...
Go to your SP installation directory(C:\opt\shibboleth-sp if you use the default) . All the SP configuration files are in the \etc\shibboleth directory.
- Update attribute-map.xml
Save a copy of attribute-map.xml to attribute-map.xml.orig or similar. Download our sample attribute-map.xml and replace your attribute-map.xml with downloaded file. Our attribute-map.xml defines all commonly used attributes.
All attributes except groups are released by default to all SP. Attribute "groups" is released on demand. Submit group membership requirement when you submit shibboleth integration request form. Find all the default attributes released by Cornell IDP from Shibboleth at Cornell Page. Edit attribute-map.xml as needed.
2. Update Shibboleth2.xml
...
Save a copy of shibboleth2.xml to shibboleth2.xml.orig or similar. Download our sample shibboleth2.xml and replace your shibboleth2.xml with downloaded shibboleth2.xml. Open shibboleth2.xml in a text editor.
...
- Update the site ID and name:
Find <ISAPI...>...<Site id="1" name="shibtest.cit.cornell.edu"/>. Change the "site id" to match the id assigned to your site by IIS. You can find your site id in Internet Services (IIS) Manager by clicking on "Sites". In this same location, change the site name to your DNS name. Our example defined two sites. Delete or add more as needed.
...
- Update the host name:
Find <RequestMap>...<Host name="shibtest.cit.cornell.edu">. Change the name to the site name you defined in step
...
above.
...
In our example files, we defined two hosts and specifies different authorization rules for each site and location. Please modify it to meet your site requirement. Additional resources for AccessControl: https://wiki.shibboleth.net/confluence/display/SP3/XMLAccessControl
| Info |
|---|
| Keep in mind Shibboleth IDP doesn't support nested groups( for example group B is a member of group A, user C is a member of group B, IDP doesn't know user C is a member of group A) . If you have to use nested group, you need to convert nested group to dynamic group. |
If your site supports both http and https, don't forget add redirectToSSL="443" in Host element because shibboleth SP doesn't work with http connection.
4.4 Update SP entityID:
Find <ApplicationDefaults entityID="shibtestsites.cit.cornell.edu" ...> Change the entityID to whatever you like. EntityID is the name of your SP. Each SP should have unique name. It's better not include space or special characters in it( / or : are fine).
...