Shibboleth - Historique des versions

Julien.garnier : /* Debian */

2012-07-13T08:28:52Z

‎Debian

Julien.garnier le 13 juillet 2012 à 08:28

2012-07-13T08:28:27Z

Julien.garnier : /* Debian */

2010-05-06T05:56:32Z

‎Debian

Julien.garnier : /* Configuration apache */

2009-06-30T08:51:25Z

‎Configuration apache

Julien.garnier le 30 juin 2009 à 08:49

2009-06-30T08:49:57Z

Julien.garnier : /* Debian */

2009-05-13T09:42:31Z

‎Debian

Julien.garnier : /* Debian */

2009-05-13T08:55:55Z

‎Debian

Julien.garnier : /* Debian */

2009-05-13T08:11:32Z

‎Debian

Julien.garnier : /* Debian */

2009-05-13T07:58:45Z

‎Debian

Julien.garnier le 13 mai 2009 à 07:43

2009-05-13T07:43:32Z

← Version précédente		Version du 13 juillet 2012 à 08:28
Ligne 9 :		Ligne 9 :


−	== Debian ==	+	== Debian (pour info, plus d'actualité)==

	'''* Prerequis :'''		'''* Prerequis :'''

← Version précédente		Version du 13 juillet 2012 à 08:28
Ligne 1 :		Ligne 1 :
	= '''Installation Shibboleth-sp''' =		= '''Installation Shibboleth-sp''' =
		+
		+
		+	Il existe maintenant un paquet debian :
		+
		+	apt-get install libapache2-mod-shib2
		+
		+

@@ Ligne 5 : / Ligne 5 : @@
 '''* Prerequis :'''
-  apt-get install build-essential libssl0.9.8 libssl-dev libcurl3 libcurl3-dev apache2-threaded-dev
+  apt-get install build-essential libssl0.9.8 libssl-dev libcurl3 libcurl3-dev apache2-threaded-dev gcc
 '''* log4shib:'''

