How to test?

[Scott Koranda]

> I have set up a new Service Provider that imports the data from our
> remote Identity Provider.  This morning, the team supporting the
> Identity Provider let me know that they had successfully imported the
> Service Provider metadata.
> 
> So at this point the Service Provider and Identity Providers are
> initially set up and configured.
> 
> How do I test the operations?

Browse to

https://<your server>/Shibboleth.sso/Login

The path /Shibboleth.sso/Login is a Shibboleth-specific mechanism to
"manually" initiate a Service Provider (SP) session if you do not
already have one.

Assuming you do not have a valid session, the SP will then consult its
configuration to determine how to initiate a session. 

Most likely you configured shibboleth2.xml so that your SP is only
federated with the single IdP. The SP will then consult the metadata for
that IdP and determine how to redirect your browser to the IdP. It will
then send your browser a 302. 

You should be directed to the IdP and asked to authenticate. After
authenticating your browser will be redirected back to the SP with a
SAML assertion. If the SP successfully consumes the assertion it will
start a new SP session (tracked by a cookie) and redirect your browser to 
https://<your server>.

At that point you should browse to

https://<your server>/Shibboleth.sso/Session

and see some details about your session.

If that all works then you have proven that your SP and the IdP are
federated. Your next step is then to "protect" an "application". An
application can be anything from a simple static web page to a Java
servlet running in Tomcat and proxied by the Apache HTTP Server on which
the SP is running.

You can then study

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent

to understand how to protect various types of content. The approach will
depend on the details of the application or content. See also

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPEnableApplication

If the process above does not work, you should 

1) Turn logging up to DEBUG for the SP, restart both shibd and httpd,
and go through the process again. Examine the log files for hints about
what is going wrong.

2) Install the SAML-Tracer plugin for Firefox and use it to investigate
the flow details to understand where in the flow the error is happening.

> How do we actually use this?

You will configure some combination of Apache HTTP Server, your
application(s), and Shibboleth SP so that when you attempt to access
content and you do not have a valid SP session the SP will redirect your
browser to the IdP to authenticate.

The details depend on your application(s).

> My assigned task was to set up a Service Provider...not sure where we
> go from here.

The above process will determine whether the basic configurations for
the SP and IdP, including SAML metadata, are correct and the SP and IdP
are federated.

After that the details of how you configure the Shibboleth SP will
depend on the application or content you are protecting and the user
experience you need to support (for example, session lifetime).
 
> Any links to documentation would be very much appreciated.

The Shibboleth IdP and SP support the SAML 2 Web Browser SSO Profile.
You should endeavor to understand the basics of that profile.

See the section "Web Browser SSO Profile" at

https://en.wikipedia.org/wiki/SAML_2.0#Web_Browser_SSO_Profile

In particular examine "SP Redirect Request; IdP POST Response" and the
diagram

https://en.wikipedia.org/wiki/SAML_2.0#/media/File:Saml2-browser-sso-redirect-post.png

Once you understand the basics of that profile and have reproduced it 
yourself using the SP, the IdP, and the SAML-Tracer plugin, you will
find understanding the Shibboleth SP specific documentation in the wiki
easier to understand.

Scott K