How to set-up IdP Initiated SSO using Shibboleth as Service Provider

[christinepuedan]

Thank you! Looks like I was able to route apache to my target application.
But my question now is what configurations should I need to do on apache so
that I can log-in to my application automatically? Basically, below is my
desired flow:

1. Log-in to my IdP URL (as this is IdP initiated SSO)
2. Our IdP validates if my ID exists on their LDAP directory.
3. Once validated, I should be routed to my application without prompting
another log-in page to log-on to that application. 

Below is the change that I've did to the following configuration files:

*ssl.conf:*

ServerName 192.168.75.149:443
SSLCertificateFile /etc/pki/tls/certs/dsstudiotst-cert.crt
SSLCertificateKeyFile /etc/pki/tls/private/dsstudiotst-key.key
SSLCertificateChainFile /etc/pki/tls/certs/dsstudiotst_ca.crt
ProxyPreserveHost On
<Location "/">
AuthType shibboleth
ShibRequestSetting requireSession 1
require shib-session
ShibUseHeaders on
ProxyPass http://dsstudiotst/app
ProxyPassReverse http://dsstudiotst/app
</Location>

*shib.conf:*

ShibCompatValidUser Off
<Location /Shibboleth.sso>
#  AuthType None
#  Require all granted
ProxyPass !
SetHandler shib
</Location>

*shibboleth2.xml:*

<ApplicationDefaults entityID="https://192.168.75.149/shibboleth"
        REMOTE_USER="eppn marriottid"
       
cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="false" cookieProps="http"
                 
exportLocation="https://192.168.75.149/Shibboleth.sso/GetAssertion"
exportACL="127.0.0.1 ::1">
            <SSO
entityID="MI-TEST-SAML2.0-https://192.168.75.149/shibboleth"
                 discoveryProtocol="SAMLDS"
discoveryURL="https://ds.example.org/DS/WAYF">
              SAML2
            </SSO>
<MetadataProvider type="XML" validate="true"
path="MI-TEST-SAML2.0-https192.168.75.149shibboleth.xml"/>
<AttributeExtractor type="XML" validate="true" reloadChanges="false"
path="attribute-map.xml"/>
<CredentialResolver type="File" use="signing"
    key="/etc/pki/tls/private/dsstudiotst-key.key"
certificate="/etc/pki/tls/certs/dsstudiotst-cert.crt"/>


*attribute-map.xml:*

    
    <Attribute name="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"
id="marriottid">
        <AttributeDecoder xsi:type="NameIDAttributeDecoder"
formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
    </Attribute>


Thanks!
Christine



--
Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html