jehan 2019 docpublic:systemes:shibboleth
https://www-public.imtbs-tsp.eu/~procacci/dok/
2026-05-13T14:52:02+00:00jehan 2019
https://www-public.imtbs-tsp.eu/~procacci/dok/
https://www-public.imtbs-tsp.eu/~procacci/dok/lib/tpl/arctic/images/favicon.icotext/html2014-04-30T10:39:24+00:00Anonymous (anonymous@undisclosed.example.com)Attr Filter
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:attributefilter&rev=1398854364&do=diff
Attr Filter
Reference
* <https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeFilter>
EduPersonEntitlement
references
* <https://services.renater.fr/federation/docs/fiches/entitlement>
* <https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinition>
Indications constructions d'attributs
resolver script
exemple de script de provisioning de l'attribut eduPersonEntitlement servant à déterminer l'acces d'un invidu à differentes ressources.
ici n…text/html2021-07-02T14:52:46+00:00Anonymous (anonymous@undisclosed.example.com)SSO Azure AD 365
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:azure365&rev=1625237566&do=diff
SSO Azure AD 365
Cette page decrit comment configurer un IDP shibboleth (v4.1.2) pour assurer une authentification SSO avec Azure AD
Azure AD
le SSO avec Azure AD suppose que les comptes de l'AD “on-premise” soient pre-provisionnés sur l'Azure ADtext/html2023-10-24T14:46:59+00:00Anonymous (anonymous@undisclosed.example.com)DocuSign
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:docusign&rev=1698158819&do=diff
DocuSign
This page shows how to enable a shibboleth IDP v4 to authenticate and send attributes to a DocuSign Service Provider .
external references :
* <https://wiki.shibboleth.net/confluence/display/IDP4/Home>
* <https://support.docusign.com/fr/guides/org-admin-guide>
DocuSign demo SP
In order to validate configuration , the DocuSign Vendor gave us a demo SP to test parameters .text/html2016-02-13T11:34:01+00:00Anonymous (anonymous@undisclosed.example.com)Fédérations
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:federations&rev=1455363241&do=diff
Fédérations
Il n'est pas indispensable d'adhérer à la fédération d'Identité Renater pour partager des identités d'accès web au sein d'un groupe communautaire. Cela reste cependant recommandé pour des raisons de formalité et d'ouverture aux autres organismes de la communauté enseignement recherche.text/html2021-06-09T15:07:16+00:00Anonymous (anonymous@undisclosed.example.com)IDP v4 as proxy
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:idpproxy&rev=1623251236&do=diff
IDP v4 as proxy
It happens that SP vendors don't provide Discocery Service/WAYF SP initiated SSO (has we are used in academic/research ecosystem)
so they ask us to register as many IDP as we have universities/school in our group of internals federated IDPs .text/html2010-05-11T20:20:54+00:00Anonymous (anonymous@undisclosed.example.com)IdP-ShibV2
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:idpv2&rev=1273609254&do=diff
IdP-ShibV2
Références shib v2
<http://shibboleth.internet2.edu/shib-v2.0.html>
<https://spaces.internet2.edu/display/SHIB2/Home>
mail d'annonce:
Date - Thu Mar 20 07:40:01 2008
From: Steven_Carmody AT brown.edu
Subject: Shibboleth v2.0 is Now Available
To: shibboleth-announce@internet2.edu, shibboleth-dev@internet2.edu,
shibboleth-users@internet2.edutext/html2014-05-19T14:00:40+00:00Anonymous (anonymous@undisclosed.example.com)IdP-ShibV2x
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:idpv2x&rev=1400508040&do=diff
IdP-ShibV2x
Exemple de deploiement d'un fournisseur d'IDP (V2.3.3) sur une centos6 avec les produits natifs de cette distribution => JVM openjdk et tomcat6 .