@@ Ligne 96 : / Ligne 96 : @@
-== Configuration apache  ==
+=== Configuration apache  ===
-		   Shibboleth Service Provider Access Rules
+Shibboleth Service Provider Access Rules
 It is the resource administrator's responsibility to configure the correct access rules for a protected resource. A resource either can be protected with acces rules defined in the web server configuration or by the application itself by checking certain Shibboleth attributes. In both cases, a Shibboleth session must be enforced on the file, location or directory to protect. Second, there must be an authorization rule based on attributes that determines how access is granted.
@@ Ligne 120 : / Ligne 120 : @@
 For first testing purposes (in Apache) it is OK to start with the most simple access rule that grants access to any user with a valid AAI login and redirects all non-ssl http requets to https before processing by Shibboleth, which is recommended:
-AuthType shibboleth
+ AuthType shibboleth
-ShibRequireSession On
+ ShibRequireSession On
-ShibRedirectToSSL 443
+ ShibRedirectToSSL 443
-require valid-user
+ require valid-user
 In the following some common rules (based on an   example page by University of Zurich) are shown together with a description of what effect they have.
 More information on this topic can also be found in the corresponding Shibboleth Wiki page.
-All users with an AAI login
+'''All users with an AAI login'''
-AuthType shibboleth
+ AuthType shibboleth
-ShibRequireSession On
+ ShibRequireSession On
-require valid-user
+ require valid-user
-All university users with an AAI login
+'''All university users with an AAI login'''
-AuthType shibboleth
+ AuthType shibboleth
-ShibRequireSession On
+ ShibRequireSession On
-require homeOrganizationType university
+ require homeOrganizationType university
-All users from university of Zurich
+'''All users from university of Zurich'''
-AuthType shibboleth
+ AuthType shibboleth
-ShibRequireSession On
+ ShibRequireSession On
-require homeOrganization unizh.ch
+ require homeOrganization unizh.ch
-All staff members from university of Zurich (with regular expression example)
+'''All staff members from university of Zurich (with regular expression example)'''
-AuthType shibboleth
+ AuthType shibboleth
-ShibRequireSession On
+ ShibRequireSession On
-ShibRequireAll On
+ ShibRequireAll On
-require affiliation staff
+ require affiliation staff
-require homeOrganization ~ ^unizh.ch$
+ require homeOrganization ~ ^unizh.ch$
-People whose email address match a regular expression (in this case all D-ITET students from ETHZ)
+'''People whose email address match a regular expression (in this case all D-ITET students from ETHZ)'''
-AuthType shibboleth
+ AuthType shibboleth
-ShibRequireSession On
+ ShibRequireSession On
-ShibRequireAll On
+ ShibRequireAll On
-require affiliation staff
+ require affiliation staff
-require homeOrganization ~ .*@ee.ethz.ch$
+ require homeOrganization ~ .*@ee.ethz.ch$
-All users from university of Zurich or ETH Zurich
+'''All users from university of Zurich or ETH Zurich'''
-AuthType shibboleth
+ AuthType shibboleth
-ShibRequireSession On
+ ShibRequireSession On
-require homeOrganization unizh.ch ethz.ch
+ require homeOrganization unizh.ch ethz.ch
-All students from university of Zurich or ETH Zurich
+'''All students from university of Zurich or ETH Zurich'''
-AuthType shibboleth
+ AuthType shibboleth
-ShibRequireSession On
+ ShibRequireSession On
-ShibRequireAll On
+ ShibRequireAll On
-require affiliation student
+ require affiliation student
-require homeOrganization unizh.ch ethz.ch
+ require homeOrganization unizh.ch ethz.ch
-Only users with the following e-Mail addresses
+'''Only users with the following e-Mail addresses'''
-AuthType shibboleth
+ AuthType shibboleth
-ShibRequireSession On
+ ShibRequireSession On
-require mail user-x@switch.ch user-y@switch.ch
+ require mail user-x@switch.ch user-y@switch.ch
-Only users with the following uniqueIDs
+'''Only users with the following uniqueIDs'''
-AuthType shibboleth
+ AuthType shibboleth
-ShibRequireSession On
+ ShibRequireSession On
-require uniqueID 000123@switch.ch 000455@switch.c
+ require uniqueID 000123@switch.ch 000455@switch.c

