How to test?

[Michael Nesmith - NOAA Affiliate]

Scott,

Thank you.

This is more like the information that I was looking for.

Let me do some testing and talk to management...see how they have the
project set up.

Happy New Year!
Mike


On Fri, Dec 29, 2017 at 12:16 PM, Scott Koranda <skoranda at gmail.com> wrote:

> > I have set up a new Service Provider that imports the data from our
> > remote Identity Provider.  This morning, the team supporting the
> > Identity Provider let me know that they had successfully imported the
> > Service Provider metadata.
> >
> > So at this point the Service Provider and Identity Providers are
> > initially set up and configured.
> >
> > How do I test the operations?
>
> Browse to
>
> https://<your server>/Shibboleth.sso/Login
>
> The path /Shibboleth.sso/Login is a Shibboleth-specific mechanism to
> "manually" initiate a Service Provider (SP) session if you do not
> already have one.
>
> Assuming you do not have a valid session, the SP will then consult its
> configuration to determine how to initiate a session.
>
> Most likely you configured shibboleth2.xml so that your SP is only
> federated with the single IdP. The SP will then consult the metadata for
> that IdP and determine how to redirect your browser to the IdP. It will
> then send your browser a 302.
>
> You should be directed to the IdP and asked to authenticate. After
> authenticating your browser will be redirected back to the SP with a
> SAML assertion. If the SP successfully consumes the assertion it will
> start a new SP session (tracked by a cookie) and redirect your browser to
> https://<your server>.
>
> At that point you should browse to
>
> https://<your server>/Shibboleth.sso/Session
>
> and see some details about your session.
>
> If that all works then you have proven that your SP and the IdP are
> federated. Your next step is then to "protect" an "application". An
> application can be anything from a simple static web page to a Java
> servlet running in Tomcat and proxied by the Apache HTTP Server on which
> the SP is running.
>
> You can then study
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/
> NativeSPProtectContent
>
> to understand how to protect various types of content. The approach will
> depend on the details of the application or content. See also
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/
> NativeSPEnableApplication
>
> If the process above does not work, you should
>
> 1) Turn logging up to DEBUG for the SP, restart both shibd and httpd,
> and go through the process again. Examine the log files for hints about
> what is going wrong.
>
> 2) Install the SAML-Tracer plugin for Firefox and use it to investigate
> the flow details to understand where in the flow the error is happening.
>
> > How do we actually use this?
>
> You will configure some combination of Apache HTTP Server, your
> application(s), and Shibboleth SP so that when you attempt to access
> content and you do not have a valid SP session the SP will redirect your
> browser to the IdP to authenticate.
>
> The details depend on your application(s).
>
> > My assigned task was to set up a Service Provider...not sure where we
> > go from here.
>
> The above process will determine whether the basic configurations for
> the SP and IdP, including SAML metadata, are correct and the SP and IdP
> are federated.
>
> After that the details of how you configure the Shibboleth SP will
> depend on the application or content you are protecting and the user
> experience you need to support (for example, session lifetime).
>
> > Any links to documentation would be very much appreciated.
>
> The Shibboleth IdP and SP support the SAML 2 Web Browser SSO Profile.
> You should endeavor to understand the basics of that profile.
>
> See the section "Web Browser SSO Profile" at
>
> https://en.wikipedia.org/wiki/SAML_2.0#Web_Browser_SSO_Profile
>
> In particular examine "SP Redirect Request; IdP POST Response" and the
> diagram
>
> https://en.wikipedia.org/wiki/SAML_2.0#/media/File:Saml2-
> browser-sso-redirect-post.png
>
> Once you understand the basics of that profile and have reproduced it
> yourself using the SP, the IdP, and the SAML-Tracer plugin, you will
> find understanding the Shibboleth SP specific documentation in the wiki
> easier to understand.
>
> Scott K
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>


-- 
Michael NeSmith
Senior Linux Administrator
Earth Resources Technology, Inc.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171229/961d0fea/attachment-0001.html>