We have prepared two files with reasonable defaults for connecting an SP to SWAMID. One is for a shibboleth SP behind an Apache web server and the other is for a shibboleth SP behind an IIS web server. You should only need to change change EntityID and any other values containing the string example.org in the file to the public FQDN (Fully Qualified Domain Name) of your host. Note that registering a fully functional SP with SWAMID usually requires you to have a FQDN for your service in DNS that is visible on the public Internet. It is possible to register internal development instances in the SWAMID testing metadata that points to localhost or other internal DNS names but this is discouraged for production services.
If you have followed the installation guides in this wiki so far, you should rename the downloaded file, edit it and rename it to shibboleth2.xml and put it in the SHIB_HOME directory (/etc/shibboleth on linux c:\opt\shibboleth-sp\etc\shibboleth on Windows, if you haven't changed that during installation).
The
...
The swamid-IIS-shibboleth2.xml file can be downloaded here.
You can see the contents of the files in the code block below. All comments that is in the files above are filtered out.
...
latest published SWAMID example main configuration file for Shibboleth Service Provider 3 is published at mds.swamid.se/entity-configurations/Shibboleth-SP/v3/. Below is the latest versions included from the publication repository.
...
swamid-apache-shibboleth2.xml
...
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
clockSkew="180">
<!--
By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
are used. See example-shibboleth2.xml for samples of explicitly configuring them.
-->
<!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
<ApplicationDefaults entityID="https://swamidsp.example.org"
REMOTE_USER="eppn persistent-id targeted-id">
<!--
Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
You MUST supply an effectively unique handlerURL value for each of your applications.
The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
a relative value based on the virtual host. Using handlerSSL="true", the default, will force
the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.
Note that while we default checkAddress to "false", this has a negative impact on the
security of your site. Stealing sessions via cookie theft is much easier with this disabled.
-->
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="true" cookieProps="http">
<!--
Configures SSO for a default IdP. To allow for >1 IdP, remove
entityID property and adjust discoveryURL to point to discovery service.
If you use this, you have to remove the SessionInitiator below.
<SSO entityID="https://swamididp.example.org
discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
SAML2 SAML1
</SSO>
-->
<!-- SAML and local-only logout. -->
<Logout>SAML2 Local</Logout>
<SessionInitiator type="Chaining" Location="/DS/Login" id="swamid-ds-default" relayState="cookie">
<SessionInitiator type="SAML2" defaultACSIndex="1" acsByIndex="false" template="bindingTemplate.html"/>
<SessionInitiator type="Shib1" defaultACSIndex="5"/>
<SessionInitiator type="SAMLDS" URL="https://md.nordu.net/role/idp.ds"/>
</SessionInitiator>
<!--
md:AssertionConsumerService locations handle specific SSO protocol bindings,
such as SAML 2.0 POST or SAML 1.1 Artifact. The isDefault and index attributes
are used when sessions are initiated to determine how to tell the IdP where and
how to return the response.
-->
<md:AssertionConsumerService Location="/SAML2/POST" index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
conf:ignoreNoPassive="true"/>
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<!-- Status reporting service. -->
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<!-- Session diagnostic service. -->
<Handler type="Session" Location="/Session" showAttributeValues="false"/>
<!-- JSON feed of discovery information. -->
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
<!--
SimpleSign not allowed in SWAMID
-->
<!-- If needed - uncomment and edit -->
<!--
<md:AssertionConsumerService Location="/SAML2/Artifact" index="2"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
<md:AssertionConsumerService Location="/SAML2/ECP" index="3"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
<md:AssertionConsumerService Location="/SAML/POST" index="4"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
<md:AssertionConsumerService Location="/SAML/Artifact" index="5"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>
-->
<!-- LogoutInitiators enable SP-initiated local or global/single logout of sessions. Uncomment and edit if used -->
<!--
<LogoutInitiator type="Chaining" Location="/Logout" relayState="cookie">
<!-- No single logout: Solving "IdP doesn't support single logout protocol over a compatible binding" problem
<LogoutInitiator type="SAML2" template="/opt/ladok3/gui-httpd/libexec/shibboleth/etc/shibboleth/bindingTemplate.html"/>
<LogoutInitiator type="Local"/>
</LogoutInitiator>
<!-- md:SingleLogoutService locations handle single logout (SLO) protocol messages.
<md:SingleLogoutService Location="/SLO/SOAP"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
<md:SingleLogoutService Location="/SLO/Redirect" conf:template="/opt/ladok3/gui-httpd/libexec/shibboleth/etc/shibboleth/bindingTemplate.html"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
<md:SingleLogoutService Location="/SLO/POST" conf:template="/opt/ladok3/gui-httpd/libexec/shibboleth/etc/shibboleth/bindingTemplate.html"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
<md:SingleLogoutService Location="/SLO/Artifact" conf:template="/opt/ladok3/gui-httpd/libexec/shibboleth/etc/shibboleth/bindingTemplate.html"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
-->
<!-- md:ManageNameIDService locations handle NameID management (NIM) protocol messages. Edit and uncomment if needed.