[root@shibidp3 shibboleth-idp]# arch
i686
[root@shibidp3 shibboleth-idp]# cat /etc/redhat-release
CentOS Linux release 6.0 (Final)text/html2019-01-02T21:57:12+00:00Anonymous (anonymous@undisclosed.example.com)Idpv3x
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:idpv3x&rev=1546466232&do=diff
Idpv3x
references
* <https://services.renater.fr/federation/docs/installation/idp3/index>
* <https://wiki.shibboleth.net/confluence/display/IDP30/Installation>
* <https://www.switch.ch/aai/guides/idp/installation/>
* <https://spaces.internet2.edu/pages/viewpage.action?pageId=49841792#LinuxIdentityProviderIdPv3>(Centos7)-5
* <https://www.testshib.org/>
contexte
Exemple de deploiement d'un fournisseur d'IDP (V3.0) sur une centos7 avec les produits natifs de cette distribution ⇒ JVM o…text/html2020-07-04T15:15:02+00:00Anonymous (anonymous@undisclosed.example.com)Idpv3x-c8
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:idpv3xc8&rev=1593875702&do=diff
Idpv3x-c8
references
* <https://services.renater.fr/federation/docs/installation/idp3/index>
* <https://wiki.shibboleth.net/confluence/display/IDP30/Installation>
* <https://www.switch.ch/aai/guides/idp/installation/>
* <https://spaces.internet2.edu/pages/viewpage.action?pageId=49841792#LinuxIdentityProviderIdPv3>(Centos7)-5
* <https://www.testshib.org/>
* <https://tecadmin.net/install-tomcat-9-on-centos-8/>
contexte
Exemple de deploiement d'un fournisseur d'IDP (V3.4) sur une ce…text/html2021-06-30T17:48:57+00:00Anonymous (anonymous@undisclosed.example.com)Idpv4x-c8
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:idpv4xc8&rev=1625075337&do=diff
Idpv4x-c8
references
* <https://wiki.shibboleth.net/confluence/display/IDP4/Home>
* <https://services.renater.fr/federation/documentation/fiches-techniques/idp/migration-idp4>
* <https://www.switch.ch/aai/guides/idp/installation/>
* <https://spaces.internet2.edu/pages/viewpage.action?pageId=49841792#LinuxIdentityProviderIdPv3>(Centos7)-5
* <https://www.testshib.org/>
* <https://tecadmin.net/install-tomcat-9-on-centos-8/>
contexte
Exemple de deploiement d'un fournisseur d'IDP (V4.…text/html2025-11-24T15:27:16+00:00Anonymous (anonymous@undisclosed.example.com)shibboleth IDP 5
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:idpv5xa9&rev=1763998036&do=diff
shibboleth IDP 5
references
* <https://shibboleth.atlassian.net/wiki/spaces/IDP5/overview>
* <https://www.ukfederation.org.uk/content/News/2023-10-24-c-Shib-IdPv5-Release>
* <https://services.renater.fr/federation/documentation/tutoriels/idp5/index>
* <https://docs.tuakiri.ac.nz/identity_providers/upgrading_a_4_x_idp_to_5_x>
requirements
* <https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199511079/SystemRequirements>
java 17
[root@idp5 ~]# dnf install java-17-openjdk j…text/html2010-01-09T11:27:54+00:00Anonymous (anonymous@undisclosed.example.com)Metadata-Fede
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:metadatafede&rev=1263036474&do=diff
Metadata-Fede
Reference
Starting point:
<https://spaces.internet2.edu/display/SHIB2/Metadata>
Documentation de la fédération Renater (FR)
<https://federation.renater.fr/technique/metadata?s[]=metadata>
Fédération à Deux
<https://federation.renater.fr/docs/fiches/fedadeux>
Discussion I had on the shibboleth-users list:
<https://mail.internet2.edu/wws/arc/shibboleth-users/2009-11/msg00399.html>
Objectif
Notre institut adhère à la fédération national Renater, afin de partager avec la communa…text/html2010-03-08T20:36:30+00:00Anonymous (anonymous@undisclosed.example.com)SAML Other
