...
Apache must be installed and your website have an SSL certificate installed and SSL enabled. To request a SSL certificate: https://it.cornell.edu/ssl/renew-or-request-ssl-certificate.
Installation
Follow instruction on https://wiki.shibboleth.net/confluence/display/SP3/RPMInstall to install Shibboleth.
...
| Expand |
|---|
| title | Update Access Control shib.conf |
|---|
|
Open /etc/httpd/conf.d/shib.conf in a text editor. If you are Not using default Apache installation, make sure this file is included in your Apache config. All the authorization rules should be defined in this file. | Code Block |
|---|
| title | Require authentication for entire site |
|---|
| <Location />
AuthType shibboleth
ShibRequestSetting requireSession 1
Require valid-user
</Location>
|
| Code Block |
|---|
| title | Authorization by affiliation |
|---|
| <Location /studentOnly>
AuthType shibboleth
ShibRequestSetting requireSession 1
Require shib-attr eduPersonPrimaryAffiliation student
</Location>
<Location /secure>
AuthType shibboleth
ShibRequestSetting requireSession 1
Require shib-attr eduPersonAffiliations staff
</Location>
*eduPersonPrimaryAffiliation is single value attribute while eduPersonAffiliations is multi-values attribute.
For example, a staff who also taking courses at Cornell has staff as the value of eduPersonPrimaryAffiliation, has staff and student as the value of eduPersonAffiliations.
All the possible value of affiliations can be found at https://confluence.cornell.edu/display/IDM/edupersonprimaryaffiliation+and+edupersonaffiliation+details |
| Code Block |
|---|
| title | Authorization by group/permit |
|---|
| <Location /secure>
AuthType shibboleth
ShibRequestSetting requireSession 1
Require shib-attr groups myGroup1 myGroup2
</Location> |
| Code Block |
|---|
| title | Require TwoFactor for everyone |
|---|
| <Location /superSecret>
AuthType shibboleth
ShibRequestSetting authnContextClassRef http://cornell.edu/mfa
ShibRequestSetting requireSession 1
Require shib-attr groups mySecureGroup
</Location> |
|
Start Shibboleth Service Provider and Apache
...
- Using a web browser, visit the /secure directory (or other protected location) of your SP.
- If you are prompted to log in, that means that your SP is properly integrated with Cornell IdP.
- After you log in, open a new tab of the same browser and point your web browser to https://<your dns name>/Shibboleth.sso/Session. Your browser should return a status page that show you all the attributes and values released to your SP.
...
