Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


Info

This guide describes how the Shibboleth v3 SP can be configured as a SAML Service Provider for eduTEAMS. 

Shibboleth (pronounced "Shibboleth") is the reference implementation of the OASIS SAML standard.

Setting up the Shibboleth Service Provider is beyond the scope of this document. Many resources are available, such as the Shibboleth Wiki (https://wiki.shibboleth.net) and the installation instructions supplied and maintained by SWITCH (https://www.switch.ch/aai/guides/sp/installation/).

It is assumed in the following that you are using Shibboleth's v3 SP alongside the Apache webserver.


Shibboleth configuration

Locate the file shibboleth2.xml. For example, using the switch.ch instructions for an Ubuntu Linux system, you will find the file at /etc/shibboleth/shibboleth2.xml.


We show to the right, sections of the file you will need to enter information relevant to your installation.



[...]

<!-- By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache are used. See example-shibboleth2.xml for samples of explicitly configuring them. -->
<!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
<ApplicationDefaults entityID="https://rohu.geant.org/shibboleth"
REMOTE_USER="mail"
cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:
!TLSv1:!TLSv1.1"
>

[...]



[...]

<!--
Configures SSO for a default IdP. To properly allow for >1 IdP, remove
entityID property and adjust discoveryURL to point to discovery service.
You can also override entityID on /Login query string, or in RequestMap/htaccess.
-->
<SSO entityID="https://login.terena.org/wayf/saml2/idp/metadata.php">
SAML2
</SSO>

[...]

[...]

<SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Login"
entityID="https://login.terena.org/wayf/saml2/idp/metadata.php"
target="https://rohu.geant.org/"
relayState="cookie">
<SessionInitiator type="SAML2" template="bindingTemplate.html"/>
<SessionInitiator type="Shib1"/>
</SessionInitiator>

[...]




<!--
Allows overriding of error template information/filenames. You can
also add your own attributes with values that can be plugged into the
templates, e.g., helpLocation below.
-->
<Errors supportContact="support@rohu.geant.org"
helpLocation="/about.html"
styleSheet="/shibboleth-sp/main.css"/>

Code Block
languagexml
<!--
        Allows overriding of error template information/filenames. You can
        also add your own attributes with values that can be plugged into the
        templates, e.g., helpLocation below.
        -->
        <Errors supportContact="support@rohu.geant.org"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>


Code Block
languagexml
<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
    clockSkew="180">

    <OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" />

    <!--
    By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
    are used. See example-shibboleth2.xml for samples of explicitly configuring them.
    -->

    <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
    <ApplicationDefaults entityID="https://rohu.geant.org/shibboleth"
        REMOTE_USER="mail"
        cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1"
        >
        <!--        sessionHook="/Shibboleth.sso/AttrChecker"-->
        <!--
        Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
        Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
        and should be a relative path, with the SP computing the full value based on the virtual
        host. Using handlerSSL="true" will force the protocol to be https. You should also set
        cookieProps to "https" for SSL-only sites. Note that while we default checkAddress to
        "false", this makes an assertion stolen in transit easier for attackers to misuse.
        -->
        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="true" cookieProps="https">

            <!--
            Configures SSO for a default IdP. To properly allow for >1 IdP, remove
            entityID property and adjust discoveryURL to point to discovery service.
            You can also override entityID on /Login query string, or in RequestMap/htaccess.
            -->
            <!--<SSO entityID="https://idp.example.org/idp/shibboleth"
                 discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">-->
            <!--<SSO entityID="https://terena.org/sp"-->
                <SSO entityID="https://login.terena.org/wayf/saml2/idp/metadata.php"
                >
              SAML2
            </SSO>

            <!-- SAML and local-only logout. -->
            <Logout>SAML2 Local</Logout>

            <!-- Administrative logout. -->
            <LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" />

            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

            <!-- Status reporting service. -->
            <!--<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1 62.40.105.39"/>-->
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

            <!-- Session diagnostic service. -->
            <!--<Handler type="Session" Location="/Session" showAttributeValues="false"/>-->
            <Handler type="Session" Location="/Session" showAttributeValues="true"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>

            <Handler type="AttributeChecker" Location="/AttrChecker" template="attrChecker.html" attributes="uid eppn displayName" flushSession="true"/>

<SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Login"
    entityID="https://login.terena.org/wayf/saml2/idp/metadata.php"
    target="https://rohu.geant.org/"
    relayState="cookie">
                <SessionInitiator type="SAML2" template="bindingTemplate.html"/>
                <SessionInitiator type="Shib1"/>
</SessionInitiator>
        </Sessions>


        <!--
        Allows overriding of error template information/filenames. You can
        also add your own attributes with values that can be plugged into the
        templates, e.g., helpLocation below.
        -->
        <Errors supportContact="support@rohu.geant.org"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>

        <!-- Example of locally maintained metadata. -->

        <MetadataProvider type="XML" validate="true" path="metadata.php"/>


        <!-- Example of remotely supplied batch of signed metadata. -->
        <!-- 
        <MetadataProvider type="XML" validate="true"
                url="https://login.terena.org/wayf/module.php/saml/sp/metadata.php/default-sp"
              backingFilePath="login.terena.org-metadata.xml" maxRefreshDelay="7200">
            <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
        -->    <!--<MetadataFilter type="Signature" certificate="fedsigner.pem" verifyBackup="false"/>-->
        <!-- <DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true" 
              attributeName="http://macedir.org/entity-category"
              attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
              attributeValue="http://refeds.org/category/hide-from-discovery" />
        </MetadataProvider>
        -->


        <!-- Example of remotely supplied "on-demand" signed metadata. -->
        <!--
        <MetadataProvider type="MDQ" validate="true" cacheDirectory="mdq"
               baseUrl="http://mdq.federation.org" ignoreTransport="true">
            <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
            <MetadataFilter type="Signature" certificate="mdqsigner.pem" />
        </MetadataProvider>
        -->

        <!-- Map to extract attributes from SAML assertions. -->
        <!--<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>-->
        <AttributeExtractor type="XML" validate="true" reloadChanges="true" path="attribute-map.xml"/>

        <!-- Default filtering policy for recognized attributes, lets other data pass. -->
        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

        <!-- Simple file-based resolvers for separate signing/encryption keys. -->
        <CredentialResolver type="File" use="signing"
            key="sp-key.pem" certificate="sp-cert.pem"/>
        <CredentialResolver type="File" use="encryption"
            key="sp-key.pem" certificate="sp-cert.pem"/>

    </ApplicationDefaults>

    <!-- Policies that determine how to process and authenticate runtime messages. -->
    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>

    <!-- Low-level configuration about protocols and bindings available for use. -->
    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>

</SPConfig>









Apache configuration