Installation des prérequis

#installation des paquets<br></br>sudo aptitude install apache2 openjdk-6-jdk tomcat6 unzip<br></br><br></br>#configuration apache<br></br>sudo a2enmod ssl && sudo a2enmod proxy-ajp && sudo service apache2 restart<br></br><br></br>#configuration de tomcat<br></br>sudo sed -i 's/JAVA_OPTS="-/#JAVA_OPTS="-/' /etc/default/tomcat6<br></br>sudo sed -i '/#JAVA_OPTS="-/a\JAVA_OPTS="-Djava.awt.headless=true -Xmx512M -XX:MaxPermSize=128M -Dcom.sun.security.enableCRLDP=true"' /etc/default/tomcat6<br></br>sudo sed -i 's/autoDeploy="true"/autoDeploy="false"/' /etc/tomcat6/server.xml<br></br><br></br>#configuration de java (attention au chemin qui doit correspondre à celui de votre environnement)<br></br>sudo echo "JAVA_HOME=/usr/lib/jvm/java-6-openjdk-amd64" >> /etc/environment<br></br>sudo export JAVA_HOME=/usr/lib/jvm/java-6-openjdk-amd64<br></br>

Installation de Shibboleth

#vérifiez la version du zip sur : <a href="http://shibboleth.net/downloads/identity-provider/latest/">shibboleth.net</a><br></br>cd ~<br></br>wget http://shibboleth.net/downloads/identity-provider/latest/shibboleth-identityprovider-2.3.8-bin.zip<br></br>unzip shibboleth-identityprovider-2.3.8-bin.zip<br></br>cd shibboleth-identityprovider-2.3.8<br></br>sudo chmod u+x ./install.sh<br></br><br></br>#copie de quelques classes java pour tomcat<br></br>sudo cp -R endorsed/ /usr/share/tomcat6/<br></br><br></br>#mise en place du <a href="http://dev.mysql.com/downloads/connector/j/">connecteur mysql</a><br></br>cd /usr/local/src/<br></br>wget http://cdn.mysql.com/Downloads/Connector-J/mysql-connector-java-5.1.21.zip<br></br>unzip mysql-connector-java-5.1.21.zipcp mysql-connector-java-5.1.21/mysql-connector-java-5.1.21-bin.jar /usr/local/src/shibboleth-identityprovider-2.3.8/lib/<br></br><br></br>#Installation (modifiez la durée de vie du certification en fonction de vos besoins).<br></br>cd /usr/local/src/shibboleth-identityprovider-2.3.6/<br></br>sudo env IdPCertLifetime=3 ./install.sh<br></br>
Une installation interactive va suivre, donnez les information correspondante à votre installation

#liens symbolique<br></br>ln -s /opt/shibboleth-idp/conf /etc/shibboleth<br></br>ln -s /opt/shibboleth-idp/logs /var/log/shibboleth<br></br><br></br>#variable HOME de l'ipdsudo echo "IDP_HOME=/opt/shibboleth-idp" >> /etc/environment<br></br>sudo export IDP_HOME=/opt/shibboleth-idp<br></br><br></br>#Création d'un descripteur de contexte pour l'application<br></br>echo << EOF >> /etc/tomcat6/Catalina/localhost/idp.xml <br></br><pre>EOF</pre>

Configuration de Mysql

#connexion au serveur mysql<br></br>sudo mysql -u root -p<br></br><br></br>#création de la BDD<br></br>SET NAMES 'utf8'; SET CHARACTER SET utf8; CHARSET utf8; CREATE DATABASE IF NOT EXISTS shibboleth CHARACTER SET=utf8; USE shibboleth;<br></br><br></br>#création de la table <br></br><pre>CREATE TABLE IF NOT EXISTS shibpid (localEntity TEXT NOT NULL,peerEntity TEXT NOT NULL,principalName VARCHAR(255) NOT NULL DEFAULT '',localId VARCHAR(255) NOT NULL,persistentId VARCHAR(36) NOT NULL,peerProvidedId VARCHAR(255) DEFAULT NULL,creationDate timestamp NOT NULL DEFAULT CURRENT_TIMESTAMPON UPDATE CURRENT_TIMESTAMP,deactivationDate TIMESTAMP NULL DEFAULT NULL,KEY persistentId (persistentId),KEY persistentId_2 (persistentId, deactivationDate),KEY localEntity (localEntity(16), peerEntity(16), localId),KEY localEntity_2 (localEntity(16), peerEntity(16),localId, deactivationDate)) ENGINE=MyISAM DEFAULT CHARSET=utf8;</pre><br></br>#vérification de la table<br></br><pre>DESCRIBE shibpid;+------------------+--------------+------+-----+-------------------+-----------------------------+| Field | Type | Null | Key | Default | Extra |+------------------+--------------+------+-----+-------------------+-----------------------------+| localEntity | text | NO | MUL | NULL | || peerEntity | text | NO | | NULL | || principalName | varchar(255) | NO | | | || localId | varchar(255) | NO | | NULL | || persistentId | varchar(36) | NO | MUL | NULL | || peerProvidedId | varchar(255) | YES | | NULL | || creationDate | timestamp | NO | | CURRENT_TIMESTAMP | on update CURRENT_TIMESTAMP || deactivationDate | timestamp | YES | | NULL | |+------------------+--------------+------+-----+-------------------+-----------------------------+8 rows in set (0.00 sec)</pre>#création de l'utlisateur shibboleth (changez le mot de passe :) )<br></br><pre>USE mysql;INSERT INTO user (Host,User,Password,Select_priv,Insert_priv,Update_priv,Delete_priv,Create_tmp_table_priv,Lock_tables_priv,Execute_priv) VALUES('localhost','shibboleth',PASSWORD('demo'),'Y','Y','Y','Y','Y','Y','Y');FLUSH PRIVILEGES;GRANT ALL ON shibboleth.* TO 'shibboleth'@'localhost'IDENTIFIED BY 'demo';FLUSH PRIVILEGES;QUIT</pre>#vérification de l'utilisateur shibboleth<br></br>mysql -u shibboleth -p<br></br>La base est maintenant prête et l’utilisateur configuré

Authentification utilsateurs

L’authentification se base sur le module JAAS que nous allons configurer pour agir avec un LDAP distant (quelques informations sur les AD).
vi /etc/shibboleth/login.conf<br></br><pre>ShibUserPassAuth {edu.vt.middleware.ldap.jaas.LdapLoginModule requiredldapUrl="ldaps://ldap.example.org"baseDn="ou=people,dc=example,dc=org"bindDn="cn=idp-user,dc=example,dc=org"bindCredential="password for idp-user";};</pre>#### configuration de tomcat

Configuration du connecteur
vi /etc/tomcat6/server.xml<br></br>#commentez les connecteurs présent (ex : 8080) et le listener "AprLifecycleListener" puis ajouter<pre><Connector port="8009" address="127.0.0.1" enableLookups="false" redirectPort="443" protocol="AJP/1.3" tomcatAuthentication="false" /></pre>