1.follow the instructions in "Touchstone-Shibboleth SP configuration instructions for Apache based systems" at https://wikis.mit.edu/confluence/display/ISDA/Touchstone-Shibboleth+SP+configuration+instructions+for+Apache+based+systems
ignore the instruction about apache22.config
shibboleth is installed under /home/www/shibboleth.
2. shibboleth configuration instruction is here: https://wikis.mit.edu/confluence/display/ISDA/Touchstone-Shibboleth+SP+configuration+instructions+for+Apache+based+systems
for information on shibboleth options goto : https://spaces.internet2.edu/display/SHIB/SPProtectionConfig
3. in /home/www/shibboleth/etc/shibboleth/apache22.config file, make sure the following lines are defined. It protects the location /.
<Location />
AuthType shibboleth
require shibboleth
ShibRequireSession On
require valid-user
</Location>
If there is a location you don't want protected, such as /about or /help, add the exception in apache22.config like following:
<location /about>
ShibRequireSession Off
</location>
4. In the apache ssl configuration in /home/www/apache/conf/extra/httpd-ssl.conf, add the following in the <VirtualHost _default_:443> block:
# Touchstone/Shibboleth
Include /home/www/shibboleth/etc/shibboleth/apache22.config
5. In the same file, comment out
SSLVerifyClient require
we don't need client authentication because touchstone handles it.
6. edit /home/www/shibboleth/etc/shibboleth/shibboleth.xml file
inside the <RequestMap applicationId="default"> in the local section, for each domain thalia supports, add a host configuration such as
<Host name="ap.thalia-dev.mit.edu">
<Path name="secure" authType="shibboleth" requireSession="true"/>
</Host>
and add the following in the <Credentials xmlns="urn:mace:shibboleth:credentials:1.0"> block:
<FileResolver Id="MITcreds">
<Key>
<Path>/home/www/ssl/private/thalia-dev.mit.edu-2008-08-04-key.pem</Path>
</Key>
<Certificate>
<Path>/home/www/ssl/certs/thalia-dev.mit.edu-2008-08-04-cert.pem</Path>
</Certificate>
<CAPath>
<Path>/home/www/ssl/certs/mitCA.pem</Path>
</CAPath>
</FileResolver>
The key is the server's private key. Certificate is the server's certificate. Make sure that your server certificate should be enabled for server use as well as client use. If not, request a new one. The ca is the CA that signs the client certificates.
7. restart the webserver: /etc/init.d/web restart
restart shibboleth daemon: /etc/init.d/shibd restart