to Homepage
You are located in service Identity Management
General information
RWTH Single Sign-On (via Shibboleth)
IT Center Help

You are located in service: Identity Management

Configuration for protecting a subdirectory
Print page

Configuration for protecting a subdirectory

 

 Detailinformation

  • Save the generated private key and the certificate (see Requesting a Server Certificate) on the server and note the location.
  • Edit the /etc/shibboleth/shibboleth2.xml:

    • Replace the SPConfig Entity with the following code to define the mdui namespace:

      <SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config" xmlns:conf="

          urn:mace:shibboleth:3.0:native:sp:config"

          xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" 

          xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"

          xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"

          xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"

      clockSkew="180">

    • Now define the RequestMapper. The  RequestMapper maps the paths to the the Shibboleth applications. The RequestMapper is above the ApplicationsDefaults

       <RequestMapper type="Native">

          <RequestMap applicationId="default">

              <Host name="sp.example.com">

                  <Path name="app" requireSession="true" applicationId="app" />

              </Host>

          </RequestMap>

      </RequestMapper>

    • In the Session entity set the attributes handler=SSL and cookieProps="https". checkAddress can be set to true if you want to check the IP at login time (can be problematic by proxies)

      <Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerSSL="true" cookieProps="https" redirectLimit="exact">

    • Replace the line <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/> with the following code to add information about your Service Provider

      <Handler type="MetadataGenerator" Location="/Metadata" signing="false">

          <mdui:UIInfo>

               <mdui:DisplayName xml:lang="de">Beispiel SP</mdui:DisplayName>

               <mdui:DisplayName xml:lang="en">Example SP</mdui:DisplayName>

               <mdui:Description xml:lang="de">Eine Beschreibung für den SP</mdui:Description>

               <mdui:Description xml:lang="en">An description for the SP</mdui:Description>

          </mdui:UIInfo>

          <md:Organization>

               <md:OrganizationName xml:lang="de">RWTH Aachen University</md:OrganizationName>

               <md:OrganizationName xml:lang="en">RWTH Aachen University</md:OrganizationName>

               <md:OrganizationDisplayName xml:lang="de">RWTH Aachen University</md:OrganizationDisplayName>

               <md:OrganizationDisplayName xml:lang="en">RWTH Aachen University</md:OrganizationDisplayName>

               <md:OrganizationURL xml:lang="de">http://www.rwth-aachen.de</md:OrganizationURL>

               <md:OrganizationURL xml:lang="en">http://www.rwth-aachen.de</md:OrganizationURL>

          </md:Organization>

          <md:ContactPerson contactType="support">

               <md:GivenName>Support</md:GivenName>

               <md:SurName>Adresse</md:SurName>

               <md:EmailAddress>support@sp.example.com</md:EmailAddress>

          </md:ContactPerson>

          <md:ContactPerson contactType="technical">

               <md:GivenName>Technischer</md:GivenName>

               <md:SurName>Ansprechpartner</md:SurName>

               <md:EmailAddress>technik@sp.example.com</md:EmailAddress>

          </md:ContactPerson>

          <md:ContactPerson contactType="administrative">

               <md:GivenName>Adminstrativer</md:GivenName>

               <md:SurName>Ansprechpartner</md:SurName>

               <md:EmailAddress>admin@sp.example.com</md:EmailAddress>

          </md:ContactPerson>

      </Handler>

      Please replace the text with your information.

    • add standard metadata provider

       <MetadataProvider type="Chaining">

          <!-- RWTH Aachen Metadaten -->

          <MetadataProvider type="XML" url="https://sso.rwth-aachen.de/metadata/rwth.metadata.xml" backingFilePath="rwth.metadata.xml" reloadInterval="7200">

