Set-up an Identity Provider

Transcription

1 Set-up an Identity Provider Dr. Marco Fargetta Italian Institute for Nuclear Physics (INFN) Bucaramanga (Colombia), November 27, 2012

2 In this tutorial we refer to the Shibboleth IdP Official documentation on-line NOTE: these slides will not replace the official documentation

3 IdPs provide users identities to external services Do not store credentials

4 Credentials must be accessible by the IdP Authentication information can be differently managed

5 The first step is to create or use ax credentials database We use LDAP in this tutorial

6 Configure an LDAP server with several test account Many OS have tool to create and manage an LDAP server Many alternatives available: Apache Directory Studio GQ JXplorer

7 Download and install last version of the Shibboleth Identity Provider Installation is straightforward

8 Install a Java servlet container to run the IdP Many servlet container supported (tomcat 6 is recommended)

9 All the communications run over ssl Configure the servlet container Deploy the idp using a Context Deployment Fragment

10 IdP context <Context docbase="_path/idp/war/idp.war" privileged="true" antiresourcelocking="false" antijarlocking="false" unpackwar="false" swallowoutput="true" /> Put the context in TOMCAT CONF/Catalina/localhost/idp.xml

11 Configuration

12 Retrieve user attributes Configure the attribute to retrieve and the storage Modify the file attribute-resolver.xml

13 Connect the attribute source <resolver:dataconnector id="myldap" xsi:type="dc:ldapdirectory" ldapurl="ldap://directory.ct.infn.it" basedn="ou=people,dc=local" principal="cn=idp,ou=people,dc=local" principalcredential="******"> <dc:filtertemplate> <![CDATA[ (cn=\$requestcontext.principalname) ]]> </dc:filtertemplate> </resolver:dataconnector>

14 Attribute Example <resolver:attributedefinition xsi:type="ad:simple" id=" " sourceattributeid="mail"> <resolver:dependency ref="myldap" /> <resolver:attributeencoder xsi:type="enc:saml1string" name="urn:mace:dir:attribute-def:mail"/> <resolver:attributeencoder xsi:type="enc:saml2string" name="urn:oid: " friendlyname="mail" /> </resolver:attributedefinition>

15 Define the attributes you want provide Normal policy is: as less as possible Modify the file attribute-filter.xml

16 Simple filter <afp:attributefilterpolicy id="attributetoanyone"> <afp:policyrequirementrule xsi:type="basic:any"/> <afp:attributerule attributeid=" "> <afp:permitvaluerule xsi:type="basic:any"/> </afp:attributerule> </afp:attributefilterpolicy>

17 A more complex example <afp:attributefilterpolicy id="attributetoansp"> <afp:policyrequirementrule xsi:type="basic:attributerequesterstring" value=" <afp:attributerule attributeid="edupersonaffiliation"> <afp:permitvaluerule xsi:type="basic:or"> <Rule xsi:type="basic:attributevaluestring" value="affiliate" ignorecase="true"/> <Rule xsi:type="basic:attributevaluestring" value="employee" ignorecase="true"/> </PermitValueRule> </afp:attributerule> </afp:attributefilterpolicy>

18 Users must be authenticated by the IdP More options available: Remote System, LDAP, Kerberos, etc... The authentication to use configured as an handler Set in handler.xml

19 Authentication with Username and Password against LDAP available out-of-the-box The LDAP can be different from the attributes LDAP Configuration in login.config

20 LDAP login configuration edu.vt.middleware.ldap.jaas.ldaploginmodule required ldapurl="ldap://directory.ct.infn.it" basedn="ou=people,dc=local" tls="true" userfilter="cn={0}";

21 IdP has to know in advance the service using it Metadata must be exchanged with all the SPs or federations An IdP can enable multiple federations and/or resources

22 Handler to generate metadata available IdP and SP metadata should be configured Modify the file relying-party.xml

23 IdP Metadata Configuration <metadata:metadataprovider id="idpmd" xsi:type="metadata:resourcebackedmetadataprovider"> <metadata:metadataresource xsi:type="resource:filesystemresource" file="_path_/idp-metadata.xml"/> </metadata:metadataprovider>

24 Federation Metadata Config <metadata:metadataprovider id="myfed" xsi:type="metadata:filebackedhttpmetadataprovider" metadataurl=" backingfile="_path/gridp.xml" disregardsslcertificate="true">

25 Trusted communications among IdP, SP and users Data sharing over ssl Metadata signed by server

26 ssl configured in the servlet container Certificate to sign metadata defined in relying-party.xml Update the metadata when change the certificate

27 Logging system very important to find configuration problem Log output configurable Modify the file logging.xml

28 The login page of the IdP can be customised The code to modify in the installation package Modify the file src/main/webapp/login.jsp in the installation directory

29 Run the installation again Take care to not overwrite configure files when requested

30

31 Task for today Install an IdP to add in a federation: 1 Define your users database 2 Configure the IdP 3 Exchange metadata 4 Customise interface