Using SRPM method to install Shibboleth on Amazon EC2 ...

[Peter Schober]

* lhenry <larry.henry at ge.com> [2015-03-13 14:20]:
> Hi Michael, Thanks for the reply. Actually I did follow those instructions
> exactly as the OP did, and got the same result:
> [root at ip-10-227-64-12 ~]# shibd -t
> 2015-03-13 13:17:51 CRIT XMLTooling.Config : libcurl lacks OpenSSL-specific
> options, this will greatly limit functionality

* Cantor, Scott <cantor.2 at osu.edu> [2015-03-13 14:22]:
> Which means you didn't build the special libcurl package required to
> fix what Red Hat broke, or didn't install it, or didn't use it at
> runtime.

To elaborate slightly on the "didn't use at runtime" part: On a CentOS
box I'd use a command like this to include the optional libcurl path
in the `shibd -t` command:

$ LD_LIBRARY_PATH=/opt/shibboleth/lib64 shibd -t

Of course paths may different for you, and if you didn't build and
install a copy of libcurl built against openssl that's also moot.

If you don't rely on SOAP requests (e.g. attrbute queries) that page
sounds like you might get away with the OS suppplied version, though?
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLinuxRH6

> 2015-03-13 13:17:51 WARN Shibboleth.Application : insecure cookieProps
> setting, set to "https" for SSL/TLS-only usage

If your site supports HTTPS for protected content (which it should,
otherweise why bother with SAML) you can get rid of that warning by
setting cookieProps="https".

> 2015-03-13 13:17:51 WARN Shibboleth.Application : handlerSSL should be
> enabled for SSL/TLS-enabled web sites

I wonder why this is still the default (do people actually deploy the
SP on HTTP-only sites? And do we need to cater to those?), but just
set handlerSSL="true" if you have HTTPS on that service at all.

> 2015-03-13 13:17:51 WARN Shibboleth.Application : no MetadataProvider
> available, configure at least one for standard SSO usage
> overall configuration is loadable, check console for non-fatal problems

The shipped default configuration does not contain metadata, so add
some, then this warning will disappear.

> So did you get these messages when you built the RPM on amazon linux? If so,
> are you saying they can be ignored? If not, any thought on what you may have
> done differently?

Warnings should never be ignored unless you know what they mean and
are certain that they don't affect you.
-peter