← Version précédente		Version du 30 juin 2009 à 08:49
Ligne 92 :		Ligne 92 :
	openssl x509 -noout -fingerprint -text < /tmp/dr13.cnrs.fr.crt >> /tmp/dr13.cnrs.fr.crt		openssl x509 -noout -fingerprint -text < /tmp/dr13.cnrs.fr.crt >> /tmp/dr13.cnrs.fr.crt
	mv /tmp/dr13.cnrs.fr.* /etc/shibboleth/ssl/		mv /tmp/dr13.cnrs.fr.* /etc/shibboleth/ssl/
		+
		+
		+
		+
		+	== Configuration apache ==
		+
		+	Shibboleth Service Provider Access Rules
		+
		+	It is the resource administrator's responsibility to configure the correct access rules for a protected resource. A resource either can be protected with acces rules defined in the web server configuration or by the application itself by checking certain Shibboleth attributes. In both cases, a Shibboleth session must be enforced on the file, location or directory to protect. Second, there must be an authorization rule based on attributes that determines how access is granted.
		+
		+	When using web server access rules, there are three ways to define rules:
		+
		+	Web Server config file
		+	E.g. you can directly set rules for a directory, file or loacation in the httpd.conf of Apache.
		+	The downside of this method is that the web server has to be restarted each time the configuration file is changed.
		+	Directory config file
		+	In Apache you can use so-called '.htaccess' files in directories to overwrite the web server static configuration settings. The rules defined in that file are dynamic, which means that they can be changed without restarting the web server. This also can be used to set Shibboleth access rules.
		+	Be sure to check that the directory you use a '.htaccess' file is configured with 'AllowOverride AuthConfig' file to allow usage of '.htaccess' files.
		+	The downside of this method that you cannot protect locations but only existing files and directories.
		+	XML Access rules in Shibboleth config (for IIS)
		+	Especially needed for the IIS web server, there is a way to define access rules directly within the Shibboleth configuration file or in a linked external file that contains access rules which are define using a special XML syntax. The inline access rules as well as the externally linked file are loaded dynamically by Shibboleth and thus are also suitable to protect locations for Apache.
		+
		+	Once your resource is ready for use, you have to configure access rules which properly protect your resource.
		+
		+	Examples of Apache Access Rules
		+
		+	For first testing purposes (in Apache) it is OK to start with the most simple access rule that grants access to any user with a valid AAI login and redirects all non-ssl http requets to https before processing by Shibboleth, which is recommended:
		+
		+	AuthType shibboleth
		+	ShibRequireSession On
		+	ShibRedirectToSSL 443
		+	require valid-user
		+
		+	In the following some common rules (based on an example page by University of Zurich) are shown together with a description of what effect they have.
		+	More information on this topic can also be found in the corresponding Shibboleth Wiki page.
		+
		+	All users with an AAI login
		+
		+	AuthType shibboleth
		+	ShibRequireSession On
		+	require valid-user
		+
		+	All university users with an AAI login
		+
		+	AuthType shibboleth
		+	ShibRequireSession On
		+	require homeOrganizationType university
		+
		+	All users from university of Zurich
		+
		+	AuthType shibboleth
		+	ShibRequireSession On
		+	require homeOrganization unizh.ch
		+
		+	All staff members from university of Zurich (with regular expression example)
		+
		+	AuthType shibboleth
		+	ShibRequireSession On
		+	ShibRequireAll On
		+	require affiliation staff
		+	require homeOrganization ~ ^unizh.ch$
		+
		+	People whose email address match a regular expression (in this case all D-ITET students from ETHZ)
		+
		+	AuthType shibboleth
		+	ShibRequireSession On
		+	ShibRequireAll On
		+	require affiliation staff
		+	require homeOrganization ~ .*@ee.ethz.ch$
		+
		+	All users from university of Zurich or ETH Zurich
		+
		+	AuthType shibboleth
		+	ShibRequireSession On
		+	require homeOrganization unizh.ch ethz.ch
		+
		+	All students from university of Zurich or ETH Zurich
		+
		+	AuthType shibboleth
		+	ShibRequireSession On
		+	ShibRequireAll On
		+	require affiliation student
		+	require homeOrganization unizh.ch ethz.ch
		+
		+	Only users with the following e-Mail addresses
		+
		+	AuthType shibboleth
		+	ShibRequireSession On
		+	require mail user-x@switch.ch user-y@switch.ch
		+
		+	Only users with the following uniqueIDs
		+
		+	AuthType shibboleth
		+	ShibRequireSession On
		+	require uniqueID 000123@switch.ch 000455@switch.c

@@ Ligne 53 : / Ligne 53 : @@
   ./configure --with-log4shib=/opt/shibboleth-sp
   make && make install
 == Red Hat ==

@@ Ligne 51 : / Ligne 51 : @@
   tar xvzf shibboleth-sp-2.1.tar.gz
   cd shibboleth-2.1
-  ./configure --with-log4shib=/opt/shibboleth-sp --sysconfdir=/etc/shibboleth-sp
+  ./configure --with-log4shib=/opt/shibboleth-sp
   make && make install

@@ Ligne 34 : / Ligne 34 : @@
 '''* XMLTooling-C:'''
-  wget http://shibboleth.internet2.edu/downloads/opensaml/cpp/latest/
+  wget http://shibboleth.internet2.edu/downloads/opensaml/cpp/latest/xmltooling-1.1.tar.gz
   tar xvzf xmltooling-1.1.tar.gz
   cd xmltooling-1.1

← Version précédente		Version du 13 mai 2009 à 07:43
Ligne 1 :		Ligne 1 :
−	= '''Installation Shibboleth''' =	+	= '''Installation Shibboleth-sp''' =