<md:ManageNameIDService Location="/NIM/SOAP"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
<md:ManageNameIDService Location="/NIM/Redirect" conf:template="/opt/ladok3/gui-httpd/libexec/shibboleth/etc/shibboleth/bindingTemplate.html"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
<md:ManageNameIDService Location="/NIM/POST" conf:template="/opt/ladok3/gui-httpd/libexec/shibboleth/etc/shibboleth/bindingTemplate.html"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
<md:ManageNameIDService Location="/NIM/Artifact" conf:template="/opt/ladok3/gui-httpd/libexec/shibboleth/etc/shibboleth/bindingTemplate.html"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
-->
<!--
md:ArtifactResolutionService locations resolve artifacts issued when using the
SAML 2.0 HTTP-Artifact binding on outgoing messages, generally uses SOAP.
-->
<md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
</Sessions>
<!--
Allows overriding of error template information/filenames. You can
also add attributes with values that can be plugged into the templates.
-->
<Errors supportContact="webmaster@example.org"
helpLocation="/about.html"
styleSheet="/shibboleth-sp/main.css"/>
<!-- Example of remotely supplied batch of signed metadata. -->
<!-- SWAMID Metadata -->
<MetadataProvider
type="XML"
uri="http://md.swamid.se/md/swamid-idp-transitive.xml"
backingFilePath="swamid-testing-idp.xml" reloadInterval="300">
<SignatureMetadataFilter certificate="swamid-signer.crt"/>
</MetadataProvider>
<!-- Example of locally maintained metadata. -->
<!--
<MetadataProvider type="XML" file="partner-metadata.xml"/>
-->
<!-- Map to extract attributes from SAML assertions. -->
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
<!-- Use a SAML query if no attributes are supplied during SSO. -->
<AttributeResolver type="Query" subjectMatch="true"/>
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<!-- Simple file-based resolver for using a single keypair. -->
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
</ApplicationDefaults>
<!-- Policies that determine how to process and authenticate runtime messages. -->
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
<!-- Low-level configuration about protocols and bindings available for use. -->
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig>
without standard installation comments and examples
| Html-bobswift | ||||||
|---|---|---|---|---|---|---|
| ||||||
swamid-IIS-shibboleth2.xml without standard installation comments and examples
| Html-bobswift | ||||||
|---|---|---|---|---|---|---|
| ||||||
Errorhandling
The "<Errors .... /> assumes that http://example.org/about.html
| Code Block | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
clockSkew="180">
<ApplicationDefaults entityID="https://example.com/shibboleth"
REMOTE_USER="eppn persistent-id targeted-id"
metadataAttributePrefix="Meta-">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="true" cookieProps="https">
<Logout>SAML2 Local</Logout>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<Handler type="Session" Location="/Session" showAttributeValues="false"/>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
<md:AssertionConsumerService Location="/SAML2/POST"
index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
conf:ignoreNoPassive="true" />
<SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="default_ds" relayState="cookie">
<SessionInitiator type="SAML2" defaultACSIndex="1" acsByIndex="false" template="bindingTemplate.html"/>
<SessionInitiator type="Shib1" defaultACSIndex="5"/>
<SessionInitiator type="SAMLDS" URL="https://md.nordu.net/role/idp.ds"/>
</SessionInitiator>
</Sessions>
<Errors supportContact="webmaster@example.com"
helpLocation="/about"
styleSheet="/shibboleth-sp/main.css"/>
<MetadataProvider type="XML" uri="http://md.swamid.se/md/swamid-idp-transitive.xml"
backingFilePath="swamid-1.0.xml" reloadInterval="300">
<SignatureMetadataFilter certificate="md-signer.crt"/>
</MetadataProvider>
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
<AttributeResolver type="Query" subjectMatch="true"/>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
</ApplicationDefaults>
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig> |
This example assumes that http://example.com/about leads to some form of help page and that webmaster@example.com is org is the right contact address for your service. Change according to taste.
Additional setup steps
After you save this file as /etc/shibboleth/shibboleth2.xml, download https://mdmds.swamid.se/md/md-signersigner2.crt and save as /etc/shibboleth/md-signer.crt (or your windows equivalent). Take care to verify the fingerprint of this certificate as published on https://mdmds.swamid.se/md/. Finally you must generate a keypair for your SP. This keypair is not the same as the certificate of your service and is used to secure SAML protocol messages between SWAMID IdPs and your service. Usually you do this by running the following command
...