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:samlothers&rev=1268080590&do=diff
SAML Other
CrudeSAML
integration de la federation d'identité pour des application non web
<http://ftp.espci.fr/shadow/manu/README>
<http://www.ossir.org/paris/supports/2010/2010-02-09/saml.pdf>
shib-user ML announce
annonce sur la ML shibboleth users
<http://marc.info/?l=shibboleth-users&m=126079803401976&w=2>
simpleSAMLphp
utilisation de federations en php et SAML
<http://rnd.feide.no/simplesamlphp>
<http://www.zeitoun.net/articles/configure-simplesaml-1.3-sp-and-shibboleth-2.1-idp/s…text/html2015-10-27T06:44:07+00:00Anonymous (anonymous@undisclosed.example.com)references
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:shibbootcamp&rev=1445928247&do=diff
references
* shibboleth Internet2 http://shibboleth.net/community/
* shibboleth wiki https://wiki.shibboleth.net/confluence/
* shibboleth Installations https://wiki.shibboleth.net/confluence/display/SHIB2/Installation
* download IDP http://shibboleth.net/downloads/identity-provider/
* sysadmins debian vs redhat https://help.ubuntu.com/community/SwitchingToUbuntu/FromLinux/RedHatEnterpriseLinuxAndFedora
* VirtualBox additional tools http://www.if-not-true-then-false.com/2010/install-…text/html2023-03-06T16:36:47+00:00Anonymous (anonymous@undisclosed.example.com)SP gitlab omniauth 15.9.2
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:sp_gitlab&rev=1678120607&do=diff
SP gitlab omniauth 15.9.2
pb after update to gitlab-ce 15.9.2
* <https://gitlab.com/gitlab-org/gitlab/-/issues/393065>
* <https://gitlab.com/gitlab-org/gitlab/-/merge_requests/109667>
workaround
* <https://gitlab.com/gitlab-org/gitlab/-/issues/393065#note_1294480666>
applied workaround
install gem omniauth-shibboleth
[root@gitlab gitlab]# /opt/gitlab/embedded/bin/gem install omniauth-shibboleth
Fetching omniauth-shibboleth-1.3.0.gem
Successfully installed omniauth-shibboleth-1.3.0…text/html2022-03-15T12:55:52+00:00Anonymous (anonymous@undisclosed.example.com)proxy SP
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:sp_proxy&rev=1647348952&do=diff
proxy SP
references
<https://services.renater.fr/federation/documentation/generale/shib-et-reverseproxy>
objectifs
mettre en place un reverse-proxy Service Provider mod-shib a partir duquel se feraient les authentifications et passages d'attributs vers le service final où il ne serait plus necessaire d'installer un mod_shib localement, bref centraliser l'authentification shibboleth sur une SP proxy vers les services finaux .text/html2022-07-04T14:53:18+00:00Anonymous (anonymous@undisclosed.example.com)Shibboleth Wordpress plugin
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:sp_wordpress&rev=1656946398&do=diff
Shibboleth Wordpress plugin
references
* <https://wordpress.org/plugins/shibboleth/>
* <https://docs.shib.ncsu.edu/docs/wordpress/index.html>
* <https://wordpress.org/plugins/simpleshib/?ref=commonninja>
* <https://www.pluginforthat.com/plugin/shibboleth/>
apache vhost config
apache vhost that serves both mainsitewp and sub-blog farm's blogs, as of blog1.mainsitewp.domain.fr :
<VirtualHost 192.168.12.12:443>
ServerName mainsitewp.domain.fr
ServerAlias *.mainsitewp.…text/html2014-04-28T20:48:32+00:00Anonymous (anonymous@undisclosed.example.com)SP v2
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:spv2&rev=1398718112&do=diff
SP v2
Réference
* <https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLinuxInstall>
* <https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPGettingStarted>
