[[Idpv3x]]
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
docpublic:systemes:shibboleth:idpv3x [2019/01/02 14:16] procacci@tem-tsp.eu [proxy-ajp] |
docpublic:systemes:shibboleth:idpv3x [2019/01/02 21:57] (current) procacci@tem-tsp.eu [SSO CAS] |
||
|---|---|---|---|
| Line 149: | Line 149: | ||
| < | < | ||
| - | [root@idp34 certs]# grep SSLCertificat | + | [root@idp34 certs]# |
| SSLCertificateFile / | SSLCertificateFile / | ||
| SSLCertificateKeyFile / | SSLCertificateKeyFile / | ||
| Line 155: | Line 155: | ||
| </ | </ | ||
| - | enfon configurer le proxy-ajp pour rediriger les requetes https d' | + | enfin configurer le proxy-ajp pour rediriger les requetes https d' |
| < | < | ||
| Line 172: | Line 172: | ||
| - | ===== TLS https ===== | ||
| - | installation du module apache (frontal proxy ajp ) pour SSL/ | ||
| - | < | ||
| - | [root@idp3 ~]# yum install mod_ssl | ||
| - | Installé : | ||
| - | mod_ssl.x86_64 1: | ||
| - | |||
| - | Terminé ! | ||
| - | </ | ||
| - | |||
| - | declarer le certificat et sa clé , wildcard possible | ||
| - | |||
| - | < | ||
| - | [root@idp3 ~]# grep ^SSL / | ||
| - | SSLCertificateFile / | ||
| - | SSLCertificateKeyFile / | ||
| - | SSLCACertificateFile / | ||
| - | </ | ||
| - | |||
| - | test | ||
| - | |||
| - | https:// | ||
| ===== ntp ==== | ===== ntp ==== | ||
| Line 212: | Line 190: | ||
| < | < | ||
| - | [root@idp3 ~]# wget http:// | + | [root@idp34 ~]# wget https:// |
| - | [root@idp3 ~]# mkdir /opt/src | + | --2019-01-02 14: |
| - | [root@idp3 ~]# mv shibboleth-identity-provider-3.2.1.tar.gz /opt/src/ | + | [root@idp34 ~]# mkdir /opt/src |
| - | [root@idp3 src]# tar xvfz shibboleth-identity-provider-3.2.1.tar.gz | + | [root@idp34 ~]# mv shibboleth-identity-provider-3.4.2.tar.gz /opt/src/ |
| - | [root@idp3 src]# cd shibboleth-identity-provider-3.2.1/ | + | [root@idp34 ~]# cd /opt/src/ ; tar xvfz shibboleth-identity-provider-3.4.2.tar.gz |
| - | [root@idp3 shibboleth-identity-provider-3.2.1]# ls | + | [root@idp34 src]# cd shibboleth-identity-provider-3.4.2 |
| - | bin conf credentials | + | [root@idp34 shibboleth-identity-provider-3.4.2]# ls |
| + | bin conf credentials | ||
| </ | </ | ||
| Line 227: | Line 205: | ||
| < | < | ||
| - | [root@idp3 shibboleth-identity-provider-3.2.1]# export JAVA_HOME=/ | + | [root@idp34 shibboleth-identity-provider-3.4.2]# export JAVA_HOME=/ |
| - | [root@idp3 shibboleth-identity-provider-3.2.1]# ./ | + | [root@idp34 shibboleth-identity-provider-3.4.2]# ./ |
| - | Source (Distribution) Directory: [/ | + | Source (Distribution) Directory |
| Installation Directory: [/ | Installation Directory: [/ | ||
| - | Hostname: [localhost.localdomain] | + | Hostname: [idp34.int-evry.fr] |
| - | idp3.tem-tsp.eu | + | idp3.imtbstsp.eu |
| - | SAML EntityID: [https:// | + | SAML EntityID: [https:// |
| - | Attribute Scope: [localdomain] | + | Attribute Scope: [int-evry.fr] |
| - | tem-tsp.eu | + | imtbstsp.eu |
| - | Backchannel PKCS12 Password: | + | Backchannel PKCS12 Password: |
| Re-enter password: | Re-enter password: | ||
