Shibboleth documentation and HOWTOs: Difference between revisions

From RavenWiki
Jump to navigationJump to search
No edit summary
 
(24 intermediate revisions by 5 users not shown)
Line 1: Line 1:
{{New Docs}}
= NOTE: Version 2 of the Service Provider has been deprecated by the software maintainers, AND we are now running version 3 of the IdP =
==Deploying Shibboleth SPs in the University==
==Deploying Shibboleth SPs in the University==


Information (sketchy at present) about deploying Shibboleth SPs within the University, either just to protect sites with Raven or with a view to joining the UK federation and potentially letting in people from other institutions. This information is intended to support the deployment of [http://shibboleth.internet2.edu/shib-v2.0.html Internet2's SP software version 2.1] - other versions of this, and other software, should work but the Computing Service is currently limited as to the amount of support it can provide on these. Note that version 1.3 of Internet2's SP software is EOL as from 30th June, 2010.


The definitive documentation for all this starts with the [https://spaces.internet2.edu/display/SHIB2/Home Internet2 Shib2 wiki] (in particular the [https://spaces.internet2.edu/display/SHIB2/Installation installation] and [https://spaces.internet2.edu/display/SHIB2/Configuration configuration] pages). Almost everything you might need will be here, but you may need to explore - try following any and all links that look even vaguely useful.


For deploying an SP in the UK federation, see the [http://www.ukfederation.org.uk/ UK federation website], and in particular the 'Shibboleth 2' section of [http://www.ukfederation.org.uk/content/Documents/Registration Entity registration].
 
 
This page provides information about deploying Shibboleth Service Providers (SPs) within the University, either just to protect sites with Raven or with a view to joining the UK federation and potentially letting in people from other institutions.
 
It is hoped the information on these pages will furnish the Reader with enough information to deploy Shibboleth Service Provider software to interact with the Shibboleth IdP version 3 - run by the Access and Identity Services team (within the UIS).
 
 
Note that, unlike when using the local Ucam WebAuth protocol (i.e. 'classic Raven'), Shib SPs need to be registered with Raven before it will provide them with service. This can be achieved either by registering with the local unofficial Ucam federation (which will allow authentication via Raven but little else), or by registering with the UK Access Management Federation. See [[SP registration]] for details. [Prior to 2012, Raven provided limited support for unregistered entities - this is no longer the case].
 
These documents are intended for the system administrator that will be installing and maintaining a Shibboleth service provider in the University of Cambridge. This may be a different person than the application developer who will actually be using the attributes which Shibboleth delivers, though they may find some of this information relevant as well. The following basic skills are expected of the reader, and are beyond the scope of what these documents attempts to cover:
* familiarity with the local operating system, including how to install software (on some UNIX systems this may involve compiling packages from source code)
* configuring the local web server (Apache, IIS, etc)
* basic understanding of XML documents (but see [[Editing XML]] for some hints)
 
In addition, a basic understanding of SSL, including how to generate a key and CSR, will be required for many deployment options.


===Instructions===
===Instructions===


*[[Shibboleth installation: Intended Audience, Prerequisites, etc.|Intended Audience, Prerequisites, etc.]]
* [https://www.switch.ch/aai/guides/sp/installation/ Installing SP3 for Linux, MacOS and Windows]
* [[Installing SP3.x under Linux]]
* [[Installing SP3.x under Windows]]
* [[Installing SP3.x for Apache under Windows]]
* [[Installing SP3.x under OSX]]


* [[Installing SP2.1 under Linux]]
* [[SP registration]]
* [[Installing SP2.1 under Windows]]
* [[Installing SP2.1 under MacOS]]


* [[SP registration]]
* [[Configuring Shibboleth access control|Configuring access control]]
* [[Configuring Shibboleth access control|Configuring access control]]
* [[Virtual hosting issues with Shibboleth|Virtual hosting issues]]
* [[Virtual hosting issues with Shibboleth|Virtual hosting issues]]
* [[Configuring other Shibboleth SPs]]


