Application for creating Shibboleth2 and attribute-map XMLs

Fri Feb 10 11:08:33 UTC 2023

Hello everyone,

I have been setting up Shibboleth for the application my software company
writes for about 2 years now. No one else in my organization has been able
to successfully deploy Shibboleth for our clients and we generally have
very basic setups. So I created a C# application that will allow you to
answer the questions and then you can select where you want the
Shibboleth2.xml and attribute-map.xml and select create files. It will
create the files from your answers and will even allow up to 3 application
overrides to be setup. If you are interested in checking it out you can
download it from
https://drive.google.com/file/d/1vR_IroMzu7pRSOUucs5RxAFyTu8kF7x2/view?usp=sharing.

Instructions:

Step 1: Start on the ISAPI Sites and select the checkbox next to how many
sites you are setting up.

Step 2: Select the Site ID (you should be able to get this from IIS) for
each site with the main site being #1.

Step 3: Select the Scheme for each site.

Step 4: Select the Port for each site (in my experience, this is best to
have all on default port and use DNS Aliases for each site).

Step 5: type in the name of the site. Example. Site.domain.com

Step 6: Select Hosts – you will notice that the only hosts you can update
are those that you selected as active in the ISAPI Sites tab.

Step 7: Select if you are making the hosts active (you have to make them
active in order to fill out the information and also it makes the
Application Defaults for the site to be editable).

Step 8: Fill in the name of the host (will most likely be the same as the
ISAPI site) host 1 is for ISAPI site 1.

Step 9: I have set this up with defaults for our application, but you can
change if you want the main page to requireSession and you can change the
names of the default pages I have entered if you want different session
requirements. These can also be removed once the file is produced.

Step 10: Host 2 to Host 4 you will also see a checkbox “Is this an
Application Override?” and an applicationID textbox. You will need to
select the override and enter a unique name for the applicationId (this can
be anything even as simple as 1, 2 or 3).

Step 11: Finish filling in each of these Hosts.

Step 12: Click the Application Defaults page.

Step 13: You will see that the only tabs active here are those of the hosts
that you made active. That is because you will not need to do Application
Overrides if you are using the same IdP information for all sites. Make any
changes to the default settings you see on the App Defaults tab.

Step 14: Go to App 1 Settings tab.

Step 15: Fill in the settings for the main site Shibboleth configuration,
remember this will be used for any sites you did not select as an
application override. Also the entity IDs will need to be in the format of
an URL, so beginning with http or https just like a website.

Step 16: Go to App 2, App3, and App4 settings tabs and fill them out
appropriately for the application overrides. The Override Id will be the
same as the Hosts applicationId for that site. Make any necessary changes
and remember if you are using a Federation URL to enter iit correctly and
be sure to download the Metadata file from the IdP (one for each override
as well) and save it to the Shibboleth file on your server along with these
two files created by the app. Put the name of the downloaded Metadata file
in the backingFilePath text box. If not using the Federation URL then this
will be used as the MetadataProvider file. Also, check the Metadata file to
see if it has a termination date set (can’t remember the name of the field
now) and remove that date or change it to something way into the future. I
have seen many IdPs set the date and time to when the file was created or
within a day or two of when it was created and then all the sudden SSO
stops working.

Step 17: Go to the Attributes tab.

Step 18: Make as many attributes active as you need and change any of the
information that you need to in order to match your attributes. Examples
are already listed. You can just select any number, you do not have to
select them in order.

Step 19: Click the where to save the files button to select the folder you
would like to save them in.

Step 20: Click the Build Shibboleth XMLs button.

Step 21: Place the files in your installed location for Shibboleth.

Step 22: Restart the Shibboleth Service.

Step 23: In Command Prompt as Administrator type in IISRESET and press
Enter.

Step 24: After IIS finishes starting go to a web browser and type in
https://sitenamepath/Shibboleth.sso/Metadata. If a Metadata file is
downloaded then you can import that information into the IdP setup for your
application.

Step 25: If using Application Overrides for each site then you will need to
download the Metadata for each.
https://site2namepath/Shibboleth.sso/Metadata,
https://site3namepath/Shibboleth.sso/Metadata and so on.

Step26: Import into your IdP for each application you have setup, make sure
the application is fully setup in your IdP and then test the site to see if
you are redirected to the correct location. With our application we have to
login into it and tell it to begin using Shibboleth which is why I have the
requireSession for the main site to false. This allows us to switch back to
not using Shibboleth and we will not be redirected to the IdP login.

You will get a popup for each of the files telling you that it has been
created and where it is at.

Please remember, this is the basics and there are a lot of other options
out there that you can setup within Shibboleth, so this will not work best
for all sites, but it will work for some.

If you have any questions, comments or suggestions please feel free to drop
me an email here.

Cheers and have fun,

Rick
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230210/a0c80d65/attachment.htm>