Im Schritt 2 haben Sie die Shibboleth SP installiert. Hier werden Sie Ihre Shibboleth SP konfigurieren, um die Userdaten von der DHBW IT-Abteilung zu erhalten.
shibbboleth.xml ist die Konfigurationsdatei für die Shibboleth SP. Diese Datei wird für die Kommunikation mit dem Identity Provider (User Datenbank) zur Authentifizierung des Benutzers verwendet.
nano /etc/shibboleth/shibboleth2.xmlNach der Öffnung der Datei, müssen Sie die XML Datei mit folgendem Inhalt anpassen: (ersetzen Sie die example.org und Kontaktinformationen durch Manager Node Domain und Ihre Kontaktinformationen)
<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
clockSkew="180">
<OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" />
<!--
By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
are used. See example-shibboleth2.xml for samples of explicitly configuring them.
-->
<!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
<ApplicationDefaults entityID="https://example.org/shibboleth"
homeURL="https://example.org/Shibboleth.sso/Session"
REMOTE_USER="persistent-id uniqueID Givenname Mail"
cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
<!--
Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
and should be a relative path, with the SP computing the full value based on the virtual
host. Use of TLS is now assumed because browsers are enforcing it due to SameSite
restrictions. Note that while we default checkAddress to "false", this makes an assertion
stolen in transit easier for attackers to misuse.
-->
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="true" cookieProps="https"
redirectLimit="host">
<!--
Configures SSO for a default IdP. To properly allow for >1 IdP, remove
entityID property and adjust discoveryURL to point to discovery service.
You can also override entityID on /Login query string, or in RequestMap/htaccess.
-->
<SSO entityID="https://saml.dhbw-stuttgart.de/idp/shibboleth"
discoveryProtocol="SAMLDS" discoveryURL="https://example.org/shibboleth-ds/index.html">
SAML2
</SSO>
<!--
<SSO discoveryProtocol="SAMLDS" discoveryURL="https://example.org/shibboleth-ds/index.html">
SAML2
</SSO>
-->
<!-- SAML and local-only logout. -->
<Logout>SAML2 Local</Logout>
<!-- Administrative logout. -->
<LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" />
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<!-- Status reporting service. -->
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<!-- Session diagnostic service. -->
<Handler type="Session" Location="/Session" showAttributeValues="false"/>
<!-- JSON feed of discovery information. -->
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>
<!--
Allows overriding of error template information/filenames. You can
also add your own attributes with values that can be plugged into the
templates, e.g., helpLocation below.
-->
<Errors supportContact="your@email.com"
helpLocation="/about.html"
styleSheet="/shibboleth-sp/main.css"/>
<!-- Example of locally maintained metadata. -->
<!--
<MetadataProvider type="XML" validate="true" path="partner-metadata.xml"/>
-->
<!-- Example of remotely supplied batch of signed metadata.
-->
<MetadataProvider type="XML" validate="true"
url="https://saml.dhbw-stuttgart.de/idp/shibboleth">
</MetadataProvider>
<!-- Example of remotely supplied "on-demand" signed metadata. -->
<!--
<MetadataProvider type="MDQ" validate="true" cacheDirectory="mdq"
baseUrl="http://mdq.federation.org" ignoreTransport="true">
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
<MetadataFilter type="Signature" certificate="mdqsigner.pem" />
</MetadataProvider>
-->
<!-- Map to extract attributes from SAML assertions. -->
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<!-- Simple file-based resolvers for separate signing/encryption keys. -->
<CredentialResolver type="File" use="signing"
key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
<CredentialResolver type="File" use="encryption"
key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>
</ApplicationDefaults>
<!-- Policies that determine how to process and authenticate runtime messages. -->
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
<!-- Low-level configuration about protocols and bindings available for use. -->
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig>
attribute-map.xml definiert welche Attribution werden von shibboleth angezeigt und in http Headers hinzugefügt. Folgende Attribution zeigt ob der User ein Mitarbeiter oder ein Student ist. Diese müssen Sie in attribute-map.xml schreiben.
nano /etc/shibboleth/attribute-map.xml<Attribute name="urn:mace:dir:attribute-def:eduPersonAffiliation" id="unscoped-affiliation">
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
</Attribute>idpselect_condig.js (in Shibboleth-ds Odner) muss auch konfiguriert werden, damit VM von Shibboleth IdP erlaubt ist.
Öffnen Sie die Datei und folgende Anpassungen vornehmen:
nano /etc/shibboleth-ds/idpselect_config.jsthis.redirectAllow = [ "^https:\/\/example\.org\/Shibboleth\.sso\/Login.*$" ];
this.returnWhiteList = [ "^https:\/\/example\.org\/Shibboleth\.sso\/Login.*$" ];Nach der Konfiguration müssen Shibboleth SP und Apache neu gestartet werden:
systemctl restart shibd
systemctl restart apache2