Page History

...

• Shibboleth Service Provider 3.x software supports Windows Server 2008 and later, and installers are available for both 32-bit and 64-bit systems.  Shibboleth 3.x supports the versions of the IIS web server that are provided with the supported Windows versions.
• The IIS website must have an appropriate SSL certificate installed and SSL enabled.  To request a SSL certificate: https://it.cornell.edu/ssl/renew-or-request-ssl-certificate
• If you have any URL rewrite rules defined in IIS, make sure those rules do not apply to Shibboleth.sso path. Or you can add this rule at the top of all the other rules that will stop redirecting any request for /Shibboleth.sso
• 

Installation

1. Install the MS Visual C++ re-distributable libraries. You need to restart the server after the installation.

   These links may break at some point, but for now the 32-bit and 64-bit run times can be found at:

   • https://aka.ms/vs/15/release/VC_redist.x86.exe

   • https://aka.ms/vs/15/release/VC_redist.x64.exe

   The top-level link to find them is https://visualstudio.microsoft.com/downloads/ via Other Tools.

2. Run Shibboleth SP Windows installer

   2.1  Download the latest version of the Windows installer package from the Shibboleth download site at https://shibboleth.net/downloads/service-provider/latest/. Select either the win32/ or win64/ directory as appropriate to your 32-bit or 64-bit system. Then download .msi file.

   2.2  Run the installer package. It is recommended that you accept all defaults, as follows:

   • Accept the license agreement
   • Install to C:\opt\shibboleth-sp ( this is the default location. You may change it to other location.)

   • Make sure Configure IIS7 module is checked
   • Click Next, then Install, then Finish
   • Click Yes to restart your system
     
     

3. Verify installation

   On the Administrative Tools menu, click Services. Find Shibboleth Daemon in the list and double-click it.  Verify that Service Status is "Running", Startup type is "Automatic", and on the Log On tab, verify that "Local System" is selected.

...

• • Update IDP info if you are configuring a test/dev site( skip this if you are configuring production site )
    Find <SSO entityID="https://shibidp.cit.cornell.edu/idp/shibboleth">.Replace our production IDP's entityID with test IDP's entityID: https://shibidp-test.cit.cornell.edu/idp/shibboleth
    Find <MetadataProvider ... url="https://shibidp.cit.cornell.edu/idp/shibboleth" ..>. This is production IDP's metadata url. Comment out this block for your test site. Then un-comment MetadataProvider for Cornell test IDP.
    Save shibboleth2.xml.

...

3. Verify the ConfiguationConfiguration

Go to your SP installation directory(default C:\opt\shibboleth-sp), cd to /sbin64 or /sbin directory as appropriate to your 64-bit or 32-bit system. Running the code below from the command line:

shibd.exe -check

• • As Shibboleth requires a certificate and key to encrypt and decrypt attribute assertions, an X509 certificate must be installed for it to work. Now that the shibboleth2.xml file has been updated, use the keygen.bat command in C:\opt\shibboleth-sp\etc\shibboleth to create new certificates with the hostname(server name) and entityID. Use the following format:

    Code Block
    language text
    keygen.bat -h idmwebserver.cit.cornell.edu -e entityID -y number of years to issue

    where the values for each are substituted accordingly

    Code Block
    title Example
    keygen.bat -h idmwebserver.cit.cornell.edu -e shibtestsites.cit.cornell.edu -y 10

    The 10 indicates the number of years for which the certificate is issued. You may specify a different value.

  • Generate SP metadata

    7.1 Restart IIS and the Shibboleth Daemon. The Shibboleth Daemon can be restarted using the Administrative Tools > Services navigation.

    7.2 Navigate to https://yoursiteDomain/Shibboleth.sso/Metadata and download it.
    7.3 Open your downloaded file with text editor. Make sure the entityID is the same as your defined in shibboleth2.xml. If there are multiple sites in IIS require Shibboleth authentication and you define them in shibboleth2.xml, you need to manually add consumer service url for each site in your SP's metadata.       

    For example, I get my SP's metadata from https://shibtest.cit.cornell.edu/Shibboleth.sso/Metadata,  in the metadata there should be a line like this:

    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://shibtest.cit.cornell.edu/Shibboleth.sso/SAML2/POST" index="1"/>

    I also have shibtest1.cit.cornell.edu defined in shibboleth2.xml, I need to add AssertionConsumerService url for shibtest1.cit.cornell.edu like this

     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://shibtest1.cit.cornell.edu/Shibboleth.sso/SAML2/POST" index="2"/>

    Save your metadata file. You'll need to submit your SP's metadata in shibboleth integration request form.

  • Register Service Provider with Cornell Identity Provider

    If your site is configured with test IDP, you don't have to submit Shibboleth integration request form because test IDP supports anonymous SP. You can start testing the authentication of your site.

    For sites configured with prod IDP, submit your shibboleth integration request from https://shibrequest.cit.cornell.edu. On the second page of request form, select 'No' for question "Has the application service provider's metadata been published with InCommon?".  Use text editor open your SP's metadata, copy the content of the metadata and paste it in the request form.Once the form is submitted, Identity Management get a Remedy case. We'll configure your SP in prod IDP in 1 - 2 business day. We'll notify you when the configuration is complete.

  • Test SP integration with IdP

    Confirm that you are able to log in with your netID and that attributes are properly released.

    1. Using a web browser, visit the /secure directory (or other protected location) of your SP.
    2. If you are prompted to log in, that means that your SP is properly integrated with Cornell IdP.
    3. After you log in, open a new tab of the same browser and point your web browser to https://<your dns name>/Shibboleth.sso/Session.  Your browser should return a status page that show you all the attributes and values released to your SP.

...