Links

Deployment

Shibboleth install

• use the manual on the switch aai site

  # curl -k -O http://pkg.switch.ch/switchaai/SWITCHaai-swdistrib.asc
  # apt-key add SWITCHaai-swdistrib.asc
  # echo "deb http://pkg.switch.ch/switchaai/debian squeeze main" > /etc/apt/sources.list.d/switchaai.list
  # apt-get update
  # apt-get install shibboleth

• next put the config files in "/etc/shibboleth" according to the SwitchAAI manual: SWITCH Shibboleth Service Provider (SP) 2.5 Configuration Guide
  • attribute-map.xml, attribute-policy.xml, shibboleth2.xml, SWITCHaaiRootCA.crt.pem, sp-cert.pem, sp-key.pem
• this includes a registration with your SWITCHaai Federation Partner (e.g. UZH)

Secure B-Fabric

• see NativeSPApacheConfig
• make sure shibboleth knows about the reverse proxy

  <Location />
      ShibRequestSetting REMOTE_ADDR X-Forwarded-For
  </Location>

• redirect "ShibbolethServelet" B-Fabric after shibboleth authentication

  <Location /ShibbolethServlet>
      AuthType shibboleth
      ShibRequireSession On
      ShibUseHeaders On
      require valid-user
      #require homeOrgType university
      RedirectMatch  .*      http://fgcz-bfabric.uzh.ch/bfabric/common/shibboleth-login.html
  </Location>

• Apache will redirect to the B-Fabric Application Server and send the shibboleth headers to B-Fabric

  <Location /bfabric>
          Order allow,deny
          allow from all
          AuthType shibboleth
          ShibUseHeaders On
          require shibboleth
          SetEnv proxy-nokeepalive 1
  </Location>
  ProxyStatus On
  ProxyPreserveHost On
  ProxyPass /bfabric http://localhost:8080/bfabric
  ProxyPassReverse /bfabric http://localhost:8080/bfabric

• redirect requests to "/shibboleth"

  Redirect seeother /shibboleth http://fgcz-bfabric.uzh.ch/Shibboleth.sso/Metadata

Reverse Proxy in front of B-Fabric

• SwitchAAI needs to connect via HTTPS to the "entityID" and all registered "service locations".
• Pound needs to accept https connections and return the certificate depending on the requested host (needs pound version 2.6 .

  ListenHTTPS
          Address 0.0.0.0
          Port 443          
  
          Cert "/etc/pound/cert/bfabric.pem"  
          RewriteLocation 2
  End

• send data to shibboleth to the B-Fabric host

  Service
      URL "^/(ShibbolethServlet|shibboleth|favicon.*|Shibboleth.sso/.*|secure.*)"
      HeadRequire "Host:.*fgcz-bfabric.*"
      Backend
          Address 130.60.81.30
          Port 443
          HTTPS
      End
      Session
          Type IP
          TTL 3600
      End
  End

• all requests must be redirected to the apache on the bfabric host

  Service
      URL "/bfabric/.*"
      HeadRequire "Host:.*fgcz-bfabric.*"
      Backend
          Address 130.60.81.30
          Port 80
          TimeOut 3600
      End
      Session
          Type IP
          TTL 3600
      End
  End

Shibboleth Troubleshooting

shibsp::ListenerException

$ sudo service shibd start