Shibboleth installation clarification

[Karla Borecky]

Hi Stephen,

This is what I have in my metadata-providers file -

<!-- Hathitrust - get from InCommon -->

<MetadataProvider id="hathitrust"
xsi:type="FileBackedHTTPMetadataProvider"
metadataURL="http://md.incommon.org/InCommon/InCommon-metadata.xml"
backingFile="/opt/shibboleth-idp/metadata/InCommon-metadata.xml"/>


I called mine 'hathitrust' but of course you could could use id="incommon"
or anything else.

FYI: You can use that id to reload metadata just for one SP, using the
reload-metadata command in the *bin* directory:

 ./reload-metadata.sh -id hathitrust

Metadata files reload periodically by themselves, but if you're working
with an SP and they've made a change to their metadata file, you can force
a reload this way.


The other step is that you have to decide which attributes you want to
release to the SP. Hathitrust has special things it wants. One thing they
recommend (I think recommend?) is eduPersonTargetID, which lets folks save
their searches and so on without exposing their actual userid or whatever.
This is done by creating a computerID, generated using a sourceattribute
and a salt. This stuff happens in the attribute-resolver file:

First, you set up the mechanism that generates the ID. This will go at the
bottom of the *attribute-resolver.xml* file, in the same area where you
have your LDAP or whatever defined:

   <!-- Computed targeted ID connector -->
    <resolver:DataConnector xsi:type="dc:ComputedId"
                            id="computedID"
                            generatedAttributeID="computedID"
                            sourceAttributeID="workforceID"
                            salt="Your weird phrase here">
        <resolver:Dependency ref="YourLDAP" />
    </resolver:DataConnector>
</resolver:AttributeResolver>


(I used "workforceID" as my source attribute because it's static for
people. You can use whatever makes sense for you.) Even if you move to a
new IdP installation, this value, once created, will always be the same for
your users, as long as you use the same salt and source attribute.

Next, still in the attribute-resolver.xml file, you configure the
eduPersonTargetedID attribute to get its value from the ComputedId you set
up:

 <resolver:AttributeDefinition xsi:type="ad:SAML2NameID"
id="eduPersonTargetedID"
       nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
*sourceAttributeID="computedID*">
        <resolver:Dependency ref="computedID" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID"
/>
    </resolver:AttributeDefinition>



Lastly, you edit your *attribute-filter.xml* file to release the attributes
to Hathitrust. This is what I have:

<!-- Attributes released to Hathitrust  -->

<afp:AttributeFilterPolicy id="hathitrust" >
  <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="http://www.hathitrust.org/shibboleth-sp"/>
<afp:AttributeRule attributeID="transientId">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
 <afp:AttributeRule attributeID="eduPersonPrincipalName">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
  <afp:AttributeRule attributeID="eduPersonScopedAffiliation">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
  <afp:AttributeRule attributeID="displayName">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
<afp:AttributeRule attributeID="eduPersonTargetedID">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
</afp:AttributeFilterPolicy>


(The eduPersonTargetID is listed at the end.)

Well, I hope this helps and wasn't TMI.

Karla

On Wed, Feb 1, 2017 at 11:29 AM, Klein, Stephen <SKlein at gc.cuny.edu> wrote:

>
>
> We are in the processing of installing Shibboleth as an Identity Provider
> and I do not understand the following in the in the Post Installation tasks:
>
> ‘Complete Metadata configuration by providing the metadata for the SPs you
> will interoperate with in the metadata-providers.xml’
>
>
>
> https://wiki.shibboleth.net/confluence/display/IDP30/Installation
>
>
>
>
>
> We are setting up Shibboleth, again as an Identity Provider, for
> HatthiTrust authentication, so not sure how to approach this task. Can
> someone send me a sample?
>
>
>
> I also see:
>
> ‘load SAML metadata for the service provider with which you will interact’
>
>
>
>
>
> I assume that these two are referencing the same required info?
>
>
>
>
>
>
>
>
>
> Thank you.
>
>
>
> Sincerely,
>
> Stephen
>
>
>
> Stephen Klein
>
> http://libguides.gc.cuny.edu/prf.php?account_id=522
>
> Digital Services Librarian
>
> Room 2318
>
> Graduate Center Library
>
> 365 5th Avenue
>
> New York, NY 10016-4309
>
> 212 817 7074 <(212)%20817-7074>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Karla Borecky
Systems Administrator
ITS
Smith College
Northampton, MA 01063
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170203/c7816fd1/attachment.html>