Shibboleth - Revision history

Drn@ecs.soton.ac.uk: /* With attribute-map.xml */

2025-11-17T10:45:43Z

With attribute-map.xml

← Older revision		Revision as of 10:45, 17 November 2025
Line 357:		Line 357:
	<Attribute name="givenName" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="givenName"/>		<Attribute name="givenName" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="givenName"/>

	A typical Shibboleth IdP would have both a namespaced attribute name and would not apply a format to an attribute that is a simple text string. Therefore it is worth enquiring with the IdP provider if either of these two happen to be the case. The Shibboleth Service Provider can be [[run in debug mode~~\|Shibboleth Debug Logging~~]], which may help your figure out what attributes are being mapped..		A typical Shibboleth IdP would have both a namespaced attribute name and would not apply a format to an attribute that is a simple text string. Therefore it is worth enquiring with the IdP provider if either of these two happen to be the case. The Shibboleth Service Provider can be [[Shibboleth Debug Logging\|run in debug mode]], which may help your figure out what attributes are being mapped..

	==== With idp-metadata.xml ====		==== With idp-metadata.xml ====

Drn@ecs.soton.ac.uk: /* Shibboleth Configuration Issues */

2025-11-17T10:45:19Z

Shibboleth Configuration Issues

← Older revision		Revision as of 10:45, 17 November 2025
Line 350:		Line 350:
	2015-09-09 09:26:43 INFO Shibboleth.AttributeExtractor.XML [2]: skipping unmapped SAML 2.0 Attribute with Name: givenName, Format:urn:oasis:names:tc:SAML:2.0:attrname-format:basic		2015-09-09 09:26:43 INFO Shibboleth.AttributeExtractor.XML [2]: skipping unmapped SAML 2.0 Attribute with Name: givenName, Format:urn:oasis:names:tc:SAML:2.0:attrname-format:basic

	# The attribute itself has no namespace it is just ''''givenName''' rather than '''urn:mace:dir:attribute-def:givenName'''		# The attribute itself has no namespace it is just '''givenName''' rather than '''urn:mace:dir:attribute-def:givenName'''
	# The attribute has a format that most also be defined in the attribute-map.xml attribute.		# The attribute has a format that most also be defined in the attribute-map.xml attribute.

Line 357:		Line 357:
	<Attribute name="givenName" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="givenName"/>		<Attribute name="givenName" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="givenName"/>

	A typical Shibboleth IdP would have both a namespaced attribute name and would not apply a format to an attribute that is a simple text string. Therefore it is worth enquiring with the IdP provider if either of these two happen to be the case.		A typical Shibboleth IdP would have both a namespaced attribute name and would not apply a format to an attribute that is a simple text string. Therefore it is worth enquiring with the IdP provider if either of these two happen to be the case. The Shibboleth Service Provider can be [[run in debug mode\|Shibboleth Debug Logging]], which may help your figure out what attributes are being mapped..

	==== With idp-metadata.xml ====		==== With idp-metadata.xml ====

Libjlrs: /* Using Remote IdP Metatdata */

2025-08-07T15:33:53Z

Using Remote IdP Metatdata

← Older revision		Revision as of 15:33, 7 August 2025
Line 124:		Line 124:
	chown shibd:shibd /etc/shibboleth/foo/idp-metadata.xml		chown shibd:shibd /etc/shibboleth/foo/idp-metadata.xml

	* To test Shibboleth you will need to make sure your '''LD_LIBRARY_PATH''' is set the same as shibd would have when started using ''systemctl shibd start~~''. This should return the message: ''overall configuration is loadable, check console for non-fatal problems~~''.		* To test Shibboleth you will need to make sure your '''LD_LIBRARY_PATH''' is set the same as shibd would have when started using ''systemctl shibd start''.

	LD_LIBRARY_PATH=/opt/shibboleth/lib64:$LD_LIBRARY_PATH shibd -t		LD_LIBRARY_PATH=/opt/shibboleth/lib64:$LD_LIBRARY_PATH shibd -t
			This should return the message: ''overall configuration is loadable, check console for non-fatal problems''.

	* The above message is because it is now advised not to leave the MetadataGenerator enabled unnecessarily. However, whilst you are setting up Shibboleth, it is useful to have the metadata generator, save you needing to build your own Service Provider metadata file to register with your Identity Provider. Later on you can comment out the MetadataGenerator line to stop getting this warning message.		* The above message is because it is now advised not to leave the MetadataGenerator enabled unnecessarily. However, whilst you are setting up Shibboleth, it is useful to have the metadata generator, save you needing to build your own Service Provider metadata file to register with your Identity Provider. Later on you can comment out the MetadataGenerator line to stop getting this warning message.

