Differences

This shows you the differences between two versions of the page.

--- en:services:it_security:aai:serviceowner [2024/01/31 16:22] – [Setting up your Service Provider (SP)] sdabbag
+++ en:services:it_security:aai:serviceowner [2024/01/31 17:28] (current) – [Setting up your Service Provider (SP)] sdabbag
@@ Line 97: / Line 97: @@
 . Configure ''/etc/sbhibboleth/shibboleth2.xml''. You can use the default and configure the following values:
-  * entityID: Use your identifier for this SP e.g. ''entityID="https://oc.test.up2university.eu/shibboleth"''
+  * entityID: Use your identifier for this SP e.g. ''entityID="https://sp.example.org/shibboleth"''
-  * SSO: The url of the metadata for the up2u SSO instance which will be used to start an authentication workflow:  ''<SSO entityID="https://sso.up2university.eu/simplesaml/saml2/idp/metadata.php">SAML2</SSO>''
+  * SSO: The url of the metadata for the GWDG SSO instance which will be used to start an authentication workflow:  ''<SSO entityID="https://sso.example.org/simplesaml/saml2/idp/metadata.php">SAML2</SSO>''
   * MetadataProvider: Where to fetch metadata for the SSO instance and where to cache it on disk: ''<MetadataProvider
                 type="XML"
-                uri="https://sso.up2university.eu/simplesaml/saml2/idp/metadata.php"
+                uri="https://sso.example.org/simplesaml/saml2/idp/metadata.php"
-                backingFilePath="/etc/shibboleth/metadata/sso.up2university.eu.xml"
+                backingFilePath="/etc/shibboleth/metadata/sso.example.org.xml"
                 reloadInterval="7200">
       </MetadataProvider>''
@@ Line 114: / Line 114: @@
 . Restart apache and shibd: ''systemctl restart shibd.service; systemctl restart apache2.service;'' or ''/etc/init.d/shibd restart; /etc/init.d/apache2 restart'' (depending on your distribution and version)
-. Check if your metadata is available. It should be found at ''https://your service url/Shibboleth.sso/Metadata''. If it looks valid, proceed to step 7. Please keep in mind that the official documentation says not to use the autogenerated Metadata. If you decide to follow this hint, make the metadata publicy available at another place and proceed to step 7.
+. Check if your metadata is available. It should be found at ''https://sp.example.org/Shibboleth.sso/Metadata''. If it looks valid, proceed to step 7. Please keep in mind that the official documentation says not to use the autogenerated Metadata. If you decide to follow this hint, make the metadata publicy available at another place and proceed to step 7.
-. Open an issue in this github project to have your metadata configured in the up2u-sso. Provide either the autoconfigured or hosted metadata link in there.
+. Open an issue in this github project to have your metadata configured in the sso. Provide either the autoconfigured or hosted metadata link in there.
 ----
 ** Example: Configuration**
-In this section are the config files of one prototype SP inside up2u with ownCloud
 ''/etc/shibboleth/shibboleth2.xml''
@@ Line 148: / Line 147: @@
     <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
-    <ApplicationDefaults entityID="https://oc.test.up2university.eu/shibboleth"
+    <ApplicationDefaults entityID="https://sp.example.org/shibboleth"
                          REMOTE_USER="eppn persistent-id targeted-id">
@@ Line 169: / Line 168: @@
             You can also override entityID on /Login query string, or in RequestMap/htaccess.
             -->
-            <SSO entityID="https://sso.up2university.eu/simplesaml/saml2/idp/metadata.php">
+            <SSO entityID="https://sso.example.org/simplesaml/saml2/idp/metadata.php">
               SAML2 SAML1
             </SSO>
@@ Line 199: / Line 198: @@
 	   <MetadataProvider
                 type="XML"
-                uri="https://sso.up2university.eu/simplesaml/saml2/idp/metadata.php"
+                uri="https://sso.example.org/simplesaml/saml2/idp/metadata.php"
-                backingFilePath="/etc/shibboleth/metadata/sso.up2university.eu.xml"
+                backingFilePath="/etc/shibboleth/metadata/sso.example.org.xml"
                 reloadInterval="7200">
               </MetadataProvider>
@@ Line 283: / Line 282: @@
     <Attribute name="urn:oid:0.9.2342.19200300.100.1.3" id="mail"/>
-    <Attribute name="urn:oid:3.1.3.3.8" id="up2uid"/>
     <Attribute name="urn:oid:0.9.2342.19200300.100.1.1" id="uid"/>
@@ Line 328: / Line 325: @@
     <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.4" id="orgunit-dn"/>
     <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.3" id="org-dn"/>
