Differences

This shows you the differences between two versions of the page.

--- docpublic:systemes:shibboleth:idpv2x [2014/05/14 08:14]
procacci@tem-tsp.eu [Lancement]
+++ docpublic:systemes:shibboleth:idpv2x [2014/05/19 14:00] (current)
procacci@tem-tsp.eu [publication des metadata]
@@ Line 525: / Line 525: @@
   * http://yourIDPhostname.domain.tld/idp/profile/Status
+  * http://yourIDPhostname.domain.tld/idp/status (si IP autorisée)
 ==== troubelshooting ====
@@ Line 1677: / Line 1678: @@
 si on oublie de recopier la librairie et qu'on a par redeployer les source pour generer le war, c'est assez troublant, l'IDP semble tourné d'apres les logs idp-process.log, c'est dans /var/log/tomcat6/localhost.log qu'on retrouvre l'erreur "SEVERE" lié au manque du CAS client !.
+===== changement de domain =====
+nous sommes passés de it-sudparis.eu a tem-tsp.eu ! cela implique plusieurs taches
+==== certificat interne a l'IDP ====
+https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCertRenew
+<code>
+[root@shibidp1 shibboleth-identityprovider-2.4.0]# ./install.sh renew-cert
+Buildfile: src/installer/resources/build.xml
+renew-cert:
+This will create a new set of credentials for your IdP.  If you ran this command previously and still have '*.new' files, they will be overwritten.  Do you wish to proceed? (yes, [no])
+yes
+Where is the Shibboleth Identity Provider installed? [/opt/shibboleth-idp]
+What is the fully qualified hostname of the Shibboleth Identity Provider server? [idp.example.org]
+idp1.tem-tsp.eu
+A keystore is about to be generated for you. Please enter a password that will be used to protect it.
+secret
+Generating new signing and encryption key, certificate, and keystore.
+BUILD SUCCESSFUL
+Total time: 29 seconds
+[root@shibidp1 shibboleth-identityprovider-2.4.0]# ls -ltr /opt/shibboleth-idp/credentials/ | tail -3
+-rw-r--r-- 1 root   root 1679 May 14 10:31 idp.key.new
+-rw-r--r-- 1 root   root 1155 May 14 10:31 idp.crt.new
+-rw-r--r-- 1 root   root 2173 May 14 10:31 idp.jks.new
+[root@shibidp1 credentials]# cp idp.jks.new idp.jks
+cp: overwrite `idp.jks'? y
+[root@shibidp1 credentials]# cp idp.crt.new idp.crt
+cp: overwrite `idp.crt'? y
+[root@shibidp1 credentials]# cp idp.key.new idp.key
+cp: overwrite `idp.key'? y
+</code>
+==== changer le hostname =====
+<code>
+[root@idpr shibboleth-idp]# grep idpr /etc/sysconfig/network
+HOSTNAME="idpr.tem-tsp.eu"
+[root@idpr metadata]# hostname
+idpr.tem-tsp.eu
+</code>
+==== certificats pour le frontal apache  ====
+changer la configuration du fichier ssl.conf d'apache pour charger les nouveau certificats public (TCS/renater)
+==== publication des metadata ====
+il faut modifier les metadata de notre propre IDP :  /opt/shibboleth-idp/metadata/idp-metadata.xml
+  * modifier l'entityID (si changement, pas necessairement recommandé !)
+  * modifier les URL d'acces aux services
+  * modifier l'enumeration du certificat
+<code>
+$ vim /opt/shibboleth-idp/metadata/idp-metadata.xml
+...
+< MIIDLDCCAhSgAwIBAgIVANglo+Sutu51HUayHY5NWsVctK5OMA0GCSqGSIb3DQEB
+< BQUAMBsxGTAXBgNVBAMTEGlkcG10LnRlbS10c3AuZXUwHhcNMTQwNTE5MTEzMTQ4
+...
+---
+> MIIDSDCCAjCgAwIBAgIVAOcj4Pu5khNxBuX5dSD5nr6TeIUhMA0GCSqGSIb3DQEB
+> BQUAMCIxIDAeBgNVBAMTF3NoaWJpZHAzLml0LXN1ZHBhcmlzLmV1MB4XDTExMDkw
+...
+<         <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://idpr.tem-tsp.eu/idp/profile/Shibboleth/SSO"/>
+---
+>         <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://shibidp1.it-sudparis.eu/idp/profile/Shibboleth/SSO"/>
+...
+<         <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idpr.tem-tsp.eu:8443/idp/profile/SAML2/SOAP/AttributeQuery"/>
+---
+>         <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://shibidp1.it-sudparis.eu:8443/idp/profile/SAML2/SOAP/AttributeQuery"/>
+</code>
+il faut aussi appliquer le changement des informations dans le guicher Renater : federation.renater.fr/registry
+onglet informations techinques => URL et certificat
+==== Filtre CAS ====
+quand on utilise un filtre CAS, il faut penser à l'URL de retour au service qui est au nom de notre IDP, donc changer le hostname là aussi !
+dans /usr/local/shibboleth-identityprovider-2.4.0/src/main/webapp/WEB-INF/web.xml
+<code>
+<context-param>
+<param-name>serverName</param-name>
+<param-value>https://idpr.tem-tsp.eu</param-value>
+</context-param>
+</code>
+relancer install.sh pour deployer ce nouveau web.xml en prenant garde de ne pas ecraser le configuration actuelle .

docpublic/systemes/shibboleth/idpv2x.1400055289.txt.gz · Last modified: 2014/05/14 08:14 by procacci@tem-tsp.eu

Show page Old revisions

[unknown link type]Back to top