Ejo1f20: /* Configuring Shibboleth */

2025-01-21T15:17:36Z

Configuring Shibboleth

← Older revision		Revision as of 15:17, 21 January 2025
Line 96:		Line 96:

	* Modify ''' foo/sp_metadata.xml''' to add in the namepace definitions by separately changing the <code>md:EntityDescriptor</code> and <code>ds:KeyInfo</code> lines as follows from:		* Modify ''' foo/sp_metadata.xml''' to add in the namepace definitions by separately changing the <code>md:EntityDescriptor</code> and <code>ds:KeyInfo</code> lines as follows from:
	<md:EntityDescriptor entityID="https://~~for~~.eprints.org/shibboleth">		<md:EntityDescriptor entityID="https://foo.eprints.org/shibboleth">
	...		...
	...		...
	<ds:KeyInfo>		<ds:KeyInfo>
	to:		to:
	<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://~~for~~.eprints.org/shibboleth">		<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://foo.eprints.org/shibboleth">
	...		...
	...		...

Ejo1f20: /* Configuring Shibboleth */

2025-01-21T14:47:45Z

Configuring Shibboleth

← Older revision		Revision as of 14:47, 21 January 2025
Line 80:		Line 80:
	root> ./keygen.sh -f -h foo.eprints.org -e https://foo.eprints.org/shibboleth		root> ./keygen.sh -f -h foo.eprints.org -e https://foo.eprints.org/shibboleth

	* Move the new '''sp-cert.pem''' and '''sp-key.pem''' to '''/etc/shibboleth/foo/''' ~~amd~~ move the ''.old'' files back in place:		* Move the new '''sp-cert.pem''' and '''sp-key.pem''' to '''/etc/shibboleth/foo/''' and move the ''.old'' files back in place:
	root> cd /etc/shibboleth		root> cd /etc/shibboleth
	root> mv sp-cert.pem sp-key.pem foo/		root> mv sp-cert.pem sp-key.pem foo/

Ejo1f20 at 14:22, 21 January 2025

2025-01-21T14:22:54Z

← Older revision		Revision as of 14:22, 21 January 2025
Line 1:		Line 1:
	{{Manual}}		{{Manual}}
	'''This page details how to install and integrate Shibboleth with EPrints 3.3.x or 3.4.x on a CentOS 7 operating system.''' The process should be fairly similar for other comparable Red Hat based Linux distributions such as RHEL 7 and Fedora 21/22. These instructions should also be generally applicable to later versions of RHEL-based Linux (e.g. Rocky Linux 8, Red Hat Enterprise Linux 9, etc.). However, they ma be somewhat different for Debian-based Linux, such as Ubuntu and Debian itself and other Linux distributions. Typically, this will just be different package names and different commands to manage applications.		'''This page details how to install and integrate Shibboleth with EPrints 3.3.x or 3.4.x on a CentOS 7 operating system.''' The process should be fairly similar for other comparable Red Hat based Linux distributions such as RHEL 7 and Fedora 21/22. These instructions should also be generally applicable to later versions of RHEL-based Linux (e.g. Rocky Linux 8, Red Hat Enterprise Linux 9, etc.). However, they may be somewhat different for Debian-based Linux, such as Ubuntu and Debian itself and other Linux distributions. Typically, this will just be different package names and different commands to manage applications.

	Generally, it is a good idea to run EPrints with '''HTTPS''' when using Shibboleth authentication for increased security on the attributes being sent back by the Shibboleth Identity Provider (IdP). Therefore, it is assumed that EPrints has already been set up to use HTTPS and there already exists an '''ssl/securevhost.conf''' under the archive directory structure.		Generally, it is a good idea to run EPrints with '''HTTPS''' when using Shibboleth authentication for increased security on the attributes being sent back by the Shibboleth Identity Provider (IdP). Therefore, it is assumed that EPrints has already been set up to use HTTPS and there already exists an '''ssl/securevhost.conf''' under the archive directory structure.

Ejo1f20: typo

2025-01-21T14:20:27Z

typo

← Older revision		Revision as of 14:20, 21 January 2025
Line 1:		Line 1:
	{{Manual}}		{{Manual}}
	'''This page details how to install and integrate Shibboleth with EPrints 3.3.x or 3.4.x on a CentOS 7 operating system.''' The process should be fairly similar for other comparable Red Hat based Linux distributions such as RHEL 7 and Fedora 21/22. These instructions should also be generally ~~application~~ to later versions of RHEL-based Linux (e.g. Rocky Linux 8, Red Hat Enterprise Linux 9, etc.). However, they ma be somewhat different for Debian-based Linux, such as Ubuntu and Debian itself and other Linux distributions. Typically, this will just be different package names and different commands to manage applications.		'''This page details how to install and integrate Shibboleth with EPrints 3.3.x or 3.4.x on a CentOS 7 operating system.''' The process should be fairly similar for other comparable Red Hat based Linux distributions such as RHEL 7 and Fedora 21/22. These instructions should also be generally applicable to later versions of RHEL-based Linux (e.g. Rocky Linux 8, Red Hat Enterprise Linux 9, etc.). However, they ma be somewhat different for Debian-based Linux, such as Ubuntu and Debian itself and other Linux distributions. Typically, this will just be different package names and different commands to manage applications.

