Save a copy of shibboleth2.xml to shibboleth2.xml.orig or similar. Download our sample shibboleth2.xml and replace your shibboleth2.xml with downloaded file. Open shibboleth2.xml in a text editor. - Update the site ID and name:
Find <ISAPI...>...<Site id="1" name="shibtest.cit.cornell.edu"/>. Change the "site id" to match the id assigned to your site by IIS. You can find your site id in Internet Services (IIS) Manager by clicking on "Sites". In this same location, change the site name to your website domain name. Our example defined two sites. Delete or add more as needed. | Info |
|---|
| title | HTTP Header Variables |
|---|
| It is not safe to use HTTP header variables. Shibboleth SP 3 do not pass attributes as HTTP headers by default. If your applications look up attributes from HTTP headers, it is recommended switching to use server variables. If you have to use HTTP header variables, refer to https://wiki.shibboleth.net/confluence/display/SP3/ISAPI for instruction.
|
Find <RequestMap>...<Host name="shibtest.cit.cornell.edu">. Change the "Host name" to the site name you defined in step above. In this example file, we defined two hosts and specifies different authorization rules for each site and location. Please modify it to meet your site requirement. If your site supports both http and https, add redirectToSSL="443" in Host element because shibboleth SP doesn't work with http connection. | Info |
|---|
If you use group for authorization, please note group membership is not released by default. Please specify your group names in Shibboleth Integration Request form. Shibboleth IDP doesn't support nested groups( for example group B is a member of group A, user C is a member of group B, IDP doesn't know user C is a member of group A) . If you have to use nested group, you need to convert nested group to dynamic group. |
| Code Block |
|---|
| title | Example: Entire website require authentication and allow valid-user |
|---|
| <Host name="xxx" authType="shibboleth" requireSession="true" redirectToSSL="443" /> |
| Code Block |
|---|
| title | Example: certain path require authentication and allow valid-user |
|---|
| <Host name="xxx" redirectToSSL="443" />
<Path name="special" authType="shibboleth" requireSession="true" />
</Host> |
| Code Block |
|---|
| title | Example: different authorizaiton rules |
|---|
| <Host name="xxx" redirectToSSL="443" />
<!-- authorization by NetID -->
<Path name="special" authType="shibboleth" requireSession="true">
<AccessControl>
<Rule require="uid">jy98 mop29</Rule>
</AccessControl>
</Path>
<!-- authorization by group/permit -->
<Path name="students" authType="shibboleth" requireSession="true">
<AccessControl>
<Rule require="groups">cit.idm CIT-IDM-test</Rule>
</AccessControl>
</Path>
<!-- authorization by user's affiliation.Possible value of affiliation: affiliate, alum, faculty, employee, staff, student -->
<Path name="students" authType="shibboleth" requireSession="true">
<AccessControl>
<Rule require="affiliations">employee student</Rule>
</AccessControl>
</Path>
</Host> |
| Code Block |
|---|
| title | Example: sub level path has different authorization rule |
|---|
| <!-- /secure require certain netID. /special/doc require group cit.idm -->
<Path name="secure" authType="shibboleth" requireSession="true">
<AccessControl>
<Rule require="uid">jy98 mop29</Rule>
</AccessControl>
<Path name="doc">
<AccessControl>
<Rule require="groups">cit.idm</Rule>
</AccessControl>
</Path>
</Path> |
| Code Block |
|---|
| title | Example: Force Everyone with TwoFactor |
|---|
| <Path name="secure" authType="shibboleth" authnContextClassRef="httphttps://cornellrefeds.eduorg/profile/mfa" requireSession="true" /> |
Find <ApplicationDefaults entityID="https://shibtest.cit.cornell.edu/shibboleth" ...>. EntityID is the unique identifier for your SP. Cornell Shibboleth Identity Provider(IDP) provides service to many applications. This entityID will help Cornell IDP to identify your SP. We recommend you follow shibboleth convention named it "https://yourDomainName/shibboleth". It's better not include space or special characters in it( / or : are fine). You can use one entityID for all your sites hosted in the same IIS. - Update the support contact:
Find < Errors supportContact ="root@localhost" helpLocation ="/about.html" styleSheet ="/shibboleth-sp/main.css" /> . Change the email address to your application's support email address. - Update IDP info if you are configuring a test/dev site( skip this if you are configuring production site )
Find <SSO entityID=" https://shibidp.cit.cornell.edu/idp/shibboleth ">.Replace our production IDP's entityID with test IDP's entityID: https://shibidp-test.cit.cornell.edu/idp/shibboleth Find <MetadataProvider ... url=" https://shibidp.cit.cornell.edu/idp/shibboleth " ..>. This is production IDP's metadata url. Comment out this block for your test site. Then un-comment MetadataProvider for Cornell test IDP. | 
