This document describes the procedure used to install Shibboleth Service Provider (SP) software on Centos/RedHat, and to configure it to work with the Cornell Shibboleth Identity Provider (IdP).
Prerequisites
Apache must be installed and your website have an SSL certificate installed and SSL enabled.
After installation Shibboleth configuration files will be placed at /etc/shibboleth/ and the necessary Apache configuration in /etc/httpd/conf.d/shib.conf.
Download our sample attribute-map.xmland replace your /etc/shibboleth/attribute-map.xml with downloaded file. Our attribute-map.xml defines all commonly used attributes.
All attributes except groups defined in attribute-map.xml are released by default to all SP. Attribute "groups" is released on demand. Submit group membership requirement when you submit shibboleth integration request form. Edit attribute-map.xml as needed.
Download our sample shibboleth2.xml and replace your /etc/shibboleth/shibboleth2.xml with downloaded file. Open shibboleth2.xml in a text editor.
Update SP entityID:
Find <ApplicationDefaults entityID="https://mysite.cit.cornell.edu/shibboleth"... >. EntityID is the Unique identifier for your SP. Cornell Shibboleth Identity Provider(IDP) provides service to many applications. This entityID will help Cornell IDP to identify your SP. We recommend you follow shibboleth convention named it "https://xxx/shibboleth". It's better not include space or special characters in it( / and : are fine). One SP can server multiple sites in your Apache so it doesnotnecessarily equate to the hostname(s) at which your service runs.
Update the support contact:
Find <ErrorssupportContact="root@localhost" helpLocation="/about.html"styleSheet="/shibboleth-sp/main.css" />. Change the email address to your application's support email address.
Update IDP info if you are configuring a test/dev site( skip this if you are configuring production site )
Find <MetadataProvider ... url="https://shibidp.cit.cornell.edu/idp/shibboleth" ..>. This is production IDP's metadata url. Comment out this block for your test site. Then un-comment MetadataProvider for Cornell test IDP.
Open /etc/httpd/conf.d/shib.conf in a text editor. If you are Not using default Apache installation, make sure this file is included in your Apache config. All the authorization rules should be defined in this file.
<Location /studentOnly>
AuthType shibboleth
ShibRequestSetting requireSession 1
Require shib-attr eduPersonPrimaryAffiliation student
</Location>
<Location /secure>
AuthType shibboleth
ShibRequestSetting requireSession 1
Require shib-attr eduPersonAffiliations staff
</Location>
*eduPersonPrimaryAffiliation is single value attribute while eduPersonAffiliations is multi-values attribute.
For example, a staff who also taking courses at Cornell has staff as the value of eduPersonPrimaryAffiliation, has staff and student as the value of eduPersonAffiliations.
All the possible value of affiliations can be found at https://confluence.cornell.edu/display/IDM/edupersonprimaryaffiliation+and+edupersonaffiliation+details
shibd is installed to /usr/sbin and may be managed using service and chkconfig (on System V platforms) or with systemctl (on systemd platforms, some additional information available).
On Centos 7, you can start it by running
sudo systemctl start shibd
sudo systemctl start httpd
After you run the command, make sure shibd and httpd are running. Logs for Shibboleth SP are located at /var/log/shibboleth/. Take a look at /var/log/shibboleth/shibd_warn.log and make sure there is no error in there. You need to fix error if there is any and restart shibd and httpd.
Register Service Provider with Cornell IDP
Navigate to https://yoursiteDomain/Shibboleth.sso/Metadata and download it.Open your downloaded file with text editor. Make sure the entityID is the same as your defined in shibboleth2.xml. If there are multiple sites in Apache require Shibboleth authentication and you define them in shibboleth2.xml, you need to manually add consumer service url for each site in your SP's metadata.