Seitenhistorie
eduID.at installation guide for the Shibboleth IDP
...
4
| Info | ||
|---|---|---|
| ||
The following is an example of a complete set of instructions for the installation and basic configuration of a current Shibboleth 34.x IDP on Debian 10 ("Buster"), using Java 11 and Tomcat 9. (Alternatively Ubuntu 18.04 LTS can also be used without any changes to the steps described in this guide.) |
...
| Warnung | ||||
|---|---|---|---|---|
| ||||
See out notes on deploying the Shibboleth IDPv3 on RHEL/CentOS for out our take on the (unfortunate) status quo. |
...
There is no point in duplicating the existing Shibboleth IDP 34.x documentation. The installation part of this guide is complete but the guide for configuration of a Shibboleth IDP is necessarily incomplete, as deployments can vary significantly and the IDPv3 IDP has tons of (optional) advanced features. Please use the upstream documentation for further steps or more advanced configurations, as hinted at below.
...
- Install and configure Java and Tomcat as webserver with TLS/SSL support, running Tomcat and the JVM as non-root user
- Install the Shibboleth IDP software and integrate it with Tomcat
- Load SAML Metadata using the eduID.at Metadata and eduID.at Metadata Verification Key
- For new eduID.at members: Send a copy of your IDP Metadata (by default in
/opt/shibboleth-idp/metadata/idp-metadata.xml) to the eduID.at Operations Team, ideally signed with your S/MIME or OpenPGP key.
- For new eduID.at members: Send a copy of your IDP Metadata (by default in
- Configuring authentication & attribute lookup is somewhat site-dependent
- Configure attribute release filters, including controlled, automated attribute release based on Service Categories
- Add support for pairwise-id ("service-specific pseudonyms") and subject-id
Upstream documentation
Until more steps/topics are covered in the instructions in this wiki please refer to the upstream documentation and engage with the community:
...
The Shibboleth Wiki has many more suggestions of what to do, esp in the IDP Configuration overview and in the Productionalization sections.
You will also want to do the following:
- Adjust Logging
- Customize the IDP's login page for Username/Password authentication, to match your institution's design.
- Look at the Consent functionality and make a plan where/when (not) to enable/disable this
- This also relates to attribute release strategies and should be considered together with those
- Consider using translated messages from the IDP software, possibly also locally adapting them as needed (
de_AT, anyone?)
...
Überblick
Inhalte
Aufgabenbericht