Installation and Configuration Valéry Tschopp,

Transcription

1 Installation and Configuration Valéry Tschopp, 2005 SWITCH

2 Deployment Guides HOWTOs and Guides Shibboleth Target Deployment Guides Apache Compilation and Installation on Linux (debian stable) Compilation and Installation on Solaris Configuration Guide for Linux and Solaris IIS Deployment Guide for Windows 2

3 What you need to get... Shibboleth Install Package: Sample configuration files for SWITCHaai SWITCHpki certificate for your Web Server 3

4 SWITCHaai Settings shibboleth.switchaai.xml Identifier in <Applications> providerid=urn:mace:switch.ch:switchaai:pilot:{hostname} SWITCHpki Server Certificate Location in <Credentials> /etc/apache/ssl.key/{hostname}.key /etc/apache/ssl.crt/{hostname}.crt Error Pages Customization in <Errors> supportcontact={contact_ } HTML pages, logo and stylesheet SWITCHaai Federation Metadata {FederationProvider} for sites.switchaai.xml {TrustProvider} for trust.switchaai.xml {AAPProvider} for AAP.switchaai.xml 4

5 SWITCHaai Settings specific for IIS IIS specific settings in shibboleth.xml Protected Web Locations in <RequestMapProvider> (Access Rules Configuration) IIS Site ID Mapping in <Implementation> 5

6 Federation Metadata SWITCHaai Federation Metadata Accepted Certification Authority certificates within SWITCHaai trust.xml Home Organizations participating within SWITCHaai sites.xml More information: 6

7 Federation Metadata - Auto-Updates Siterefresh Shell script (Standard Linux shell / Windows Cygwin) Automatical updates of the Federation Metadata (sites.xml / trust.xml) Security given by verification of the files signatures Get the script and documentation: 7

8 Authorization with Apache Patrik Schnellmann, 2005 SWITCH

9 Apache Software Components Apache Webserver Shibboleth Target (mod_shib) Tomcat Connector (mod_jk) PHP (mod_php) Apache mod_shib mod_php mod_jk Modules Shibboleth Target (SHAR) SHAR Dynamic Web Pages (PHP, Java, ) PHP Application Java Application 1 Tomcat Java Application 2 9

10 Using access rules Login: demostudent PW: demo Web Server SWITCHaai Test Home Organization affiliation: student homeorganizationtype: others Shibboleth Component Access Rule: Affiliation = Student HomeOrgType = Not VHO 10

11 Static Authorization in Apache Rules in httpd.conf or.htaccess for Shibboleth Target Any AAI user <Location /secure> AuthType shibboleth ShibRequireSession On require valid-user </Location> One specific user <Location /restricted> AuthType shibboleth ShibRequireSession On require uniqueid </Location> All students without VHO <Location /secure> AuthType shibboleth ShibRequireSession On require affiliation student require homeorganizationtype ~ ^[^vv][^hh][^oo] </Location> Reference: 11

12 Authorization with IIS Patrik Schnellmann, 2005 SWITCH

13 Software Components IIS Web Server Shibboleth Target (isapi_shib) isapi_shib Web Server ISAPI Filter CGI ISAPI Extension Shibboleth Target (SHAR) SHAR Tomcat via JK (isapi redirector) Tomcat Dynamic Web Pages (ASP, Java, PHP, ) PHP Application ASP Application Java Application 13

14 Configuring Access Rules in IIS Rules in shibboleth.xml for Shibboleth Target <RequestMap applicationid="default"> <Host name= some.host.ch"> <Path name="secure" requiresession="true" exportassertion="false"> </Path> </Host> </RequestMap>... isapi_shib filter forces Shibboleth authentication on requests for files in equivivalent to setting require valid-user in Apache 14

15 Access Rules Management with IIS AAI Inscription at first visit AAI Protected Area Checks if user already exists No: Attributes checking Yes Swepuid Local users Database Restricted Area Waiting List autologin Personal Information Services Content Courtesy of ISREC, Yan Corneille, Pascal Py 15

16 Questions? Q & A aai@switch.ch 16