	Generally, it is a good idea to run EPrints with '''HTTPS''' when using Shibboleth authentication for increased security on the attributes being sent back by the Shibboleth Identity Provider (IdP). Therefore, it is assumed that EPrints has already been set up to use HTTPS and there already exists an '''ssl/securevhost.conf''' under the archive directory structure.		Generally, it is a good idea to run EPrints with '''HTTPS''' when using Shibboleth authentication for increased security on the attributes being sent back by the Shibboleth Identity Provider (IdP). Therefore, it is assumed that EPrints has already been set up to use HTTPS and there already exists an '''ssl/securevhost.conf''' under the archive directory structure.

Ejo1f20 at 14:19, 21 January 2025

2025-01-21T14:19:49Z

← Older revision		Revision as of 14:19, 21 January 2025
Line 1:		Line 1:
	{{Manual}}		{{Manual}}
	'''This page details how to install and integrate Shibboleth with EPrints 3.3.x or 3.4.x on a CentOS 7 operating system.''' The process should be fairly similar for other comparable Red Hat based Linux distributions such as RHEL 7 and Fedora 21/22. These instructions ~~shouls~~ also be generally application to later versions of RHEL-based Linux (e.g. Rocky Linux 8, Red Hat Enterprise Linux 9, etc.). However, they ma be somewhat different for Debian-based Linux, such as Ubuntu and Debian itself and other Linux distributions. Typically, this will just be different package names and different commands to manage applications.		'''This page details how to install and integrate Shibboleth with EPrints 3.3.x or 3.4.x on a CentOS 7 operating system.''' The process should be fairly similar for other comparable Red Hat based Linux distributions such as RHEL 7 and Fedora 21/22. These instructions should also be generally application to later versions of RHEL-based Linux (e.g. Rocky Linux 8, Red Hat Enterprise Linux 9, etc.). However, they ma be somewhat different for Debian-based Linux, such as Ubuntu and Debian itself and other Linux distributions. Typically, this will just be different package names and different commands to manage applications.

	Generally, it is a good idea to run EPrints with '''HTTPS''' when using Shibboleth authentication for increased security on the attributes being sent back by the Shibboleth Identity Provider (IdP). Therefore, it is assumed that EPrints has already been set up to use HTTPS and there already exists an '''ssl/securevhost.conf''' under the archive directory structure.		Generally, it is a good idea to run EPrints with '''HTTPS''' when using Shibboleth authentication for increased security on the attributes being sent back by the Shibboleth Identity Provider (IdP). Therefore, it is assumed that EPrints has already been set up to use HTTPS and there already exists an '''ssl/securevhost.conf''' under the archive directory structure.

Drn@ecs.soton.ac.uk: Advice about added ns to metadata generated for service provider

2024-10-25T15:23:23Z

Advice about added ns to metadata generated for service provider

@@ Line 94: / Line 94: @@
    root> cd /etc/shibboleth
    root> ./metagen.sh -ALO -c foo/sp-cert.pem -h foo.eprints.org -e https://foo.eprints.org/shibboleth > foo/sp_metadata.xml
 * Use ''wget'' to download the metadata from your Shibboleth IdP (e.g. shib.foo.example.org) to the '''/etc/shibboleth/foo/''' directory.

Drn@ecs.soton.ac.uk: /* Configuring Apache and EPrints */

2024-10-22T16:11:03Z

Configuring Apache and EPrints

← Older revision		Revision as of 16:11, 22 October 2024
Line 246:		Line 246:
	my $user = &get_user;		my $user = &get_user;

	if( defined $user ) {		if( defined $user )
			{
	$user->set_value( "last_login", EPrints::Time::get_iso_timestamp() );		$user->set_value( "last_login", EPrints::Time::get_iso_timestamp() );
	$user->commit;		$user->commit;
Line 255:		Line 256:
	})->set_cookies();		})->set_cookies();
	}		}
	else {		else
			{
	$url = $session->get_repository->get_conf( "base_url" ) . "/account_required.html";		$url = $session->get_repository->get_conf( "base_url" ) . "/account_required.html";
	}		}
Line 263:		Line 265:
	$session->terminate;		$session->terminate;

	sub get_user {		sub get_user
			{
	my ( $username, $email ) = ( undef, "" );		my ( $username, $email ) = ( undef, "" );
	if( $ENV{eppn} ) {		if( $ENV{eppn} )
			{
	( $username ) = split( /@/, $ENV{eppn}, 2);		( $username ) = split( /@/, $ENV{eppn}, 2);
	$username = lc( $username );		$username = lc( $username );