Please note that these instructions are for the 1.3 SP only; new deployments should use version 2.x. Please see https://spaces.internet2.edu/display/SHIB2/NativeSPSolarisInstall for help on building 2.x for Solaris.

This page has notes on building the Shibboleth SP 1.3 software on Solaris.  Since the support from internet2 for downloadable binary packages on Solaris seems weak, we will likely need to build and package the software ourselves for our Solaris-based web servers.  (Also see  https://spaces.internet2.edu/display/SHIB/SolarisNotes).

The initial test build was done on an Athena 9.4/Solaris 10 machine, which was already running Apache 1.3 with mod_ssl.  (It also previously contained an installation of cURL (version 7.16.0) in /usr/local, which is another prerequisite of the Shibboleth SP, and is also a prerequisite of WebAuth; cURL was rebuilt using the Sun compiler for subsequent builds).  The following procedure assumes that Shibboleth should be installed under the prefix /usr/local/shibboleth.  It also assumes that the system already has the GNU build tools installed; in particular, most of the source packages must be built using gmake.  But, note that postings on the Shibboleth users list mention problems seen with gcc/g++ builds on Solaris, and recommend using Sun's compiler (cc/CC); gcc was used for the initial test build below, though.

Build steps: 

To configure Apache 1.3, create $APACHE_ROOT/conf/shib.conf, and include that from httpd.conf, e.g.:

#
# Load the Shibboleth module.
#
LoadModule mod_shib /usr/local/shibboleth/libexec/mod_shib_13.so

#
# Global Configuration
# This is the XML file that contains all the global, non-apache-specific
# configuration.  Look at this file for most of your configuration parameters.
#
ShibSchemaDir /usr/local/shibboleth/share/xml/shibboleth
ShibConfig /usr/local/shibboleth/etc/shibboleth/shibboleth.xml

#
# An Apache handler needs to be established for the "handler" location.
# This applies the handler to any requests for a resource with a ".sso"
# extension.
#
<Files *.sso>
SetHandler shib-handler
</Files>
#
# Another way of addressing this is to apply Shibboleth
# globally to the site in "lazy" session mode:
# <Location />
# AuthType shibboleth
# require shibboleth
# </Location>

#
# Used for example logo and style sheet in error templates.
#
<IfModule mod_alias.c>
  Alias /shibboleth-sp/main.css /usr/local/shibboleth/doc/shibboleth/main.css
  Alias /shibboleth-sp/logo.jpg /usr/local/shibboleth/doc/shibboleth/logo.jpg
</IfModule>

#
# Configure the module for content
#
# You can now do most of this in shibboleth.xml using the RequestMap
# but you MUST enable AuthType shibboleth for the module to process
# any requests, and there MUST be a require command as well. To
# enable Shibboleth but not specify any session/access requirements
# use "require shibboleth".
#
<Location /secure>
  AuthType shibboleth
  ShibRequireSession On
  require valid-user
</Location>

ScriptAlias /shib-testenv "/usr/apache-1.3/cgi-bin/printenv"
<Location /shib-testenv>
  AuthType shibboleth
  ShibRequireSession On
  require valid-user
</Location>

Note that the configuration is slightly different from the Apache 2.0 configuration. 

To start Apache, the LD_LIBRARY_PATH must be set for the module to be loaded, e.g. to /usr/local/shibboleth/lib:/usr/local/lib:/usr/athena/lib:/usr/sfw/lib

Note that certain directories under /usr/local/shibboleth were created with mode 700 (apparently from installing while umask was 077), i.e. so that Apache can't access them.  The workaround is to set the umask to 022 before installing.  This is presumably something we can fix easily in the build system.

Note that an rc script is installed in /usr/local/shibboleth/etc/shibboleth/shibd, but this is apparently Linux-specific, as it uses #!/bin/bash, sources /etc/rc.d/init.d/functions, etc.  You can just run shibd directly, e.g. "/usr/local/shibboleth/sbin/shibd &".