...
Expand | ||
---|---|---|
| ||
Save a copy of attribute-map.xml to attribute-map.xml.orig or similar. Download our sample attribute-map.xml and replace your attribute-map.xml with downloaded file. Our attribute-map.xml defines all commonly used attributes. All attributes except groups are released by default to all SP. Attribute "groups" is released on demand. Submit group membership requirement when you submit shibboleth integration request form. Find all the default attributes released by Cornell IDP from Shibboleth at Cornell Page. Edit attribute-map.xml as needed |
Expand | ||||
---|---|---|---|---|
| ||||
Save a copy of
Find <ISAPI...>...<Site id="1" name="shibtest.cit.cornell.edu"/>. Change the "site id" to match the id assigned to your site by IIS. You can find your site id in Internet Services (IIS) Manager by clicking on "Sites". In this same location, change the site name to your DNS name. Our example defined two sites. Delete or add more as needed.
Find <RequestMap>...<Host name="shibtest.cit.cornell.edu">. Change the "Host name" to the site name you defined in step above. In our example files, we defined two hosts and specifies different authorization rules for each site and location. Please modify it to meet your site requirement. Additional resources for AccessControl: https://wiki.shibboleth.net/confluence/display/SP3/XMLAccessControl
Find <ApplicationDefaults entityID="shibtestsites.cit.cornell.edu" ...>. Change the "entityID" to whatever you like. EntityID is the name of your SP and should be unique. We recommend you include domain name in entityID to guarantee it is unique. It's better not include space or special characters in it( / or : are fine).
Find < Errors supportContact ="root@localhost" helpLocation ="/about.html" styleSheet ="/shibboleth-sp/main.css" />. Change the email address to your application's support email address.
|
Expand | |||||
---|---|---|---|---|---|
| |||||
Go to your SP installation directory(
"overall configuration is loadable, check console for non-fatal problems" If there is error, check log for detail. All the log files are in SP installation directory\var\log\shibboleth |
Expand | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
As Shibboleth requires a certificate and key to encrypt and decrypt attribute assertions, an X509 certificate must be installed for it to work. Now that the shibboleth2.xml file has been updated, use the keygen.bat command in C:\opt\shibboleth-sp\etc\shibboleth to create new certificates with the hostname(server name) and entityID. Use the following format:
where the values for each are substituted accordingly
The 10 indicates the number of years for which the certificate is issued. You may specify a different value. |
Info |
---|
Whenever you make changes to SP's configuration file, save the file. You can wait for the Shibboleth Daemon to pick up the changes or you can restart the Shibboleth Daemon to make the changes take effect right away. |
5. Get SP metadata
Restart IIS and the Shibboleth Daemon. The Shibboleth Daemon can be restarted using the Administrative Tools > Services navigation.
...