Installing SP2.x under OSX: Difference between revisions

From RavenWiki
Jump to navigationJump to search
(Created page with "'''This page is still a work in progress. Caveat emptor and all that...''' ==Installing/Configuring Shibboleth for OS Server 10.5.6== ====Install MacPorts & Shibboleth==== Do...")
 
No edit summary
 
(17 intermediate revisions by the same user not shown)
Line 1: Line 1:
'''This page is still a work in progress. Caveat emptor and all that...'''
==Installing/Configuring Shibboleth for OS Server 10.6.8==


==Installing/Configuring Shibboleth for OS Server 10.5.6==
Legacy info here: [[Installing SP2.x under MacOS]]


====Install MacPorts & Shibboleth====  
===Install MacPorts & Shibboleth===
 
====Method 1====
 
Download and install OS X Developer Tools from https://developer.apple.com (you may need to create an account first)


Download Mac Ports from http://www.macports.org/install.php and install the .pkg
Download Mac Ports from http://www.macports.org/install.php and install the .pkg
Line 9: Line 13:
Open Terminal and type:
Open Terminal and type:


<tt>$ sudo port install curl +ssl </tt>
<tt>sudo port selfupdate</tt>


<tt>$ sudo port install shibboleth</tt>
<tt>sudo port install shibboleth</tt>


'''The installation of Shibboleth and supporting software will take some time.'''
'''The installation of Shibboleth and supporting software will take some time.'''


====Retreive the Shibboleth profiles====
====Method 2====
 
<tt>$ cd /opt/local/</tt>
 
<tt>$ sudo curl http://shibboleth.internet2.edu/downloads/shibboleth/cppsp/latest/mac/ports.tar | tar xv</tt>
 
Edit /opt/local/etc/macports/sources.conf and add in:
 
<pre>file:///opt/local/ports [nosync]</pre>
 
before the line:
 
<pre>rsync://rsync.macports.org/release/ports/ [default]</pre>
 
This enables Mac Ports access to the non-standard software repository containing Shibboleth.
 
====For first time installs only====
 
Duplicate the standard config files and create the key pair.
 
<tt>$ cd /opt/local/etc/shibboleth</tt>
 
<tt>$ ls -1 *.dist | sed -e 's/\.dist//' | xargs -I % sudo cp "%.dist" "%"</tt>
 
<tt>$ sudo sh ./keygen.sh</tt>
 
As the default permissions for the cert files causes Shibboleth to fail they need changing:
 
<tt>$ sudo chmod 740 sp-key.pem</tt>
 
<tt>$ sudo chmod 644 sp-cert.pem</tt>
 
====Disabling Intel 64 bit architecture for Apache====
 
Shibboleth is currently not compatible with the 64 bit architecture available on newer Macs. To check run the following command in Terminal:
 
<tt>$ sysctl hw.cpu64bit_capable</tt>
 
If the result is 1 then do the following steps, otherwise skip to the 'Create the Shibboleth log file' section
 
<tt>$ sudo emacs /usr/sbin/apachectl</tt>
 
change HTTPD variable from:
 
<pre>HTTPD='/usr/sbin/httpd'</pre>


to:
Install the package from ftp://ftp.csx.cam.ac.uk/cam_only/Mac/OSX/Misc/shibboleth-2.4.3.dmg. This software is built for 32/64 bit intel and should work on 10.5 and later.


<pre>HTTPD='arch -i386 /usr/sbin/httpd'</pre>
Once installed you need to create the OpenSSL certificates:


Add the following 2 lines to the <array> element in /System/Library/LaunchDaemons/org.apache.httpd.plist:
<tt>sudo /opt/local/etc/shibboleth/keygen.sh</tt>
<pre>
<string>arch</string>
<string>-i386</string>
</pre>
The array element should look like this when done:
<pre>
<array>
                <string>arch</string>
                <string>-i386</string>
                <string>/usr/sbin/httpd</string>
                <string>-D</string>
                <string>FOREGROUND</string>
        </array>
</pre>


====Create the Shibboleth log file====
===Enable SSL===
 
<tt>$ sudo touch /opt/local/var/log/httpd/native.log</tt>
 
<tt>$ sudo chown _www /opt/local/var/log/httpd/native.log</tt>
 
====Ensure SSL is enabled for the website====


Using Server Admin select Web | Sites pane, choose the website and enable SSL from the security tab
Using Server Admin select Web | Sites pane, choose the website and enable SSL from the security tab


====Configuring Apache====
===Configure Apache===


Add the following to the /etc/apache2/httpd.conf file:
Add the following to the /etc/apache2/httpd.conf file:
Line 99: Line 39:
If you are not using apache v2.2 then edit the above line appropriately according to the contents of the /opt/local/etc/shibboleth/ directory.
If you are not using apache v2.2 then edit the above line appropriately according to the contents of the /opt/local/etc/shibboleth/ directory.


Ensure that the ''ServerName'' directive is set correctly and ''UseCanonicalName'' is set to ''On''
Ensure that the ''ServerName'' directive is set correctly and ''UseCanonicalName'' is set to ''On'' in /etc/apache2/httpd.conf


====Download the Shibboleth configuration templates====
===Configure Shibboleth===


<tt>$ cd /opt/local/etc/shibboleth/</tt>
<tt>$ cd /opt/local/etc/shibboleth/</tt>
Line 117: Line 57:
A correctly configured install will return 'overall configuration is loadable, check console for non-fatal problems'. If not, check syntax and try again.
A correctly configured install will return 'overall configuration is loadable, check console for non-fatal problems'. If not, check syntax and try again.


