Versionen im Vergleich

Alte Version 3

changes.mady.by.user Peter Brand

Gespeichert am

verglichen mit

Neue Version Aktuell

changes.mady.by.user Brand Peter

Gespeichert am

Schlüssel

  • Diese Zeile wurde hinzugefügt.
  • Diese Zeile wurde entfernt.
  • Formatierung wurde geändert.

...

Info
iconfalse

The following is an example of a complete set of instructions for the installation and basic configuration of a current Shibboleth 4.x IDP on Debian 10 11 ("BusterBullseye"), using Java 11 and Tomcat 9. (Alternatively Ubuntu 18.04 LTS can also be used without any changes to the steps described in this guide.)

Hinweis
titleUbuntu no longer viable

Unfortunately Ubuntu is no longer a viable platform for deploying the Shibboleth IDP (or anything else that requires secure operation, for that matter): It has become evident that Ubuntu does not provide security updates for Tomcat, see e.g. the lack of available fixes for CVE-2025-24813 for Tomcat 9 and Tomcat 10. There is no point in running an OS from a vendor that does provide you with applications but does not provide you with security fixes for those applications!
Debian on the other hand does and did provide security fixes for that same vulnerability for their current "stable" and previous "oldstable" releases of their OS.

false
Warnung
Warnung
icon
titleWhat about RHEL/CentOS?

See out notes on deploying the Shibboleth IDPv3 IDP on RHEL/CentOS for our take on the (unfortunate) status quo.

The installation instructions provided in this guide are specific to a deployment without Apache httpd, using Apache Tomcat both as Java Servlet Container and as TLS/SSL-enabled webserver. Do not follow these installtion instructions if you're determined to use Apache httpd (which is also possible, but sufficiently documented elsewhere) – though you can still follow the rest of our documentation (for metadata, resolver, filter, etc. configuration).

There is no point in duplicating the existing Shibboleth IDP 4.x documentation. The installation part of this guide is complete but the guide for configuration of a Shibboleth IDP is necessarily incomplete, as deployments can vary significantly and the IDP has tons of (optional) advanced features. Please use the upstream documentation for further steps or more advanced configurations, as hinted at below.

...

  1. Install and configure Java and Tomcat as webserver with TLS/SSL support, running Tomcat and the JVM as non-root user
  2. Install the Shibboleth IDP software and integrate it with Tomcat
  3. Load SAML Metadata using the eduID.at Metadata and eduID.at Metadata Verification Key
    • For new eduID.at members: Send a copy of your IDP Metadata (by default in /opt/shibboleth-idp/metadata/idp-metadata.xml) to the eduID.at Operations Team, ideally signed with your S/MIME or OpenPGP key.
  4. Configuring authentication & attribute lookup and generation is somewhat site-dependent
  5. Configure attribute release filters, including controlled, automated scalable attribute release based on Service CategoriesAdd support for pairwise-id ("service-specific pseudonyms") and subject-id

Upstream documentation

Until more steps/topics are covered in the instructions in this wiki please refer to the upstream documentation and engage with the community:

Info
iconfalse

Please make use of the eduID.at community which has been configuring and running Shibboleth IPDs IDPs for over a decade by now! The Contact page has the details for the eduid-discuss mailing list which should be able to help you with any and all problems in this space (Shibboleth IDP-related or with related maybe even Identity and Access Management issues).

The Shibboleth Wiki has many more suggestions of what to do, esp in the IDP Configuration overview and in the Productionalization sections.
You will also want to do the following:

...