| - | Cookie Encryption Key Password: | + | Cookie Encryption Key Password: |
| - | Password cannot be zero length | + | |
| - | Cookie | + | |
| Re-enter password: | Re-enter password: | ||
| Warning: / | Warning: / | ||
| + | Warning: / | ||
| Warning: / | Warning: / | ||
| Warning: / | Warning: / | ||
| Warning: / | Warning: / | ||
| - | Warning: / | + | Generating Signing Key, CN = idp3.imtbstsp.eu URI = https:// |
| - | Generating Signing Key, CN = idpmt3.tem-tsp.eu URI = https:// | + | |
| ...done | ...done | ||
| - | Creating Encryption Key, CN = idpmt3.tem-tsp.eu URI = https:// | + | Creating Encryption Key, CN = idp3.imtbstsp.eu URI = https:// |
| ...done | ...done | ||
| - | Creating Backchannel keystore, CN = idpmt3.tem-tsp.eu URI = https:// | + | Creating Backchannel keystore, CN = idpr3.imtbs-tsp.eu URI = https:// |
| ...done | ...done | ||
| Creating cookie encryption key files... | Creating cookie encryption key files... | ||
| Line 262: | Line 238: | ||
| BUILD SUCCESSFUL | BUILD SUCCESSFUL | ||
| + | Total time: 2 minutes 14 seconds | ||
| + | |||
| </ | </ | ||
| Line 267: | Line 245: | ||
| < | < | ||
| - | [root@idp3 shibboleth-identity-provider-3.2.1]# ls -l / | + | [root@idp34 shibboleth-identity-provider-3.4.2]# ls -l / |
| total 32 | total 32 | ||
| - | -rw-r--r-- 1 root root 1168 23 mai 22:14 idp-backchannel.crt | + | -rw-r--r-- 1 root root 1517 2 janv. 14:23 idp-backchannel.crt |
| - | -rw-r--r-- 1 root root 2554 23 mai 22:14 idp-backchannel.p12 | + | -rw-r--r-- 1 root root 3399 2 janv. 14:23 idp-backchannel.p12 |
| - | -rw-r--r-- 1 root root 1164 23 mai 22:14 idp-encryption.crt | + | -rw-r--r-- 1 root root 1517 2 janv. 14:23 idp-encryption.crt |
| - | -rw------- 1 root root 1675 23 mai 22:14 idp-encryption.key | + | -rw------- 1 root root 2455 2 janv. 14:23 idp-encryption.key |
| - | -rw-r--r-- 1 root root 1164 23 mai 22:14 idp-signing.crt | + | -rw-r--r-- 1 root root 1517 2 janv. 14:23 idp-signing.crt |
| - | -rw------- 1 root root 1675 23 mai 22:14 idp-signing.key | + | -rw------- 1 root root 2459 2 janv. 14:23 idp-signing.key |
| - | -rw-r--r-- 1 root root | + | -rw-r--r-- 1 root root |
| - | -rw-r--r-- 1 root root 48 23 mai 22:14 sealer.kver | + | -rw-r--r-- 1 root root 47 2 janv. 14:23 sealer.kver |
| </ | </ | ||
| Line 282: | Line 260: | ||
| < | < | ||
| - | [root@idp3 shibboleth-identity-provider-3.2.1]# chown -R tomcat / | + | [root@idp34 shibboleth-identity-provider-3.4.2]# chown -R tomcat / |
| </ | </ | ||
| Line 298: | Line 276: | ||
| </ | </ | ||
| - | quelques secondes apres | + | quelques secondes apres grace a l' |
| < | < | ||
| - | root@idp3 localhost]# ls -l / | + | [root@idp34 shibboleth-identity-provider-3.4.2]# ls -l / |
| total 32 | total 32 | ||
| - | drwxr-xr-x 2 tomcat tomcat 4096 25 mai 20:38 css | + | drwxr-xr-x 2 tomcat tomcat 4096 2 janv. 14:28 css |
| - | drwxr-xr-x 2 tomcat tomcat 4096 25 mai 20:38 images | + | drwxr-xr-x 2 tomcat tomcat 4096 2 janv. 14:28 images |
| - | -rw-r--r-- 1 tomcat tomcat 1008 23 mai 22:14 index.jsp | + | -rw-r--r-- 1 tomcat tomcat 1008 2 janv. 14:23 index.jsp |
