You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 10 Next »

This document describes the procedure used to install Shibboleth Service Provider (SP) software on Windows Server and Internet Information Server (IIS), and to configure it to work with the Cornell Shibboleth Identity Provider (IdP).

Prerequisites

The IIS website must have an appropriate SSL certificate installed and SSL enabled.  Shibboleth Service Provider 3.x software supports Windows Server 2008 and later, and installers are available for both 32-bit and 64-bit systems.  Shibboleth 3.x supports the versions of the IIS web server that are provided with the supported Windows versions.

Installation Steps

  1. Install the MS Visual C++ re-distributable libraries. You need to restart the server after the installation.

    These links may break at some point, but for now the 32-bit and 64-bit run times can be found at:

    The top-level link to find them is https://visualstudio.microsoft.com/downloads/ via Other Tools.

  2. Run Shibboleth SP Windows installer

    2.1  Download the latest version of the Windows installer package from the Shibboleth download site at https://shibboleth.net/downloads/service-provider/latest/. Select either the win32/ or win64/ directory as appropriate to your 32-bit or 64-bit system. Then download .msi file.

    2.2  Run the installer package. It is recommended that you accept all defaults, as follows:

    • Accept the license agreement
    • Install to C:\opt\shibboleth-sp - This is the default location. You may change it to other location.
    • Make sure Configure IIS7 module is checked
    • Click Next, then Install, then Finish
    • Click Yes to restart your system

  3. Verify installation

    On the Administrative Tools menu, click Services. Find Shibboleth Daemon in the list and double-click it.  Verify that Service Status is Running, Startup type is Automatic, and on the Log On tab, verify that Local System is selected.

  4. Edit Configuration files

    Go to your SP installation directory(C:\opt\shibboleth-sp if you used the default) . All the SP configuration files are in the \etc\shibboleth directory.

    4.0 Save a copy of attribute-map.xml to attribute-map.xml.orig or similar. Download our sample attribute-map.xml and replace your attribute-map.xml with downloaded file. Our attribute-map.xml defines all commonly used attribute. 

    All attributes except groups are released by default to all SP. Attribute groups is released on demand. Submit group membership requirement when you submit shibboleth integration request form. Find all the default attributes released by Cornell IDP from Shibboleth at Cornell Page.

    4.1 Save a copy of shibboleth2.xml to shibboleth2.xml.orig or similar. Download our sample shibboleth2.xml and replace your shibboleth2.xml with downloaded shibboleth2.xml
    4.2 Open shibboleth2.xml.

    Find <ISAPI...>...<Site id="1" name="shibtest.cit.cornell.edu"/>. Change the site id to match the id assigned to your site by IIS. You can find your site id in Internet Services (IIS) Manager by clicking on "Sites". In this same location, change the site name to your DNS name. Our example defined two sites. Delete or add more as your need.

    4.3 Find <RequestMap>...<Host name="shibtest.cit.cornell.edu">. Change the name to the site name you defined in step 4.2. In our example files, we defined two hosts and specifies different authorization rules for each site and location. Please modify it to meet your site requirement.

    4.4 Find <ApplicationDefaults entityID="shibtestsites.cit.cornell.edu" ...> Change the entityID to whatever you like. EntityID is the name of your SP. Each SP should have unique name. It's better not include space or special characters in it( / or : are fine).

    4.5 Find  < Errors supportContact ="root@localhost"  helpLocation ="/about.html" styleSheet ="/shibboleth-sp/main.css"  />  and change the email address to your application's support email address.

    Skip 4.6, 4.7 if you are configuring a production site

    4.6 Find <SSO entityID="https://shibidp.cit.cornell.edu/idp/shibboleth">. If this is test/dev site, configured it with Cornell test IDP. When configure with test IDP, replace the entityID with https://shibidp-test.cit.cornell.edu/idp/shibboleth

    4.7  Find <MetadataProvider ... url="https://shibidp.cit.cornell.edu/idp/shibboleth" ..>. This is the metadata for production IDP. Comment out this block for your test site. Then un-comment MetadataProvider for Cornell test IDP.

    4.8 Save shibboleth2.xml.

    4.13  Use Internet Services (IIS) Manager to restart IIS and Administrative Tools > Services to restart the Shibboleth 2 Daemon.

  5. Verify the configuration

    Running the code below from the command line: 

     

    %SHIBSP_PREFIX%/sbin/shibd.exe -check

    If the last line of the output is the following message, everything is as expected:

    overall configuration is loadable, check console for non-fatal problems

     

    4.15  Download your SP metadata from https://<your dns name>/Shibboleth.sso/Metadata. Depending on your OS and browser, the metadata might be displayed in the browser or you might be asked to save the file. If you save the file with a .xml file extension and open the file in your browser it will be easier to read. Make sure there are no instances of sp.example.org in the URLs; any such references should have been replaced by your DNS name.  The file will contain a warning about reviewing the contents of the file and not supplying it in real time–that's normal.  Checking for sp.example.org counts as review, and our registry doesn't monitor the contents of that file after the initial registration (i.e. not real time).

  • No labels