...
The key is the server's private key. Certificate is the server's certificate. Make sure that your server certificate should be enabled for server use as well as client use. If not, request a new one. The ca is the CA that signs the client certificates.
7. We also set the shib ticket life time to 10 hours and timeout to 2 hours, so in /home/www/shibboleth/etc/shibboleth/shibboleth.xml file, you should have
<Sessions lifetime="36000" timeout="7200" checkAddress="false" consistentAddress="true"
handlerURL="/Shibboleth.sso" handlerSSL="true" idpHistory="true" idpHistoryDays="7">
8. to pass the HTTP_REMOTE_USER variable, make sure the following is in /home/www/sash-server/conf/consolidator.conf
...
also in /home/www/sash-server/servers/thalia/conf/server.xml make sure the AJP connector is defined as follows:
<!- - An AJP Connector - uncomment if needed -->
<Connector port="8901"
request.tomcatAuthentication="false" address="127.0.0.1"
protocol="AJP/1.3" />
89. restart the webserver: /etc/init.d/web restart
...