| - | drwxr-xr-x 2 tomcat tomcat 4096 25 mai 20:38 js | + | drwxr-xr-x 2 tomcat tomcat 4096 2 janv. 14:28 js |
| - | drwxr-xr-x 2 tomcat tomcat 4096 25 mai 20:38 META-INF | + | drwxr-xr-x 2 tomcat tomcat 4096 2 janv. 14:28 META-INF |
| - | drwxr-xr-x 5 tomcat tomcat 4096 25 mai 20:38 WEB-INF | + | drwxr-xr-x 5 tomcat tomcat 4096 2 janv. 14:28 WEB-INF |
| - | -rw-r--r-- 1 tomcat tomcat | + | -rw-r--r-- 1 tomcat tomcat |
| </ | </ | ||
| Line 325: | Line 304: | ||
| en effet il faut ajouter la librairie jstl (cf http:// | en effet il faut ajouter la librairie jstl (cf http:// | ||
| - | cf aussi https:// | + | cf aussi https:// |
| < | < | ||
| - | [root@idp3 ~]# cd / | + | [root@idp34 shibboleth-identity-provider-3.4.2]# cd / |
| - | [root@idp3 lib]# wget http:// | + | [root@idp34 lib]# wget http:// |
| - | [root@idp3 lib]# systemctl restart tomcat | + | 2019-01-02 14:34:08 (9,27 MB/s) - «jstl-1.2.jar» sauvegardé [414240/ |
| + | [root@idp34 lib]# systemctl restart tomcat | ||
| </ | </ | ||
| + | Pour l' | ||
| + | |||
| + | < | ||
| + | # vim / | ||
| + | < | ||
| + | ... | ||
| + | < | ||
| + | |||
| + | <entry key=" | ||
| + | <bean id=" | ||
| + | p: | ||
| + | </ | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | |||
| + | maintenant accessible en https:// | ||
| acces status possible en shell également | acces status possible en shell également | ||
| < | < | ||
| - | [root@idp3 ~]# / | + | [root@idp34 bin]# / |
| ### Operating Environment Information | ### Operating Environment Information | ||
| operating_system: | operating_system: | ||
| - | operating_system_version: | + | operating_system_version: |
| operating_system_architecture: | operating_system_architecture: | ||
| - | jdk_version: | + | jdk_version: |
| - | available_cores: | + | available_cores: |
| - | used_memory: | + | used_memory: |
| maximum_memory: | maximum_memory: | ||
| ### Identity Provider Information | ### Identity Provider Information | ||
| - | idp_version: | + | idp_version: |
| - | start_time: | + | start_time: |
| - | current_time: | + | current_time: |
| - | uptime: | + | uptime: |
| - | service: shibboleth.LoggingService | ||
| - | last successful reload attempt: 2016-06-21T08: | ||
| - | last reload attempt: 2016-06-21T08: | ||
| - | .... | ||
| </ | </ | ||
| - | Pour l' | ||
| - | < | ||
| - | CT-a84f4e90 shibboleth-identity-provider-3.3.0# | ||
| - | < | ||
| - | ... | ||
| - | < | ||
| - | |||
| - | <entry key=" | ||
| - | <bean id=" | ||
| - | p: | ||
| - | </ | ||
| - | ... | ||
| - | </ | ||
| Line 407: | Line 387: | ||
| < | < | ||
| - | [root@idp3 shibboleth-idp]# wget -O / | + | [root@idp34]# cd / |
| + | [root@idp34 credentials]# | ||
| </ | </ | ||
| Line 414: | Line 396: | ||
| < | < | ||
| [root@idp3 conf]# tail -18 metadata-providers.xml | [root@idp3 conf]# tail -18 metadata-providers.xml | ||
| + | |||
| + | < | ||
| + | < | ||
| + | xsi: | ||
| + | backingFile=" | ||
| + | metadataURL=" | ||
| + | |||
| + | < | ||
| + | requireSignedRoot=" | ||
| + | certificateFile=" | ||
| + | </ | ||
