Versionen im Vergleich

Alte Version 1

changes.mady.by.user Peter Brand

Gespeichert am

verglichen mit

Neue Version Aktuell

changes.mady.by.user Peter Brand

Gespeichert am

Schlüssel

  • Diese Zeile wurde hinzugefügt.
  • Diese Zeile wurde entfernt.
  • Formatierung wurde geändert.
Kommentar: more promiment testing link

...

Adjust /opt/shibboleth-idp/conf/ldap.properties to taste, according to section "Basic General Configuration" from the documentation.

Hinweis
iconfalse
titleAdditional steps for LDAPS

If you're using LDAPS to connect to your LDAP servers (use of LDAP+STARTTLS shouldn't need anything special) be sure to also follow the steps mentioned in the LDAPonJava>8 documentation in the Shibboleth wiki, i.e. within your conf/ldap.properties config file ensure the following:

  • no trailing slash on any of your ldapURL values
  • no blanks/spaces in any of the LDAP filters
  • set the property to use the UnboundID LDAP provider

After changes to (any) property files you'll need to restart the whole container (i.e., Tomcat) for the changes to become active:

The properties file /opt/shibboleth-idp/credentials/secrets.properties by default contains the setting idp.authn.LDAP.bindDNCredential to be used for the password of the administrative account performing LDAP binds. In case you're planning to use the bindSearchAuthenticator authentication strategy in your ldap.properties (with a given idp.authn.LDAP.bindDN) make sure to set the corresponding password for that DN in credentials/secrets.properties!

If OTOH you intend to use the anonSearchAuthenticator in ldap.properties (only anonymous binds will be made to the configured LDAP server/s) be sure to remove the principal and principalCredential XML attributes from your LDAP DataConnector in your /opt/shibboleth-idp/conf/attribute-resolver.xml (as included in our documentation and also in conf/examples/attribute-resolver-ldap.xml).


systemctl restart tomcat9
Tipp
Kein Format

In order to test/verify your authentication configuration

...

use the

...

methods described in our Testing an IDP documentation.


Further reading for more advanced needs:

...

E.g. you may be interested in the automated account lockout feature (even though this allows anyone to DoS individual accounts simply by repeatedly providing an incorrect passwort for given accounts), see Account Lockout under Advanced Features in the Shibboleth IDP documentation. In the simplest case you just need to uncomment the bean with id="shibboleth.authn.Password.AccountLockoutManager" in the file /opt/shibboleth-idp/conf/authn/password-authn-config.xml (and optionally adjust the parameters to taste). The page for Account Lockout Management explains how to lock/unlock accounts via HTTP and therefore also from the command line using cURL.

As always, after changes to any property files you'll need to restart the whole container (i.e., Tomcat) for the changes to become active:

Kein Format
systemctl restart tomcat9