Questions on initial install/configuration of Shibboleth

[Michael Nesmith - NOAA Affiliate]

Hi,

I am a Linux SA but new to Shibboleth and this list.
Please pardon some very basic configuration questions.


My partner has recently installed Shibboleth on a Redhat 6 Linux server.

[root at marlin ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 6.9 (Santiago)

[root at marlin ~]# uname -a
Linux marlin.nmfs.noaa.gov 2.6.32-696.13.2.el6.x86_64 #1 SMP Fri Sep 22
12:32:14 EDT 2017 x86_64 x86_64 x86_64 GNU/Linux

He tells me that he did a default rpm install.
I see the following rpms loaded:

[root at marlin ~]# rpm -qa | grep shib
liblog4shib1-1.0.9-3.1.el6.x86_64
shibboleth-2.6.1-3.1.el6.x86_64

The customer wants to use Shibboleth as a single sign-on provider.
Not sure why they don't just use LDAP...we have a LDAP  server.


Here's the initial guidance I received from my partner before he left.

Michael , here are the steps that i know should be done first:

1) import IdP (Identify Provider) metadata to shibboleth (this is what OCIO
provided for us to connect) -
  attached two files: sso-dev-noaaonline-idp.xml and sso-dev-cac-idp.xml

2) generate our SP (Service Provider) metadata and attach here.

The problem is that when I read the configuration documentation, I don't
see any of the information that I need to do either of these tasks.

Step 1 on loading the IdP metadata refers to a file named relying-party.xml
that I can't even find.

-------------------------------------------------------------------------------------------------------------------
A great deal of functionality in the Shibboleth Identity Provider is driven
from SAML metadata information.
Metadata is provided to the IdP through Metadata Providers (yeah, we
developers are pretty creative with our names).
Metadata Providers are defined in the $IDP_HOME/conf/relying-party.xml file
and are defined as follows.
-------------------------------------------------------------------------------------------------------------------

I don't see anything regarding how to do step 2 in the documentation on
producing SP metadata.

Here is my documentation source:
https://wiki.shibboleth.net/confluence/display/SHIB2/Configuration

No idea what the Shibboleth home directory is supposed to be.
I don't see any Shibboleth environment variables set.

It seems to have most of the Shibboleth files loaded in /etc/shibboleth:

root at marlin shibboleth]# pwd
/etc/shibboleth

[root at marlin shibboleth]# ls
accessError.html           console.logger.dist
native.logger             shibd-debian
accessError.html.dist      discoveryTemplate.html
native.logger.dist        shibd.logger
apache22.config            discoveryTemplate.html.dist
partialLogout.html        shibd.logger.dist
apache24.config            example-metadata.xml
partialLogout.html.dist   shibd-osx.plist
apache2.config             example-metadata.xml.dist
postTemplate.html         shibd-redhat
apache.config              example-shibboleth2.xml
postTemplate.html.dist    shibd-suse
attrChecker.html           example-shibboleth2.xml.dist
protocols.xml             shibd-systemd
attrChecker.html.dist      globalLogout.html
protocols.xml.dist        sp-cert.pem
attribute-map.xml          globalLogout.html.dist
security-policy.xml       sp-key.pem
attribute-map.xml.dist     keygen.sh
security-policy.xml.dist  sslError.html
attribute-policy.xml       localLogout.html
sessionError.html         sslError.html.dist
attribute-policy.xml.dist  localLogout.html.dist
sessionError.html.dist    syslog.logger
bindingTemplate.html       metadataError.html
shibboleth2.xml           syslog.logger.dist
bindingTemplate.html.dist  metadataError.html.dist
shibboleth2.xml.dist
console.logger             metagen.sh                    shibd-amazon


Looks like the main configuration file is:
  shibboleth2.xml

The Shibboleth daemon seems to be running, but I can't access anything
related to Shibboleth from the Apache web page.

[root at marlin init.d]# /etc/init.d/shibd status
shibd (pid 5043) is running...

[root at marlin init.d]# /etc/init.d/httpd status
httpd (pid  6642) is running...

Any help that anyone can provide for someone doing his first install will
be greatly appreciated.
Anyone with links to better install/configuration information should feel
free to chip in too.

Thanks,
Mike


-- 
Michael NeSmith
Senior Linux Administrator
Earth Resources Technology, Inc.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171213/7f3a15b0/attachment.html>