Page History
...
| Info | ||||
|---|---|---|---|---|
| ||||
|
As always, use the provided Metadata Verification Key to make sure the metadata is authentic and hasn't been tampered with.
For the Shibboleth SP check out the complete configuration examples provided.
...
The Shibboleth SP software in particular has an issue only affecting its first start, when no previously downloaded, validated and cached metadata is available locally. The Shibboleth wiki provides some ways of dealing with that (e.g. by adding a configuration snippet that disables systemd's process start timeout). Also manually starting shibd before (re-)restarting it via the service manager (systemd or otherwise) should take care of that issue.
Be sure to follow our configuration examples, particularly with regards to the verifyBackup="false" setting on the Signature MetadataFilter.
IDP Discovery
In order to log in to a federated service the subject needs to be able to select the IDP they want to log in with/from. The most useful and obvious way to do this is by presenting the subject with a user interface to select/find their organisation by name.
Manually managing lists of of Identity Providers users may log in from does not scale, is not sufficiently dynamic (IDPs' names and/or logos may change over time) and may also not provide a a proper user experience. It will therefore be necessary to deploy or utilise some kind of of IDP discovery service, using additional software components which allow subjects to easily choose their preferred IDPs(s) from those available via interfederation. .
(The eduID.at Demo SP currently demonstrates use of 3 different IDP discovery interfaces.
...
A real production service would of course not do this.)
External discovery services
If all else fails you You can always make use of one of the central "fallback" discovery interface provided by ACOnet or Seamless Access.
| Note | ||
|---|---|---|
| ||
Using the fallback an external discovery service is is not recommended as it sends users away from the service (which may be seen as disrupting the access process) and may confuse users due to different designs at the Service Provider, the central IDP Discovery Service and again at the Identity Provider. |
There's currently one central "fallback" IDP Discovery Service avalable within eduID.at that's Interfederation-enabled:
| Info | ||||
|---|---|---|---|---|
| ||||
This instance of the SWITCHwayf software may be more familiar to subjects from ACOnet institutions since older versions have been in use since 2007. This software still works (without its dynamic features) when JavaScript is disabled in the web browser (though not much else on the web will work in such a setup).
On the plus side, external discovery services usually implement the relevant specifications and may have performed usability testing of their interfaces which may not be the case (or may be too much work when done properly) for home-grown/ad-hoc implementations. |
See See Discovery Services for more, including references to Seamless Access.
...
Consider handling any access errors due to missing attributes as gracefully as possible. That includes giving precise instructions to the subject on what failed, why and what to do about it. Using information from SAML metadata support or technical contact data for the IDP should be offered.TODO: More technical information to come, see this example from the eduGAIN Wiki for a demonstration.
Notify ACOnet
To make your Service Provider available to subjects from other interfederated institutions contact ACOnet in order for your entity to become visible to eduGAIN (and from there to other eduGAIN-participating federations and institutions).
Overview
Content Tools
Tasks