Page History

...

Expand

title	Update shibboleth2.xml

Download our sample shibboleth2.xml and replace your /etc/shibboleth/shibboleth2.xml with downloaded file. Open shibboleth2.xml in a text editor.

Update SP entityID:

Find <ApplicationDefaults entityID="https://mysite.cit.cornell.edu/shibboleth"... >. EntityID is the Unique identifier for your SP. Cornell Shibboleth Identity Provider(IDP) provides service to many applications. This entityID will help Cornell IDP to identify your SP. We recommend you follow shibboleth convention named it "https://xxx/shibboleth". It's better not include space or special characters in it( / and : are fine). One SP can server multiple sites in your Apache so it does not necessarily equate to the hostname(s) at which your service runs.

Update the support contact:

Find < Errors supportContact ="root@localhost" helpLocation ="/about.html" styleSheet ="/shibboleth-sp/main.css" /> . Change the email address to your application's support email address.

Update IDP info if you are configuring a test/dev site( skip this if you are configuring production site )

Find <SSO entityID=" https://shibidp.cit.cornell.edu/idp/shibboleth ">.Replace our production IDP's entityID with test IDP's entityID: https://shibidp-test.cit.cornell.edu/idp/shibboleth

Find <MetadataProvider ... url=" https://shibidp.cit.cornell.edu/idp/shibboleth " ..>. This is production IDP's metadata url. Comment out this block for your test site. Then un-comment MetadataProvider for Cornell test IDP.

Check if you have sp-signing-cert.pem and sp-encrypt-cert.pem in /etc/shibboleth directory. If they are not there, generate them.
Code Block
title generate a 10 year signing key
shib-keygen -n sp-signing -h yourServername -y 10 (your servername will be the CN of the certificate)
Code Block
title generate 10 year encryption key
shib-keygen -n sp-encrypt -h yourServername -y 10

Expand

title	Update Access Control shib.conf

Open /etc/httpd/conf.d/shib.conf in a text editor. If you are Not using default Apache installation, make sure this file is included in your Apache config. All the authorization rules should be defined in this file.

Code Block

title	Require authentication for entire site

<Location />
AuthType shibboleth
ShibRequestSetting requireSession 1
Require valid-user
</Location>

Code Block

title	Authorization by affiliation

<Location /studentOnly>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  Require shib-attr eduPersonPrimaryAffiliation student
</Location>

<Location /secure>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  Require shib-attr eduPersonAffiliations staff
</Location>

*eduPersonPrimaryAffiliation is single value attribute while eduPersonAffiliations is multi-values attribute. 
For example, a staff who also taking courses at Cornell has staff as the value of eduPersonPrimaryAffiliation, has staff and student as the value of eduPersonAffiliations. 
All the possible value of affiliations can be found at https://confluence.cornell.edu/display/IDM/edupersonprimaryaffiliation+and+edupersonaffiliation+details

Code Block

title	Authorization by group/permit

<Location /secure>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  Require shib-attr groups myGroup1 myGroup2
</Location>

Code Block

title	Authorization by NetID

<Location /secure>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  Require shib-attr uid hjy789 jpq2020
</Location>

Code Block

title	Require TwoFactor for everyone

<Location /superSecret>
  AuthType shibboleth
  ShibRequestSetting authnContextClassRef http://cornell.edu/mfa
  ShibRequestSetting requireSession 1
  Require shib-attr groups mySecureGroup
</Location>

...

Child pages

Versions Compared

Old Version 37

New Version 38

Key