...
Expand | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
Download our sample shibboleth2.xml and replace your /etc/shibboleth/shibboleth2.xml with downloaded file. Open shibboleth2.xml in a text editor.
Search <ApplicationDefaults entityID="https://mysite.cit.cornell.edu/shibboleth"... >. EntityID is the Unique identifier for your SP. Cornell Shibboleth Identity Provider(IDP) provides service to many applications. This entityID will help Cornell IDP to identify your SP. We recommend you follow shibboleth convention named it "https://xxx/shibboleth". It's better not include space or special characters in it( / and : are fine). One SP can server multiple sites in your Apache so it does not necessarily equate to the hostname(s) at which your service runs.
--- lifetime is the maximum duration in --- timeout is the maximum inactivity allowed between requests in a session maintained by the SP. The settings shown in the example will set your Shibboleth session timeout to 3600 (1 hour). --- postData="ss:mem" postTemplate="postTemplate.html" Add it to <Session ..> if your website has web form. Web form POST data will be saved in the Shibboleth memory cache rather than discarded when a user requires authentication after filling out a web form. "postTemplate.html" is located in /etc/shibboleth directory. Modify it to meet your website's style. More information: https://wiki.shibboleth.net/confluence/display/SP3/Sessions
Search < Errors supportContact ="root@localhost" helpLocation ="/about.html" styleSheet ="/shibboleth-sp/main.css" /> . Change the email address to your application's support email address. Change the helpLocation to your application's help page.
Search <SSO entityID=" https://shibidp.cit.cornell.edu/idp/shibboleth ">.Replace our production IDP's entityID with test IDP's entityID: https://shibidp-test.cit.cornell.edu/idp/shibboleth Search <MetadataProvider ... url=" https://shibidp.cit.cornell.edu/idp/shibboleth " ..>. This is production IDP's metadata url. Comment out this block for your test site. Then un-comment MetadataProvider for Cornell test IDP.
|
Shibboleth Configuration Check:
In the command line, execute the following command to see whether the Shibboleth Service Provider can load the default configuration:
Panel |
---|
sudo shibd -t If you see ERROR regarding XMLTooling, include following library path in the command sudo LD_LIBRARY_PATH=/opt/shibboleth/lib64 shibd -t |
The last line of the output should read:
Panel |
---|
|
If there are any ERROR
log entries, we strongly recommended you resolve these. Messages with log level WARN
are generally not problematic but you should understand the causes of these warning messages and run the configuration check again when you are finished with your setup.
Logs for Shibboleth SP are located at /var/log/shibboleth/. Take a look at /var/log/shibboleth/shibd_warn.log and make sure there is no error in there. You need to fix error if there is any and restart shibd and httpd.
Start Shibboleth Service Provider and Apache
...
After you run the command, make sure shibd and httpd are running. Logs for Shibboleth SP are located at /var/log/shibboleth/. Take a look at /var/log/shibboleth/shibd_warn.log and make sure there is no error in there. You need to fix error if there is any and restart shibd and httpd.
Register Service Provider with Cornell IDP
...