Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
docpublic:systemes:shibboleth:idpv2x [2014/04/05 13:00] procacci@tem-tsp.eu [chargement metadonnée fédération] |
docpublic:systemes:shibboleth:idpv2x [2014/05/19 14:00] (current) procacci@tem-tsp.eu [publication des metadata] |
||
|---|---|---|---|
| Line 423: | Line 423: | ||
| a ce niveau, on peux tester l'IDP via *idp/ | a ce niveau, on peux tester l'IDP via *idp/ | ||
| - | http://shibidp3.it-sudparis.eu/ | + | http://yourIDPhostname.domain.tld/ |
| qui retourne un simple *OK* | qui retourne un simple *OK* | ||
| + | |||
| + | status detaillé sur http:// | ||
| ===== Parametrage de l'IDP ===== | ===== Parametrage de l'IDP ===== | ||
| Line 505: | Line 507: | ||
| </ | </ | ||
| </ | </ | ||
| + | |||
| + | |||
| + | autrement on a au chargement de l'IDP une erreur de ce type | ||
| + | |||
| + | < | ||
| + | 15: | ||
| + | </ | ||
| + | |||
| + | |||
| + | ==== URLs locales Metadata + Status ==== | ||
| + | |||
| + | Test d' | ||
| + | |||
| + | * http:/// | ||
| + | |||
| + | Test de fonctionnement (status) de l'IDP | ||
| + | |||
| + | * http:// | ||
| + | * http:// | ||
| ==== troubelshooting ==== | ==== troubelshooting ==== | ||
| Line 570: | Line 591: | ||
| - | ==== Metadata pour Féderation Renater-Test ==== | ||
| - | |||
| - | https:// | ||
| - | |||
| - | < | ||
| - | [root@shibidp3 metadata]# wget https:// | ||
| - | [root@shibidp3 metadata]# chown tomcat renater-test-metadata.xml | ||
| - | </ | ||
| - | |||
| - | Téléchargez le certificat utilisé pour signer les méta-données de REnater : | ||
| - | |||
| - | < | ||
| - | [root@shibidp3 credentials]# | ||
| - | |||
| - | </ | ||
| - | |||
| - | Configuration de Renater-test comme provider de metadata toujours dans *relying-party.xml* | ||
| - | |||
| - | < | ||
| - | ... | ||
| - | <!-- MetaData fede Test Renater --> | ||
| - | < | ||
| - | metadataURL=" | ||
| - | backingFile="/ | ||
| - | < | ||
| - | < | ||
| - | | ||
| - | < | ||
| - | trustEngineRef=" | ||
| - | requireSignedMetadata=" | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | </ | ||
| - | </ | ||
| - | </ | ||
| - | |||
| - | |||
| - | ... | ||
| - | <!-- ========================================== --> | ||
| - | < | ||
| - | <!-- ========================================== --> | ||
| - | |||
| - | |||
| - | <!-- Trust engine used to evaluate the signature on loaded metadata. --> | ||
| - | < | ||
| - | |||
| - | |||
| - | <!-- Confiance certificat metaData REnater --> | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | </ | ||
| - | |||
| - | < | ||
| - | |||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Test d' | ||
| - | |||
| - | http:// | ||
| - | |||
| - | Test de fonctionnement (status) de l'IDP | ||
| - | |||
| - | http:// | ||
| - | |||
| - | ==== Metada fédération Renater ==== | ||
| - | |||
| - | https:// | ||
| - | |||
| - | < | ||
| - | [root@shibidp1 / | ||
| - | $ wget https:// | ||
| - | </ | ||
| - | |||
| - | < | ||
| - | [root@shibidp1 / | ||
| - | $ vim relying-party.xml | ||
| - | ... | ||
| - | < | ||
| - | metadataURL=" | ||
| - | backingFile="/ | ||
| - | < | ||
| - | < | ||
| - | maxValidityInterval=" | ||
| - | < | ||
| - | trustEngineRef=" | ||
| - | requireSignedMetadata=" | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | </ | ||
| - | </ | ||
| - | ... | ||
| - | |||
| - | < | ||
| - | <!-- ========================================== --> | ||
| - | < | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | |||
| - | < | ||
| - | < | ||
| - | |||
| - | |||
| - | <!-- Confiance certificat metaData REnater --> | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | |||
| - | |||
| - | <!-- Confiance certificat metaData CruTest --> | ||
| - | < | ||
| - | < | ||
| - | </ | ||
| - | </ | ||
| - | </ | ||
| - | ... | ||
| - | </ | ||
| === Metadata JASIG === | === Metadata JASIG === | ||
| Line 1474: | Line 1374: | ||
| il faut activer le LoginHandler UsernamePassword dans handler.xml et commenter le LoginHnadler RemoteUser, autrement c'est ce dernier qui prend la main . | il faut activer le LoginHandler UsernamePassword dans handler.xml et commenter le LoginHnadler RemoteUser, autrement c'est ce dernier qui prend la main . | ||
| - | cf http:// | + | cf http:// |
| < | < | ||
| [root@idp / | [root@idp / | ||
| $ vim handler.xml | $ vim handler.xml | ||
| - | + | | |
| - | < | + | < |
| - | + | <!-- | |