===Additional information===
===Additional information===


* [[Editing XML]]
* [[Editing XML]]
* [[EntityIDs]]
* [[Choosing EntityIDs]]
* [[SP Metadata]]
* [[Attributes released by the Raven IdP]]
* [[Attributes released by the Raven IdP]]
* [[SSL, certificates and security with Shibboleth|SSL, certificates and security]]
* [[SSL, certificates and security with Shibboleth|SSL, certificates and security]]
* [[Shibboleth FAQs|FAQs]]
===Resources===
* [['Ucam Federation' IdP metadata]]
* [[shibboleth2.xml - internal use skeleton]]
* [[attribute-map.xml - internal use skeleton]]
- - - -
== DEPRECATED SP v2 ==
'''Please note these instructions are left here for those interested, but are aimed at the DEPRECATED SP version 2'''
This information is intended to support the deployment of [http://shibboleth.net/products/service-provider.html version 2.x of the Shib SP software] originally developed by [http://www.internet2.edu/ Internet2] but now managed by [http://shibboleth.net/ the Shibboleth Consortium] - other  software, including anything supporting appropriate versions of SAML, should also work but University Information Services has limited direct experience of anything else. Note that earlier versions of the Shibboleth software have reached end of life and should be avoided.
The definitive documentation for all this starts with the [http://shibboleth.net/products/service-provider.html Shib Consortium SP software page] and the [https://wiki.shibboleth.net/confluence/display/SHIB2/Installation installation] and [https://wiki.shibboleth.net/confluence/display/SHIB2/Configuration configuration] pages in the Shib Wiki. Almost everything you might need will be here, but you may need to explore - try following any and all links that look even vaguely useful. The [http://shibboleth.net/community/lists.html Shibboleth-Users] mailing list can be a useful resource, as can its archives (but be sure you are finding fresh information - the archives go back a long way). 
===Instructions===
* [[Installing SP2.x under Linux]]
* [[Installing SP2.x under Windows]]
* [[Installing SP2.x for Apache under Windows]]
* [[Installing SP2.x under OSX]]


===Resources===
===Resources===


* [['Ucam Federation' IdP metadata]]
* [['Ucam Federation' IdP metadata]]
* [[shibbileth2.xml - internal use skeleton]]
* [[shibboleth2.xml - internal use skeleton]]
* [[attribute-map.xml - internal use skeleton]]
* [[attribute-map.xml - internal use skeleton]]


Line 35: Line 80:


* [[A University Shibboleth Glossary]]
* [[A University Shibboleth Glossary]]
* [[Athens Gateway access control]]
* [[Electronic journal access control]]


==Shibboleth Implementation Project documents==
==Shibboleth Implementation Project documents==

Latest revision as of 11:40, 3 March 2020

We're working on improving Raven resources for developers and site operators.

Try out the new Raven documentation for size.

NOTE: Version 2 of the Service Provider has been deprecated by the software maintainers, AND we are now running version 3 of the IdP

Deploying Shibboleth SPs in the University

This page provides information about deploying Shibboleth Service Providers (SPs) within the University, either just to protect sites with Raven or with a view to joining the UK federation and potentially letting in people from other institutions.

It is hoped the information on these pages will furnish the Reader with enough information to deploy Shibboleth Service Provider software to interact with the Shibboleth IdP version 3 - run by the Access and Identity Services team (within the UIS).


Note that, unlike when using the local Ucam WebAuth protocol (i.e. 'classic Raven'), Shib SPs need to be registered with Raven before it will provide them with service. This can be achieved either by registering with the local unofficial Ucam federation (which will allow authentication via Raven but little else), or by registering with the UK Access Management Federation. See SP registration for details. [Prior to 2012, Raven provided limited support for unregistered entities - this is no longer the case].

These documents are intended for the system administrator that will be installing and maintaining a Shibboleth service provider in the University of Cambridge. This may be a different person than the application developer who will actually be using the attributes which Shibboleth delivers, though they may find some of this information relevant as well. The following basic skills are expected of the reader, and are beyond the scope of what these documents attempts to cover:

  • familiarity with the local operating system, including how to install software (on some UNIX systems this may involve compiling packages from source code)
  • configuring the local web server (Apache, IIS, etc)
  • basic understanding of XML documents (but see Editing XML for some hints)

In addition, a basic understanding of SSL, including how to generate a key and CSR, will be required for many deployment options.

Instructions

Additional information

Resources


- - - -

DEPRECATED SP v2

Please note these instructions are left here for those interested, but are aimed at the DEPRECATED SP version 2

This information is intended to support the deployment of version 2.x of the Shib SP software originally developed by Internet2 but now managed by the Shibboleth Consortium - other software, including anything supporting appropriate versions of SAML, should also work but University Information Services has limited direct experience of anything else. Note that earlier versions of the Shibboleth software have reached end of life and should be avoided.

The definitive documentation for all this starts with the Shib Consortium SP software page and the installation and configuration pages in the Shib Wiki. Almost everything you might need will be here, but you may need to explore - try following any and all links that look even vaguely useful. The Shibboleth-Users mailing list can be a useful resource, as can its archives (but be sure you are finding fresh information - the archives go back a long way).

Instructions

Resources

Other University Shibboleth information

Shibboleth Implementation Project documents

These documents, originally working document belonging to the Computing Service's Shibboleth Development Project, are retained for historical and reference purposes.