Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
docpublic:systemes:shibboleth:idpv2x [2014/05/14 08:15] procacci@tem-tsp.eu [URLs locales Metadata + Status] |
docpublic:systemes:shibboleth:idpv2x [2014/05/19 14:00] (current) procacci@tem-tsp.eu [publication des metadata] |
||
|---|---|---|---|
| Line 1678: | Line 1678: | ||
| si on oublie de recopier la librairie et qu'on a par redeployer les source pour generer le war, c'est assez troublant, l'IDP semble tourné d' | si on oublie de recopier la librairie et qu'on a par redeployer les source pour generer le war, c'est assez troublant, l'IDP semble tourné d' | ||
| + | ===== changement de domain ===== | ||
| + | |||
| + | nous sommes passés de it-sudparis.eu a tem-tsp.eu ! cela implique plusieurs taches | ||
| + | |||
| + | ==== certificat interne a l'IDP ==== | ||
| + | |||
| + | https:// | ||
| + | |||
| + | < | ||
| + | [root@shibidp1 shibboleth-identityprovider-2.4.0]# | ||
| + | Buildfile: src/ | ||
| + | |||
| + | renew-cert: | ||
| + | This will create a new set of credentials for your IdP. If you ran this command previously and still have ' | ||
| + | yes | ||
| + | Where is the Shibboleth Identity Provider installed? [/ | ||
| + | |||
| + | What is the fully qualified hostname of the Shibboleth Identity Provider server? [idp.example.org] | ||
| + | idp1.tem-tsp.eu | ||
| + | A keystore is about to be generated for you. Please enter a password that will be used to protect it. | ||
| + | secret | ||
| + | Generating new signing and encryption key, certificate, | ||
| + | |||
| + | BUILD SUCCESSFUL | ||
| + | Total time: 29 seconds | ||
| + | |||
| + | [root@shibidp1 shibboleth-identityprovider-2.4.0]# | ||
| + | -rw-r--r-- 1 root root 1679 May 14 10:31 idp.key.new | ||
| + | -rw-r--r-- 1 root root 1155 May 14 10:31 idp.crt.new | ||
| + | -rw-r--r-- 1 root root 2173 May 14 10:31 idp.jks.new | ||
| + | |||
| + | [root@shibidp1 credentials]# | ||
| + | cp: overwrite `idp.jks'? | ||
| + | [root@shibidp1 credentials]# | ||
| + | cp: overwrite `idp.crt'? | ||
| + | [root@shibidp1 credentials]# | ||
| + | cp: overwrite `idp.key'? | ||
| + | |||
| + | </ | ||
| + | |||
| + | ==== changer le hostname ===== | ||
| + | |||
| + | < | ||
| + | [root@idpr shibboleth-idp]# | ||
| + | HOSTNAME=" | ||
| + | |||
| + | [root@idpr metadata]# hostname | ||
| + | idpr.tem-tsp.eu | ||
| + | </ | ||
| + | |||
| + | |||
| + | ==== certificats pour le frontal apache | ||
| + | |||
| + | changer la configuration du fichier ssl.conf d' | ||
| + | |||
| + | ==== publication des metadata ==== | ||
| + | |||
| + | il faut modifier les metadata de notre propre IDP : / | ||
| + | |||
| + | * modifier l' | ||
| + | * modifier les URL d' | ||
| + | * modifier l' | ||
| + | |||
| + | < | ||
| + | $ vim / | ||
| + | ... | ||
| + | < MIIDLDCCAhSgAwIBAgIVANglo+Sutu51HUayHY5NWsVctK5OMA0GCSqGSIb3DQEB | ||
| + | < BQUAMBsxGTAXBgNVBAMTEGlkcG10LnRlbS10c3AuZXUwHhcNMTQwNTE5MTEzMTQ4 | ||
| + | ... | ||
| + | --- | ||
| + | > MIIDSDCCAjCgAwIBAgIVAOcj4Pu5khNxBuX5dSD5nr6TeIUhMA0GCSqGSIb3DQEB | ||
| + | > BQUAMCIxIDAeBgNVBAMTF3NoaWJpZHAzLml0LXN1ZHBhcmlzLmV1MB4XDTExMDkw | ||
| + | ... | ||
| + | < < | ||
| + | --- | ||
| + | > < | ||
| + | ... | ||
| + | < < | ||
| + | --- | ||
| + | > < | ||
| + | |||
| + | </ | ||
| + | |||
| + | il faut aussi appliquer le changement des informations dans le guicher Renater : federation.renater.fr/ | ||
| + | |||
| + | onglet informations techinques => URL et certificat | ||
| + | |||
| + | |||
| + | |||
| + | ==== Filtre CAS ==== | ||
| + | |||
| + | quand on utilise un filtre CAS, il faut penser à l'URL de retour au service qui est au nom de notre IDP, donc changer le hostname là aussi ! | ||
| + | |||
| + | dans / | ||
| + | |||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | </ | ||
| + | |||
| + | relancer install.sh pour deployer ce nouveau web.xml en prenant garde de ne pas ecraser le configuration actuelle . | ||