* <https://federation.renater.fr/docs/installation#installer_un_sp_shibboleth>
* <https://shib.kuleuven.be/docs/sp/2.x/install-sp-2.x-rhel.html>
* <https://wiki.umn.edu/ShibAuth/Shibboleth2Xml>
* <https://wiki.cac.washington.edu/display/infra/Configure+a+Service+Provider+for+Step-up+Two-Factor+Authentication>
…text/html2017-02-21T09:42:15+00:00Anonymous (anonymous@undisclosed.example.com)SP v2
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:spv2c7&rev=1487670135&do=diff
SP v2
Réference
* <https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLinuxInstall>
* <https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPGettingStarted>
* <https://services.renater.fr/federation/docs/installation#installer_un_sp_shibboleth>
* <https://shib.kuleuven.be/docs/sp/2.x/install-sp-2.x-rhel.html>
* <https://wiki.umn.edu/ShibAuth/Shibboleth2Xml>
* <https://wiki.cac.washington.edu/display/infra/Configure+a+Service+Provider+for+Step-up+Two-Factor+Authenti…text/html2018-01-12T14:46:26+00:00Anonymous (anonymous@undisclosed.example.com)Shibboleth-sp2 debian
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:spv2deb&rev=1515768386&do=diff
Shibboleth-sp2 debian
Installation d'un service provider shibboleth2 sous debian
package
le module shibboleth pour apache fait partie des depos debian par defaut
root@kohadev:/etc/apt# apt-cache search shibboleth
libapache2-mod-shib2 - Federated web single sign-on system (Apache module)
libshibsp-dev - Federated web single sign-on system (development)
libshibsp-doc - Federated web single sign-on system (API docs)
libshibsp4 - Federated web single sign-on system (runtime)
shibboleth-sp2-sche…text/html2020-02-12T10:23:48+00:00Anonymous (anonymous@undisclosed.example.com)SP v3
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:spv3c7&rev=1581503028&do=diff
SP v3
Déploiement d'un Service Provider v3 sous centos 7
Réference
* <https://wiki.shibboleth.net/confluence/display/SP3/Home>
Repo shibboleth
* <https://wiki.shibboleth.net/confluence/display/SP3/RPMInstall>
le site de shibboleth fournit maintenant des packahe RPM (opensuse avant)
depuis le site <https://shibboleth.net/downloads/service-provider/RPMS/> on genere un fichier de repository pur notre distribution (ici centos 7)text/html2022-05-05T21:24:40+00:00Anonymous (anonymous@undisclosed.example.com)SP v3 os 8
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:spv3o8&rev=1651785880&do=diff
SP v3 os 8
Déploiement d'un Service Provider v3 sous OS type RHEL8/Centos8 ici vzLinux8
Réference
* <https://wiki.shibboleth.net/confluence/display/SP3/Home>
Repo shibboleth
* <https://wiki.shibboleth.net/confluence/display/SP3/RPMInstall>
* <https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335566/RPMInstall>
le site de shibboleth fournit maintenant des packahe RPM (opensuse avant)
depuis le site <https://shibboleth.net/downloads/service-provider/RPMS/> on genere un fic…text/html2025-11-14T13:52:20+00:00Anonymous (anonymous@undisclosed.example.com)SP v3
https://www-public.imtbs-tsp.eu/~procacci/dok/doku.php?id=docpublic:systemes:shibboleth:spv3xa10&rev=1763128340&do=diff
SP v3
Déploiement d'un Service Provider v3 sous AlmaLinux10
Réference
* <https://wiki.shibboleth.net/confluence/display/SP3/Home>
* <https://wiki.shibboleth.net/confluence/display/SP3/Home>
Repo shibboleth
* <https://wiki.shibboleth.net/confluence/display/SP3/RPMInstall>
le site de shibboleth fournit maintenant des package RPM (opensuse avant)
depuis le site <https://shibboleth.net/downloads/service-provider/RPMS/> on genere un fichier de repository pur notre distribution (ici Al…