               <MetadataFilter type=Signature" certificate="/pfad/zu/sso.pem"/>

          </MetadataProvider>

      </MetadataProvider>

      -----BEGIN CERTIFICATE-----

      MIIJ4TCCCMmgAwIBAgIMIOADIKkrY40uIWIdMA0GCSqGSIb3DQEBCwUAMIGNMQsw CQYDVQQGEwJERTFFMEMGA1UECgw8VmVyZWluIHp1ciBGb2VyZGVydW5nIGVpbmVz IERldXRzY2hlbiBGb3JzY2h1bmdzbmV0emVzIGUuIFYuMRAwDgYDVQQLDAdERk4t UEtJMSUwIwYDVQQDDBxERk4tVmVyZWluIEdsb2JhbCBJc3N1aW5nIENBMB4XDTE5 MDQyNDE1NDk0MVoXDTIxMDcyNjE1NDk0MVowgYMxCzAJBgNVBAYTAkRFMRwwGgYD VQQIDBNOb3JkcmhlaW4tV2VzdGZhbGVuMQ8wDQYDVQQHDAZBYWNoZW4xFDASBgNV BAoMC1JXVEggQWFjaGVuMRIwEAYDVQQLDAlJVCBDZW50ZXIxGzAZBgNVBAMMEnNz by5yd3RoLWFhY2hlbi5kZTCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGB AJ8J8KJpxclkuMP22G1oQWmgZBp/F6uEwHMqTaPYr9EXV8LNlWJ/ytm85vNMCUJh IqIotZ8ZEB7BMkhBCikIIF+9ePa9iTNIk4F3Bl+sXM0hZIJKL994QpMHfrh0a+8n i33Kx9NDjMefG+pUV9gzBHB6KyaBiG+0Pfizpf0h9Ol0GtBPWBeHJyv5JNAhZkvY QBORvgyAc/O7CyQ1nEDHIESYdzKx96nhY+xtf68cbxmFzDWLWshxiZXh9YGABsFZ Fx+gAjorWjAxEVgv8BxRoGMhMRQxhUuZWKljZir234LNU5HdNfDOyDPz+dOz3jUB ZWy5X8IkNX3NvQjA6WegXMBQUKjD2WnX90Z0TU6exapp5USUU46P76SBtmoa0ZS8 3ZR88ftfFNN2okP1+CfxUDf+pzjMDUN54+gedbg6S9H9zR53RCPlOyvNsBMtA6gC +GcSsg5Bthb1PPB/qlGnzVrYqN+zfXf1hRHy87DTO50P2A+dCiluTK9vXzHwJXER IwIDAQABo4IFxzCCBcMwWQYDVR0gBFIwUDAIBgZngQwBAgIwDQYLKwYBBAGBrSGC LB4wDwYNKwYBBAGBrSGCLAEBBDARBg8rBgEEAYGtIYIsAQEEAwkwEQYPKwYBBAGB rSGCLAIBBAMJMAkGA1UdEwQCMAAwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQG CCsGAQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUTkEuy4Ym8vM1URhyxTXYSvSZ XXYwHwYDVR0jBBgwFoAUazqYi/nyU4na4K2yMh4JH+iqO3QwHQYDVR0RBBYwFIIS c3NvLnJ3dGgtYWFjaGVuLmRlMIGNBgNVHR8EgYUwgYIwP6A9oDuGOWh0dHA6Ly9j ZHAxLnBjYS5kZm4uZGUvZGZuLWNhLWdsb2JhbC1nMi9wdWIvY3JsL2NhY3JsLmNy bDA/oD2gO4Y5aHR0cDovL2NkcDIucGNhLmRmbi5kZS9kZm4tY2EtZ2xvYmFsLWcy L3B1Yi9jcmwvY2FjcmwuY3JsMIHbBggrBgEFBQcBAQSBzjCByzAzBggrBgEFBQcw AYYnaHR0cDovL29jc3AucGNhLmRmbi5kZS9PQ1NQLVNlcnZlci9PQ1NQMEkGCCsG AQUFBzAChj1odHRwOi8vY2RwMS5wY2EuZGZuLmRlL2Rmbi1jYS1nbG9iYWwtZzIv cHViL2NhY2VydC9jYWNlcnQuY3J0MEkGCCsGAQUFBzAChj1odHRwOi8vY2RwMi5w Y2EuZGZuLmRlL2Rmbi1jYS1nbG9iYWwtZzIvcHViL2NhY2VydC9jYWNlcnQuY3J0 MIIDXQYKKwYBBAHWeQIEAgSCA00EggNJA0cAdwBvU3asMfAxGdiZAKRRFf93FRwR 2QLBACkGjbIImjfZEwAAAWpQCeGNAAAEAwBIMEYCIQCS+2+Itdxob0jupwp33VA3 lYg42iOB8fhTQ1TFe5doCQIhAP7k2+poCC3LKK0SksS4AwflClLJV0jukyimG6er 0cMAAHYA7ku9t3XOYLrhQmkfq+GeZqMPfl+wctiDAMR7iXqo/csAAAFqUAnhdwAA BAMARzBFAiEA0/BOWnwB8cQdYi6CIJRdOzq0GVvmCU5q1/NvDfe+6xUCICSmMnmh NKjPFIXhahMeEdNWuIZaa+W5+v4eu3+2RbzaAHYAVYHUwhaQNgFK6gubVzxT8MDk OHhwJQgXL6OqHQcT0wwAAAFqUAnigwAABAMARzBFAiEA0OqKYt9gtJNA7uu098jN EEADAjMWv6kIdQsx9oZP6J8CIGTYwHIZpYuixqM5hZgzqypsGT1O11xcCndjf1Jk RUpIAHYAqucLfzy41WbIbC8Wl5yfRF9pqw60U1WJsvd6AwEE880AAAFqUAnhsgAA BAMARzBFAiEA7/OBFxJcP0up1eFV5NWnB8JjOmM9Z+9KcK7vfuCFDzsCIHd9zUDp JaMacRFzwN2Uvwx6QCNlB8jXub4kyVFyfVXjAHUApLkJkLQYWBSHuxOizGdwCjw1 mAT5G9+443fNDsgN3BAAAAFqUAnhhQAABAMARjBEAiB/e2co3MrynEcg9dCkzP2T Rx+Jwi032rCWRAPywdshgQIgMSaCBufeXucCisPwGaKNw+1dj7cw8QgR/QSo/nDp 6CcAdgC72d+8H4pxtZOUI5eqkntHOFeVCqtS6BqQlmQ2jh7RhQAAAWpQCeFmAAAE AwBHMEUCIEgUO1YSzlXnG+w9sBr927TEMeGTEKP8u7AZ86o3FerPAiEA8AUM80HK v2+ggjBaSbFvgTfz8Tq7+cwOZjWcnhSQRA8AdQBElGUusO7Or8RAB9io/ijA2uaC vtjLMbU/0zOWtbaBqAAAAWpQCeStAAAEAwBGMEQCIHrYjpbZzGCaml7z+rv3kRhS gjbdvjh5H0QKHDFDegsnAiAG33Wb5kzSz39q5eMr9qeFCXVhArWIXpDpMW4FZrtk RTANBgkqhkiG9w0BAQsFAAOCAQEASeFP/s5ypcqgNLs9nA8nB66yT+J/PmL8y6N3 EGcXVnhPcTp3AegY2hHyvktYK2Apv5Bf++N0BwHxp2Q/OwgN0RW0VYC1c86iebkf zyohRYSAsdjHgJNnjmwJ2uGkVa4SAJYie49tMYdA1cq6o6IqsyZOTOKWDyi2JH+6 PCUk1b+/8UQXM/dpdgPuwODnMsyxBb81O68ZqnD6BXWBIbmb0ZT6+avfsUyG31TL /gyXJTD1UBrTcuI8Z7IruuxWN0JRq9u8+ya1T4Dw7sUkoSqsKkXXG7m5DwC7hEel eUhkyenWEDu6foeufoSbhJJv2516XzFSkIj8NRvC8eKbxA7IuQ==