| + | </ | ||
| + | |||
| | | ||
| - | <!-- Federation de test renater --> | + | |
| - | < | + | |
| - | xsi: | + | |
| - | backingFile=" | + | |
| - | metadataURL=" | + | |
| - | + | ||
| - | < | + | |
| - | requireSignedRoot=" | + | |
| - | certificateFile=" | + | |
| - | </ | + | |
| - | < | + | |
| - | < | + | |
| - | </ | + | |
| </ | </ | ||
| Line 437: | Line 420: | ||
| < | < | ||
| - | [root@idp3 conf]# systemctl restart tomcat.service | + | [root@idp34 conf]# systemctl restart tomcat.service |
| - | [root@idp3 conf]# ls -l ../ | + | |
| - | total 6480 | + | [root@idp34 conf]# |
| - | -rw-r--r-- | + | total 31308 |
| - | -rw-r--r-- | + | -rw-r--r-- 1 tomcat root |
| + | -rw-r--r-- 1 tomcat tomcat | ||
| </ | </ | ||
| Line 451: | Line 436: | ||
| idp-process.log : | idp-process.log : | ||
| - | 2016-06-21 18:55:56,043 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver: | + | |
| - | 2016-06-21 18:55:56,062 - INFO [Shibboleth-Audit.Reload: | + | 2019-01-02 14:48:18,248 - 127.0.0.1 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:574] - Metadata Resolver FileBackedHTTPMetadataResolver RenaterTestMetadata: New metadata successfully loaded for ' |
| + | 2019-01-02 14:48:18,250 - 127.0.0.1 | ||
| + | 2019-01-02 14:48:18,268 - 127.0.0.1 | ||
| + | |||
| </ | </ | ||
| Line 663: | Line 652: | ||
| https:// | https:// | ||
| - | < | ||
| - | [root@idp3]# | ||
| - | [root@idp3 src]# git clone https:// | + | < |
| - | Cloning into 'shib-cas-authn3-git-master' | + | [root@idp34 src]# wget https:// |
| - | remote: Counting objects: 1172, done. | + | [root@idp34 src]# tar xvf shib-cas-authn3-3.2.3.tar |
| - | remote: Total 1172 (delta 0), reused 0 (delta 0), pack-reused 1172 | + | ... |
| - | Receiving objects: 100% (1172/1172), 991.61 KiB | 884.00 KiB/s, done. | + | shib-cas-authn3-3.2.3/edit-webapp/ |
| - | Resolving deltas: 100% (427/427), done. | + | shib-cas-authn3-3.2.3/edit-webapp/ |
| + | shib-cas-authn3-3.2.3/edit-webapp/ | ||
| + | .. | ||
| - | [root@idp3 src]# cp -R /opt/src/shib-cas-authn3-git-master/IDP_HOME/ | + | [root@idp34 src]# cp shib-cas-authn3-3.2.3/edit-webapp/WEB-INF/lib/ |
| - | [root@idp3 src]# wget https:// | + | |
| - | [root@idp3 src]# mv shib-cas-authenticator-3.0.0.jar / | + | |
| - | [root@idp3 src]# wget http:// | + | |
| - | [root@idp3 src]# mv cas-client-core-3.3.3.jar / | + | [root@idp34 src]# cp -R shib-cas-authn3-3.2.3/ |
| + | [root@idp34 src]# ls -ltr /opt/ | ||
| + | total 8 | ||
| + | -rw-r--r-- 1 root root 2290 2 janv. 21:23 shibcas-authn-flow.xml | ||
| + | -rw-r--r-- 1 root root 3241 2 janv. 21:23 shibcas-authn-beans.xml | ||
| + | [root@idp34 src]# wget http:// | ||
| + | [root@idp34 src]# cp cas-client-core-3.5.1.jar / | ||
| </ | </ | ||
| Line 709: | Line 701: | ||
| < | < | ||
| + | |||
| + | [root@idp34 conf]# cd / | ||
| + | [root@idp34 authn]# cp general-authn.xml general-authn.xml.dist | ||
| + | |||
| [root@idp3 authn]# diff general-authn.xml general-authn.xml.dist | [root@idp3 authn]# diff general-authn.xml general-authn.xml.dist | ||
| 93,98d92 | 93,98d92 | ||