| - | < | + | <ph:LoginHandler xsi: |
| + | < | ||
| + | </ | ||
| + | --> | ||
| + | < | ||
| + | <ph:LoginHandler xsi: | ||
| jaasConfigurationLocation=" | jaasConfigurationLocation=" | ||
| + | < | ||
| + | </ | ||
| + | |||
| </ | </ | ||
| Line 1635: | Line 1543: | ||
| </ | </ | ||
| - | ==== Attributs calculés | + | ==== Attributs calculés |
| - | === Expression Reguliere | + | === Expression Reguliere |
| Definition d'un attribut basé sur une expression reguliere | Definition d'un attribut basé sur une expression reguliere | ||
| Line 1656: | Line 1564: | ||
| </ | </ | ||
| - | === Attribut mappé | + | === Attribut mappé |
| < | < | ||
| Line 1678: | Line 1586: | ||
| </ | </ | ||
| - | === test | + | === test === |
| http:// | http:// | ||
| Line 1770: | Line 1678: | ||
| si on oublie de recopier la librairie et qu'on a par redeployer les source pour generer le war, c'est assez troublant, l'IDP semble tourné d' | si on oublie de recopier la librairie et qu'on a par redeployer les source pour generer le war, c'est assez troublant, l'IDP semble tourné d' | ||
| + | ===== changement de domain ===== | ||
| + | |||
| + | nous sommes passés de it-sudparis.eu a tem-tsp.eu ! cela implique plusieurs taches | ||
| + | |||
| + | ==== certificat interne a l'IDP ==== | ||
| + | |||
| + | https:// | ||
| + | |||
| + | < | ||
| + | [root@shibidp1 shibboleth-identityprovider-2.4.0]# | ||
| + | Buildfile: src/ | ||
| + | |||
| + | renew-cert: | ||
| + | This will create a new set of credentials for your IdP. If you ran this command previously and still have ' | ||
| + | yes | ||
| + | Where is the Shibboleth Identity Provider installed? [/ | ||
| + | |||
| + | What is the fully qualified hostname of the Shibboleth Identity Provider server? [idp.example.org] | ||
| + | idp1.tem-tsp.eu | ||
| + | A keystore is about to be generated for you. Please enter a password that will be used to protect it. | ||
| + | secret | ||
| + | Generating new signing and encryption key, certificate, | ||
| + | |||
| + | BUILD SUCCESSFUL | ||
| + | Total time: 29 seconds | ||
| + | |||
| + | [root@shibidp1 shibboleth-identityprovider-2.4.0]# | ||
| + | -rw-r--r-- 1 root root 1679 May 14 10:31 idp.key.new | ||
| + | -rw-r--r-- 1 root root 1155 May 14 10:31 idp.crt.new | ||
| + | -rw-r--r-- 1 root root 2173 May 14 10:31 idp.jks.new | ||
| + | |||
| + | [root@shibidp1 credentials]# | ||
| + | cp: overwrite `idp.jks'? | ||
| + | [root@shibidp1 credentials]# | ||
| + | cp: overwrite `idp.crt'? | ||
| + | [root@shibidp1 credentials]# | ||
| + | cp: overwrite `idp.key'? | ||
| + | |||
| + | </ | ||
| + | |||
| + | ==== changer le hostname ===== | ||
| + | |||
| + | < | ||
| + | [root@idpr shibboleth-idp]# | ||
| + | HOSTNAME=" | ||
| + | |||
| + | [root@idpr metadata]# hostname | ||
| + | idpr.tem-tsp.eu | ||
| + | </ | ||
| + | |||
| + | |||
| + | ==== certificats pour le frontal apache | ||
| + | |||
| + | changer la configuration du fichier ssl.conf d' | ||
| + | |||
| + | ==== publication des metadata ==== | ||
| + | |||
| + | il faut modifier les metadata de notre propre IDP : / | ||
| + | |||
| + | * modifier l' | ||
| + | * modifier les URL d' | ||
| + | * modifier l' | ||
| + | |||
| + | < | ||
| + | $ vim / | ||
| + | ... | ||
| + | < MIIDLDCCAhSgAwIBAgIVANglo+Sutu51HUayHY5NWsVctK5OMA0GCSqGSIb3DQEB | ||
| + | < BQUAMBsxGTAXBgNVBAMTEGlkcG10LnRlbS10c3AuZXUwHhcNMTQwNTE5MTEzMTQ4 | ||
| + | ... | ||
| + | --- | ||
| + | > MIIDSDCCAjCgAwIBAgIVAOcj4Pu5khNxBuX5dSD5nr6TeIUhMA0GCSqGSIb3DQEB | ||
| + | > BQUAMCIxIDAeBgNVBAMTF3NoaWJpZHAzLml0LXN1ZHBhcmlzLmV1MB4XDTExMDkw | ||
| + | ... | ||
| + | < < | ||
| + | --- | ||
| + | > < | ||
| + | ... | ||
| + | < < | ||
| + | --- | ||
| + | > < | ||
| + | |||
| + | </ | ||
| + | |||
| + | il faut aussi appliquer le changement des informations dans le guicher Renater : federation.renater.fr/ | ||
| + | |||
| + | onglet informations techinques => URL et certificat | ||
| + | |||
| + | |||
| + | |||
| + | ==== Filtre CAS ==== | ||
| + | |||
| + | quand on utilise un filtre CAS, il faut penser à l'URL de retour au service qui est au nom de notre IDP, donc changer le hostname là aussi ! | ||
| + | |||
| + | dans / | ||
| + | |||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | </ | ||
| + | |||
| + | relancer install.sh pour deployer ce nouveau web.xml en prenant garde de ne pas ecraser le configuration actuelle . | ||