      -----END CERTIFICATE-----

    • Before the closing </ApplicationDefaults> add the following

      <ApplicationOverride id="app" entityID="https://sp.example.com/app">

          <Sessions lifetime="28800" timeout="3600" checkAddress="false"

                  handlerURL="/app/Shibboleth.sso" handlerSSL="true" cookieProps="https"> 

                 <SessionInitiator type="Chaining" Location="/Login" isDefault="true"

                     relayState="cookie" entityID="https://login.rz.rwth-aachen.de/shibboleth">

                     <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/>

                     <SessionInitiator type="Shib1" acsIndex="5" />

                 </SessionInitiator>

            </Sessions>

      </ApplicationOverride>

    • Add the certificates in the CredentialResolver for signing and encryption of SAML data

      <CredentialResolver type="File" key="/Pfad/zum/Private/Key.pem" certificate="/Pfad/zum/Zertifikat.pem"/>

    • Test if the configuration is loadable

      shibd -t

      With RHEL based systems (centOS etc) the LD_LIBRARY_PATH must be extended before: export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/shibboleth/lib64/

    • Restart the shibboleth service provider

      systemctl restart shibd

 Zusatzinformation

  • An example of a setup for protecting a subdirectory can be found here.

last changed on 04/28/2023

How did this content help you?

Creative Commons Lizenzvertrag
This work is licensed under a Creative Commons Attribution - Share Alike 3.0 Germany License
Chat