Versions Compared

Old Version 50

changes.mady.by.user Hong Ye

Saved on

compared with

New Version 51

changes.mady.by.user Hong Ye

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Expand
titleUpdate Shibboleth2.xml

Save a copy of shibboleth2.xml to shibboleth2.xml.orig or similar. Download our sample shibboleth2.xml and replace your shibboleth2.xml with downloaded shibboleth2.xml. Open shibboleth2.xml in a text editor.

    • Update the site ID and name:

Find <ISAPI...>...<Site id="1" name="shibtest.cit.cornell.edu"/>. Change the "site id" to match the id assigned to your site by IIS. You can find your site id in Internet Services (IIS) Manager by clicking on "Sites". In this same location, change the site name to your DNS name. Our example defined two sites. Delete or add more as needed.

    • Update the host name:

Find <RequestMap>...<Host name="shibtest.cit.cornell.edu">. Change the "Host name" to the site name you defined in step above. In our example files, we defined two hosts and specifies different authorization rules for each site and location. Please modify it to meet your site requirement. Additional resources for AccessControl: https://wiki.shibboleth.net/confluence/display/SP3/XMLAccessControl

Info

Shibboleth IDP doesn't support nested groups( for example group B is a member of group A, user C is a member of group B, IDP doesn't know user C is a member of group A) . If you have to use nested group, you need to convert nested group to dynamic group.

If your site supports both http and https, add redirectToSSL="443" in Host element because shibboleth SP doesn't work with http connection.

    • Update SP entityID:

Find <ApplicationDefaults entityID="shibtestsites.cit.cornell.edu" ...>. Change the "entityID" to whatever you like. EntityID is the name of your SP and should be unique. We recommend you include domain name in entityID to guarantee it is unique. It's better not include space or special characters in it( / or : are fine). 

    • Update the support contact:

Find  < Errors supportContact ="root@localhost"  helpLocation ="/about.html" styleSheet ="/shibboleth-sp/main.css"  />. Change the email address to your application's support email address.

Info
Whenever you make changes to SP's configuration file, save the file. You can wait for the Shibboleth Daemon to pick up the changes or you can restart the Shibboleth Daemon to make the changes take effect right away.

 3.

Expand
titleVerify the Configuration

Go to your SP installation directory(default C:\opt\shibboleth-sp), cd to /sbin64 or /sbin directory as appropriate to your 64-bit or 32-bit system. Running the code below from the command line:

 

Code Block
languagetext
shibd.exe -check

If the last line of the output is the following message, everything is as expected:

"overall configuration is loadable, check console fornon-fatal problems"

If there is error, check log for detail. All the log files are in SP installation directory\var\log\shibboleth

Expand
title

...

Install X509 Certificate

As Shibboleth requires a certificate and key to encrypt and decrypt attribute assertions, an X509 certificate must be installed for it to work. Now that the shibboleth2.xml file has been updated, use the keygen.bat command in C:\opt\shibboleth-sp\etc\shibboleth to create new certificates with the hostname(server name) and entityID. Use the following format:

Code Block
languagetext
keygen.bat -h idmwebserver.cit.cornell.edu -e entityID -y number of years to issue

where the values for each are substituted accordingly

Code Block
titleExample
keygen.bat -h idmwebserver.cit.cornell.edu -e shibtestsites.cit.cornell.edu -y 10

The 10 indicates the number of years for which the certificate is issued. You may specify a different value.

 

5. Get SP metadata

Restart IIS and the Shibboleth Daemon. The Shibboleth Daemon can be restarted using the Administrative Tools > Services navigation.

...