...
Expand | ||
---|---|---|
| ||
These links may break at some point, but for now the 32-bit and 64-bit run times can be found at: https://aka.ms/vs/15/release/VC_redist.x86.exe https://aka.ms/vs/15/release/VC_redist.x64.exe The top-level link to find them is https://visualstudio.microsoft.com/downloads/ via Other Tools Restart the server after the installation. |
Expand | ||
---|---|---|
| ||
1 Download the latest version of the Windows installer package from the Shibboleth download site at https://shibboleth.net/downloads/service-provider/latest/. Select either the win32/ or win64/ directory as appropriate to your 32-bit or 64-bit system. Then download .msi file. 2 Run the installer package. It is recommended that you accept all defaults, as follows:
|
...
Expand | ||
---|---|---|
| ||
Save a copy of attribute-map.xml to attribute-map.xml.orig or similar. Download our sample attribute-map.xml and replace your attribute-map.xml with downloaded file. Our attribute-map.xml defines all commonly used attributes. All attributes except groups are released by default to all SP. Attribute "groups" is released on demand. Submit group membership requirement when you submit shibboleth integration request form. Find all the default attributes released by Cornell IDP from Shibboleth at Cornell Page. Edit attribute-map.xml as needed. |
Expand | ||||||||
---|---|---|---|---|---|---|---|---|
| ||||||||
Save a copy of
Find <ISAPI...>...<Site id="1" name="shibtest.cit.cornell.edu"/>. Change the "site id" to match the id assigned to your site by IIS. You can find your site id in Internet Services (IIS) Manager by clicking on "Sites". In this same location, change the site name to your website domain name. Our example defined two sites. Delete or add more as needed.
Find <RequestMap>...<Host name="shibtest.cit.cornell.edu">. Change the "Host name" to the site name you defined in step above. In this example file, we defined two hosts and specifies different authorization rules for each site and location. Please modify it to meet your site requirement. If your site supports both http and https, add redirectToSSL="443" in Host element because shibboleth SP doesn't work with http connection. Additional resources for AccessControl: https://wiki.shibboleth.net/confluence/display/SP3/XMLAccessControl
Find <ApplicationDefaults entityID="https://shibtest.cit.cornell.edu/shibboleth" ...>. EntityID is the name of your SP and should be unique. Change the "entityID" to whatever you like.We recommend you follow shibboleth convention named it "https://yourDomainName/shibboleth". It's better not include space or special characters in it( / or : are fine). You can use one entityID for all your sites hosted in the same IIS.
Find < Errors supportContact ="root@localhost" helpLocation ="/about.html" styleSheet ="/shibboleth-sp/main.css" /> . Change the email address to your application's support email address.
Find <MetadataProvider ... url=" https://shibidp.cit.cornell.edu/idp/shibboleth " ..>. This is production IDP's metadata url. Comment out this block for your test site. Then un-comment MetadataProvider for Cornell test IDP. |
Expand | |||||
---|---|---|---|---|---|
| |||||
Go to your SP installation directory(
"overall configuration is loadable, check console for non-fatal problems" If there is error, check log for detail. All the log files are in SP installation directory\var\log\shibboleth |
Expand | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
As Shibboleth requires a certificate and key to encrypt and decrypt attribute assertions, an X509 certificate must be installed for it to work. Now that the shibboleth2.xml file has been updated, use the keygen.bat command in C:\opt\shibboleth-sp\etc\shibboleth to create new certificates with the hostname(server name) and your SP entityID. Use the following format:
where the values for each are substituted accordingly
The 10 indicates the number of years for which the certificate is issued. You may specify a different value. |
Info |
---|
Whenever you make changes to SP's configuration file, save the file. You can wait for the Shibboleth Daemon to pick up the changes or you can restart the Shibboleth Daemon to make the changes take effect right away. Some changes may require IIS restart. |
Register Service Provider with Cornell IDP
...
title | Get SP's metadata |
---|
...
Find <ApplicationDefaults entityID="https://shibtest.cit.cornell.edu/shibboleth" ...>. EntityID is the unique identifier for your SP. Cornell Shibboleth Identity Provider(IDP) provides service to many applications. This entityID will help Cornell IDP to identify your SP. We recommend you follow shibboleth convention named it "https://yourDomainName/shibboleth". It's better not include space or special characters in it( / or : are fine). You can use one entityID for all your sites hosted in the same IIS.
Find < Errors supportContact ="root@localhost" helpLocation ="/about.html" styleSheet ="/shibboleth-sp/main.css" /> . Change the email address to your application's support email address.
