
</SPConfig>
On Thu, Mar 15, 2012 at 2:22 PM, Jason Johnson <jasonaj at gmail.com> wrote:
> Hello,
>
> I am wanting to convert my existing Shibboleth SP installation from a
> native (using local SP metadata file AND connecting to IDPs using local
> metadata files) to an InCommon/Shibboleth SP installation (with my SP
> metadata being pulled from InCommon). My biggest hurdle is I don't see
> where in the shibboleth2.xml file I need to specify that my SP metadata is
> to now be supplied remotely. I have seen this line mentioned a few times
> in other posts:
>
> <MetadataProvider type="XML" uri="
> https://wayf.incommonfederation.org/InCommon/InCommon-metadata.xml"
> backingFilePath="incommon-metadata.xml" reloadInterval="7200">
> <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200" />
> <MetadataFilter type="Signature" certificate="incommon.pem" />
> </MetadataProvider>
>
> However, I was under the impression that this XML attribute was to tell
> Shibboleth how to interact with the IDPs. Do I have that wrong? Does it
> control both??
>
> My end goal is the following:
>
> 1. Use my new InCommon SP metadata for all my connections
> 2. Use InCommon IDPs for those that are in InCommon
> 3. Use local IDP metadata files for those not in InCommon
> 4. All this using one Shibboleth installation.
>
> Thanks,
> Jason
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120315/5d00facc/attachment.html
More information about the users
mailing list