====Starting the service====
===Starting the service===


Set shib to load at startup:
Set shib to load at startup:


<tt>$ sudo launchctl load -w /Library/LaunchDaemons/org.macports.shibd.plist</tt>
<tt>$ sudo launchctl load -w /opt/local/etc/LaunchDaemons/org.macports.shibd/org.macports.shibd.plist</tt>


Start Apache:
Start Apache:


<tt>$ sudo apachectl start</tt>
<tt>$ sudo serveradmin start web</tt>


Before you can proceed any further you will need to register you SP, at least with Raven. See [[SP registration]] for details
Before you can proceed any further you will need to register you SP, at least with Raven. See [[SP registration]] for details


Test your page!
Test your page by going to https://your.server.cam.ac.uk/secure


====Reloading the service====
===Reloading the service===


Any changes to the shib config may require ''both'' shibd and apache to be reloaded:
Any changes to the shib config require shibd and apache to be reloaded:


<tt>$ sudo launchctl unload -w /Library/LaunchDaemons/org.macports.shibd.plist</tt>
<tt>sudo launchctl unload -w /opt/local/etc/LaunchDaemons/org.macports.shibd/org.macports.shibd.plist</tt>


<tt>$ sudo launchctl load -w /Library/LaunchDaemons/org.macports.shibd.plist</tt>
<tt>sudo launchctl load -w /opt/local/etc/LaunchDaemons/org.macports.shibd/org.macports.shibd.plist</tt>


<tt>$ sudo apachectl restart</tt>
<tt> sudo apachectl restart</tt>


You may care to script this to save your sanity when making lots of changes/testing..
You may care to script this to save your sanity when making lots of changes/testing..


====Logging====
===Logging===


Check the following locations for logging info:
Check the following locations for logging info:
Line 150: Line 90:


/opt/local/var/log/shibboleth/transaction.log
/opt/local/var/log/shibboleth/transaction.log
/opt/local/var/log/shibboleth/shibd_warn.log


/var/log/apache2/access.log
/var/log/apache2/access.log
Line 155: Line 97:
/var/log/apache2/error.log
/var/log/apache2/error.log


====More information====
===More information===


Most of this document was cribbed together from the following sources:
Most of this document was cribbed together from the following sources:

Latest revision as of 08:19, 9 July 2012

Installing/Configuring Shibboleth for OS Server 10.6.8

Legacy info here: Installing SP2.x under MacOS

Install MacPorts & Shibboleth

Method 1

Download and install OS X Developer Tools from https://developer.apple.com (you may need to create an account first)

Download Mac Ports from http://www.macports.org/install.php and install the .pkg

Open Terminal and type:

sudo port selfupdate

sudo port install shibboleth

The installation of Shibboleth and supporting software will take some time.

Method 2

Install the package from ftp://ftp.csx.cam.ac.uk/cam_only/Mac/OSX/Misc/shibboleth-2.4.3.dmg. This software is built for 32/64 bit intel and should work on 10.5 and later.

Once installed you need to create the OpenSSL certificates:

sudo /opt/local/etc/shibboleth/keygen.sh

Enable SSL

Using Server Admin select Web | Sites pane, choose the website and enable SSL from the security tab

Configure Apache

Add the following to the /etc/apache2/httpd.conf file: 

Include /opt/local/etc/shibboleth/apache22.config

If you are not using apache v2.2 then edit the above line appropriately according to the contents of the /opt/local/etc/shibboleth/ directory.

Ensure that the ServerName directive is set correctly and UseCanonicalName is set to On in /etc/apache2/httpd.conf

Configure Shibboleth

$ cd /opt/local/etc/shibboleth/

$ sudo curl http://raven.cam.ac.uk/project/shibboleth/files/config/shibboleth2.xml-UCAMSKEL -o shibboleth2.xml

$ sudo curl http://raven.cam.ac.uk/project/shibboleth/files/config/attribute-map.xml-UCAMSKEL -o attribute-map.xml

Edit the config files and look for the FIX-ME flags highlighting required edits to the files. See https://wiki.csx.cam.ac.uk/raven/Shibboleth_documentation_and_HOWTOs#Deploying_Shibboleth_SPs_in_the_University for more info.

Once configured check the syntax with:

$ /opt/local/sbin/shibd -t

A correctly configured install will return 'overall configuration is loadable, check console for non-fatal problems'. If not, check syntax and try again.

Starting the service

Set shib to load at startup:

$ sudo launchctl load -w /opt/local/etc/LaunchDaemons/org.macports.shibd/org.macports.shibd.plist

Start Apache:

$ sudo serveradmin start web

Before you can proceed any further you will need to register you SP, at least with Raven. See SP registration for details

Test your page by going to https://your.server.cam.ac.uk/secure

Reloading the service

Any changes to the shib config require shibd and apache to be reloaded:

sudo launchctl unload -w /opt/local/etc/LaunchDaemons/org.macports.shibd/org.macports.shibd.plist

sudo launchctl load -w /opt/local/etc/LaunchDaemons/org.macports.shibd/org.macports.shibd.plist

sudo apachectl restart

You may care to script this to save your sanity when making lots of changes/testing..

Logging

Check the following locations for logging info:

/opt/local/var/log/shibboleth/shibd.log

/opt/local/var/log/shibboleth/transaction.log

/opt/local/var/log/shibboleth/shibd_warn.log

/var/log/apache2/access.log

/var/log/apache2/error.log

More information

Most of this document was cribbed together from the following sources:

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMacInstall

https://wiki.csx.cam.ac.uk/raven/Shibboleth_documentation_and_HOWTOs#Deploying_Shibboleth_SPs_in_the_University

Retrieved from "https://wiki.cam.ac.uk/wiki/raven/index.php?title=Installing_SP2.x_under_OSX&oldid=2534"