Versions Compared

Old Version 52

changes.mady.by.user Robert A Basch

Saved on

compared with

New Version 53

changes.mady.by.user Robert A Basch

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Panel
Tip

Before proceeding to "Configuration and customization for use" you should obtain a server certificate.

A server certificate, issued either by the MIT CA or a commercial CA, is required for SSL (https) traffic to your server; we strongly recommend using SSL for all Shibboleth-protected content. Please make sure that you use lower case server names in your certificate request. The server name within the certificate is case sensitive.

Information about how to generate a certificate request and where to send the request can be found in https://wikis.mit.edu/confluence/display/WSWG/How+to+acquire+and+verify+a+M.I.T.+x509+Server+Certificate

An MIT-issued server certificate can also be used by the Shibboleth SP when it authenticates to an IdP, though we will be transitioning to using a self-signed certificate for that purpose.

Ensure your system clock is accurate

...

Panel
Info

Until the MIT Identity Providers know about your application, they won't release information about an authenticated user to your server. Each Touchstone enabled application running on a server needs to be registered with the IdPs.

Tip

To register your application server with the MIT IdPs send mail to touchstone-support with the following information:

  • A contact email address. We strongly recommend that this be an email list rather than an individual's personal email address.
  • The server or host name. This should be the web server host name, i.e. the host name that a user would specify when entering the URL to access your site. This should be the same as the Subject CN in your server's SSL certificate. If you have multiple applications installed on the same server, you will actually need to register each application's provider ID. See below for more details.
  • The certificate information for the SP. If using the self-signed certificate generated at install time, you must include the certificate itself (in /etc/shibboleth/sp-cert.pem); do not send the private key file. If using the MIT server SSL certificate, we only need the Subject CN from the certificate (should be the same as the web server host name above).
  • Organization name. This is typically the name of the MIT department, lab, or center running the application.
  • Organization URL. The URL that provides some basic information about your department, lab, or center.

We also encourage you to send the following optional information with your registration information:

  • The application URL. The actual URL which will be used to access your application.
  • Your server platform. (RHEL 4, RHEL 5, Windows, Debian, Solaris, ...)

The IdP doesn't really need to know your hostname. It does need to know the Entity ID that uniquely identifies your application. Typical MIT installations that use the gen-shib.sh script (see above) hide this detail from you so that we simply need the hostname. If you want to learn more about entity ID naming please see EntityNamingat the Internet2 wiki site.

A single Shibboleth SP installation is designed to support multiple applications installed on that server, but there are different deployment and configuration strategies to support multiple applications. At MIT we recommend that each application simply be configured to use a separate Apache vhost; more complex configurations, e.g. creating separate entity IDs for each application, are also possibile. More information is available here:

Testing your Shibboleth configuration

...