     <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" id="assurance"/>
     <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" id="member"/>
-    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.6.1.1" id="eduCourseOffering"/>
-    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.6.1.2" id="eduCourseMember"/>
     -->
     <!-- Examples of LDAP-based attributes, uncomment to use these... -->
     <!--
-    <Attribute name="urn:mace:dir:attribute-def:cn" id="cn"/>
-    <Attribute name="urn:mace:dir:attribute-def:sn" id="sn"/>
-    <Attribute name="urn:mace:dir:attribute-def:givenName" id="givenName"/>
-    <Attribute name="urn:mace:dir:attribute-def:displayName" id="displayName"/>
-    <Attribute name="urn:mace:dir:attribute-def:mail" id="mail"/>
-    <Attribute name="urn:mace:dir:attribute-def:telephoneNumber" id="telephoneNumber"/>
-    <Attribute name="urn:mace:dir:attribute-def:title" id="title"/>
-    <Attribute name="urn:mace:dir:attribute-def:initials" id="initials"/>
-    <Attribute name="urn:mace:dir:attribute-def:description" id="description"/>
-    <Attribute name="urn:mace:dir:attribute-def:carLicense" id="carLicense"/>
-    <Attribute name="urn:mace:dir:attribute-def:departmentNumber" id="departmentNumber"/>
-    <Attribute name="urn:mace:dir:attribute-def:employeeNumber" id="employeeNumber"/>
-    <Attribute name="urn:mace:dir:attribute-def:employeeType" id="employeeType"/>
-    <Attribute name="urn:mace:dir:attribute-def:preferredLanguage" id="preferredLanguage"/>
-    <Attribute name="urn:mace:dir:attribute-def:manager" id="manager"/>
-    <Attribute name="urn:mace:dir:attribute-def:seeAlso" id="seeAlso"/>
-    <Attribute name="urn:mace:dir:attribute-def:facsimileTelephoneNumber" id="facsimileTelephoneNumber"/>
-    <Attribute name="urn:mace:dir:attribute-def:street" id="street"/>
-    <Attribute name="urn:mace:dir:attribute-def:postOfficeBox" id="postOfficeBox"/>
-    <Attribute name="urn:mace:dir:attribute-def:postalCode" id="postalCode"/>
-    <Attribute name="urn:mace:dir:attribute-def:st" id="st"/>
-    <Attribute name="urn:mace:dir:attribute-def:l" id="l"/>
-    <Attribute name="urn:mace:dir:attribute-def:o" id="o"/>
-    <Attribute name="urn:mace:dir:attribute-def:ou" id="ou"/>
-    <Attribute name="urn:mace:dir:attribute-def:businessCategory" id="businessCategory"/>
-    <Attribute name="urn:mace:dir:attribute-def:physicalDeliveryOfficeName" id="physicalDeliveryOfficeName"/>
     <Attribute name="urn:oid:2.5.4.3" id="cn"/>
     <Attribute name="urn:oid:2.5.4.4" id="sn"/>
@@ Line 375: / Line 341: @@
     <Attribute name="urn:oid:2.5.4.43" id="initials"/>
     <Attribute name="urn:oid:2.5.4.13" id="description"/>
-    <Attribute name="urn:oid:2.16.840.1.113730.3.1.1" id="carLicense"/>
-    <Attribute name="urn:oid:2.16.840.1.113730.3.1.2" id="departmentNumber"/>
-    <Attribute name="urn:oid:2.16.840.1.113730.3.1.3" id="employeeNumber"/>
-    <Attribute name="urn:oid:2.16.840.1.113730.3.1.4" id="employeeType"/>
-    <Attribute name="urn:oid:2.16.840.1.113730.3.1.39" id="preferredLanguage"/>
-    <Attribute name="urn:oid:0.9.2342.19200300.100.1.10" id="manager"/>
-    <Attribute name="urn:oid:2.5.4.34" id="seeAlso"/>
-    <Attribute name="urn:oid:2.5.4.23" id="facsimileTelephoneNumber"/>
-    <Attribute name="urn:oid:2.5.4.9" id="street"/>
-    <Attribute name="urn:oid:2.5.4.18" id="postOfficeBox"/>
-    <Attribute name="urn:oid:2.5.4.17" id="postalCode"/>
-    <Attribute name="urn:oid:2.5.4.8" id="st"/>
     <Attribute name="urn:oid:2.5.4.7" id="l"/>
     <Attribute name="urn:oid:2.5.4.10" id="o"/>
     <Attribute name="urn:oid:2.5.4.11" id="ou"/>
-    <Attribute name="urn:oid:2.5.4.15" id="businessCategory"/>
-    <Attribute name="urn:oid:2.5.4.19" id="physicalDeliveryOfficeName"/>
     -->
@@ Line 397: / Line 349: @@
 </code>
-**/etc/apache2/site-enabled/owncloud_ssl.conf**
+**/etc/apache2/site-enabled/ssl.conf**
 <code>
 <VirtualHost *:443>
-  DocumentRoot /var/www/owncloud
+  DocumentRoot /var/www/html
   <Directory />
@@ Line 428: / Line 380: @@
   </Location>
-  ServerName oc.test.up2university.eu
+  ServerName sp.example.org
   UseCanonicalName On
-SSLCertificateFile /etc/letsencrypt/live/oc.test.up2university.eu/fullchain.pem
+SSLCertificateFile /etc/letsencrypt/live/sp.example.org/fullchain.pem
-SSLCertificateKeyFile /etc/letsencrypt/live/oc.test.up2university.eu/privkey.pem
+SSLCertificateKeyFile /etc/letsencrypt/live/sp.example.org/privkey.pem
 Include /etc/letsencrypt/options-ssl-apache.conf
 </VirtualHost>
 </code>