Find <SSO entityID=" https://shibidp.cit.cornell.edu/idp/shibboleth ">.Replace our production IDP's entityID with test IDP's entityID: https://shibidp-test.cit.cornell.edu/idp/shibboleth Find <MetadataProvider ... url=" https://shibidp.cit.cornell.edu/idp/shibboleth " ..>. This is production IDP's metadata url. Comment out this block for your test site. Then un-comment MetadataProvider for Cornell test IDP.
|
Expand | |||||
---|---|---|---|---|---|
| |||||
Go to your SP installation directory(
"overall configuration is loadable, check console for non-fatal problems" If there is error, check log for detail. All the log files are in SP installation directory\var\log\shibboleth |
Info |
---|
Whenever you make changes to SP's configuration file, save the file. You can wait for the Shibboleth Daemon to pick up the changes or you can restart the Shibboleth Daemon to make the changes take effect right away. Some changes may require IIS restart. |
Register Service Provider with Cornell IDP
Expand | |||||||
---|---|---|---|---|---|---|---|
| |||||||
|
Expand | ||
---|---|---|
| ||
Submit your shibboleth integration request from https://shibrequest.cit.cornell.edu. On the second page of request form, select 'No' for question "Has the application service provider's metadata been published with InCommon?". Use text editor open your SP's metadata, copy the content of the metadata and paste it in the "Service Provider's metadata field. Once the form is submitted, Identity Management get a Remedy case. We'll configure your SP in prod IDP in 1 - 2 business day. We'll notify you when the configuration is complete. |
Test SP integration with IdP
Confirm that you are able to log in with your netID and user's attributes are properly released.
- Using a web browser, visit the /secure directory (or other protected location) of your SP.
- If you are prompted to log in, that means that your SP is properly integrated with Cornell IdP.
- After you log in, open a new tab of the same browser and point your web browser to https://<your dns name>/Shibboleth.sso/Session. Your browser should return a status page that show you all the attributes and values released to your SP.
FAQ
Expand | ||
---|---|---|
| ||
"Looping" refers to a situation in which an attempt to login to the SP results in a rapid cycle of redirections between the IdP and the SP with a new session created every time around. Please follow the instructions from Shibboleth WIKI page to troubleshoot. |
Expand | ||
---|---|---|
| ||
If possible snap shot your Windows server before you make any changes. When integrating your website with Shibboleth, you will need to submit a Shibboleth integration request form. After IDM receive the request, your SP's metadata will be configured in Cornell Identity Provider(IDP). It may take as long as one business day for IDM to complete your request. Before your SP's metadata is loaded in IDP, shibboleth authentication won't work. To avoid the long down time of your production website, we recommend you make the transition in two steps and make the changes during maintenance hours. <ISAPI normalizeRequest="true" safeHeaderNames="true"> <! – <Site id="1" name="shibtest1.cit.cornell.edu"/ > --> <! – <Site id="2" name="shibtest2.cit.cornell.edu"/ > → </ISAPI>
|
Code Block | ||||
---|---|---|---|---|
| ||||
In our example, SP's metadata can be obtained from https://shibtest.cit.cornell.edu/Shibboleth.sso/Metadata. In the metadata there should be a line:
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://shibtest.cit.cornell.edu/Shibboleth.sso/SAML2/POST" index="1"/>
Our example also have shibtest1.cit.cornell.edu defined in shibboleth2.xml, another AssertionConsumerService url for shibtest1.cit.cornell.edu need to be manually added in the metadata:
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://shibtest1.cit.cornell.edu/Shibboleth.sso/SAML2/POST" index="2"/> |
- Save your metadata file. You'll need to submit your SP's metadata in shibboleth integration request form.
Expand | ||
---|---|---|
| ||
If your site is configured with test IDP, you don't have to submit Shibboleth integration request form because test IDP supports anonymous SP. You can start testing the authentication of your site. For sites configured with prod IDP, submit your shibboleth integration request from https://shibrequest.cit.cornell.edu. On the second page of request form, select 'No' for question "Has the application service provider's metadata been published with InCommon?". Use text editor open your SP's metadata, copy the content of the metadata and paste it in the "Service Provider's metadata field. Once the form is submitted, Identity Management get a Remedy case. We'll configure your SP in prod IDP in 1 - 2 business day. We'll notify you when the configuration is complete. |
Test SP integration with IdP
Confirm that you are able to log in with your netID and user's attributes are properly released.
- Using a web browser, visit the /secure directory (or other protected location) of your SP.
- If you are prompted to log in, that means that your SP is properly integrated with Cornell IdP.
- After you log in, open a new tab of the same browser and point your web browser to https://<your dns name>/Shibboleth.sso/Session. Your browser should return a status page that show you all the attributes and values released to your SP.
FAQ
Expand | ||
---|---|---|
| ||
"Looping" refers to a situation in which an attempt to login to the SP results in a rapid cycle of redirections between the IdP and the SP with a new session created every time around. Please follow the instructions from Shibboleth WIKI page to troubleshoot. |
Expand | ||
---|---|---|
| ||
coming ... |
Expand | ||
---|---|---|
| ||
By default, Shibboleth attributes that released to your shibboleth SP are available to your application as server variables, not available in HTTP headers. But not all the server/module expose custom server variables to application, for example .asp. It's dangerous using HTTP headers. If you have to get Shibboleth attributes from HTTP header, you could enable it by adding useHeaders=”true” in <ISAPI tag>. In your application, you should always get authenticated user's netID from server variable REMOTE_USER. Detail and examples about attribute access https://wiki.shibboleth.net/confluence/display/SP3/AttributeAccess SpoofChecking if using HTTP headers https://wiki.shibboleth.net/confluence/display/SP3/SpoofChecking |
...
contact idmgmt@cornell.edu