Setting up Shibboleth IdP to mock SAML provider

[Brandon Chinn]

Hi Peter, thanks for the detailed answers. Unrelatedly, sorry for not
replying in the thread. I can't figure out how to get Gmail to continue the
thread.

I actually got it working, thanks! Like I mentioned, I think I've read
every page in that Shibboleth wiki, but I couldn't figure out how to piece
it together. Here's the flow that I figured out for my use-case, for
posterity:

0. Use the unicon/shibboleth-idp Docker container
1. Configure SP in `conf/metadata-providers.xml`
    * https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataForSP
2. Configure the "SAML2.SSO" profile in `conf/relying-party.xml`
    *
https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration
    * Make sure you include `<property name="encryptionOptional"
value="true" />` as a child of the SAML2.SSO bean
    * I used the RelyingPartyByName bean in RelyingPartyOverrides
3. Ensure the "authn/Password" is enabled in "conf/authn/general-authn.xml"
    *
https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration#AuthenticationConfiguration-GeneralConfiguration
    * I deleted everything else just to be clean, but not necessary
4. Enable just the "jaas-authn-config.xml" import in
"conf/authn/password-authn-config.xml"
    *
https://wiki.shibboleth.net/confluence/display/IDP30/PasswordAuthnConfiguration#PasswordAuthnConfiguration-GeneralConfiguration
5. Configure ShibUserPassAuth in "conf/authn/jaas.config"
    *
https://wiki.shibboleth.net/confluence/display/IDP30/JAASAuthnConfiguration#JAASAuthnConfiguration-JAASConfiguration
    * This is where I configured com.tagish.auth.FileLogin, by adding
`tagishauth.jar` to `/opt/shibboleth/webapp/WEB-INF/lib/` and creating a
password file of "username:md5-hash-of-password" lines
6. Go to
`localhost:4443/idp/profile/SAML2/Unsolicited/SSO?providerId=your-entity-id`

That checklist ^ would've been so helpful for me, but I couldn't find
anything like it anywhere. Thanks again for all your help!

-- 
Brandon Chinn
LeapYear Technologies (http://leapyear.io)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190606/fa05705d/attachment.html>