shibboleth with google

shibboleth idp與google app認證整合
ps:
shibboleth idp建置與設定可參考http://systw.net/note/af/sblog/more.php?id=255

shibboleth idp部份,步驟摘要
1建立google app的sp metadata
2透過relying-party.xml將該sp metadata納入idp
3透過attribute-resolver.xml新增attribute連接idp的ldap
4透過attribute-policy.xml設定該attribute存取規則

.....

1
建立sp metadata

在IDP_HOME/metadata下建立metadata,並擁有以下資料
< md:EntityDescriptor entityID="< sp_entityid>" validUntil="2010-01-01T00:00:00Z">
< md:SPSSODescriptor protocolSupportEnumeration="< value>" >
 < md:NameIDFormat>< /md:NameIDFormat>
 < md:AssertionConsumerService
Location="< relative path>" index="< unsigned integer>" Binding="< URI>"
/>
< /md:SPSSODescriptor>
< /md:EntityDescriptor>
說明如下
EntityDescriptor

 entityID="< sp_entityid>" ,若沒勾選Use a domain specific issuer,則sp_entiyid為google.com
 xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
protocolSupportEnumeration
支援以下,若設多個需以空白分隔
 urn:oasis:names:tc:SAML:1.1:protocol
 urn:oasis:names:tc:SAML:2.0:protocol
NameIDFormat(選擇性)
 指定sp saml name identifiers格式
AssertionConsumerService(至少需設定一個)
需設定location,binding,index
 location
 需設定sp acs的url位置
 This is the location to which an IdP sends assertions using whatever protocol and binding it shares with the SP.
 Each combination of SSO protocol and binding is usually installed at a unique location to improve efficiency.
 binding
 支援以下uri
 urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
 urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign
 urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact
 urn:oasis:names:tc:SAML:2.0:bindings:PAOS
 index
 是一個acs endpoint的tag,用來參照到其他組態元素或應用,一般都設1

ex
假設
sp_entityid=google.com
location=https://www.google.com/a/systw.net/acs

#vi $IDP_HOME/metadata/google-metadata.xml
< EntityDescriptor entityID="google.com" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
 < SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
  < NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified< /NameIDFormat>
  < AssertionConsumerService
   index="1"
   Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
   Location="https://www.google.com/a/systw.net/acs" />
 < /SPSSODescriptor>
< /EntityDescriptor>

.....
 
2
定義sp metadata來源
編輯$IDP_HOME/conf/relying-party.xml,並設定以下
ex:
#vi $IDP_HOME/conf/relying-party.xml

ps:以下YOUR-ENTITY-ID及IDP_HOME需依實際環境做設定

2.1定義新的RelyingParty element
格式如下
< RelyingParty id="< sp_entityid>"
 provider="< idp_entityid>"
 defaultSigningCredentialRef="IdPCredential">
 < ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
< /RelyingParty>
說明如下
relying party 主要有以下3種類型
 < AnonymousRelyingParty> 需設定provider屬性
 < DefaultRelyingParty> 需設定provider屬性
 < RelyingParty> 需設定id及provider屬性
id 設定sp的entityid
provider 設定idp的entityid
defaultSigningCredentialRef 使用IdPCredential
xsi:type 使用saml:SAML2SSOProfile
ps:relying party相關設定請參考https://spaces.internet2.edu/display/SHIB2/IdPRelyingParty
ps:relying party相關說明https://spaces.internet2.edu/display/SHIB2/IdPUnderstandingRP
ex:
將以下relyingparty放入
< RelyingParty id="google.com"
 provider="YOUR-ENTITY-ID"
 defaultSigningCredentialRef="IdPCredential">
 < ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
< /RelyingParty>

2.2將剛才建立的sp metadata設定進去
格式如下
< MetadataProvider id="< id>" xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"
metadataFile="< sp metadata path>" maintainExpiredMetadata="true" />
說明如下
id    
xsi:type使用"FilesystemMetadataProvider"
xmlns使用"urn:mace:shibboleth:2.0:metadata
metadataFile要定義metadata file的實際位置
ps:
Define a New Metadata Source(定義新metadata來源說明)
https://spaces.internet2.edu/display/SHIB2/IdPMetadataProvider
ex:
將以下metadataprovider放入< metadata:MetadataProvider id="ShibbolethMetadata" xsi:type="metadata:ChainingMetadataProvider">和< /metadata:MetadataProvider>之間
< !-- Google Metadata -->
< MetadataProvider id="GoogleMD" xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"
metadataFile="IDP_HOME/metadata/google-metadata.xml" maintainExpiredMetadata="true" />

.....
3
新增attribute連接idp的ldap
 

設定Attribute Definition和Attribute Encoding
#vi $IDP_HOME/conf/attribute-resolver.xml
< resolver:AttributeDefinition id="principal" xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad">
 < resolver:Dependency ref="myldap" />
 < resolver:AttributeEncoder
  xsi:type="SAML2StringNameID"
  xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
  nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
< /resolver:AttributeDefinition>
說明如下
AttributeDefinition部份
 id 用於和AttributeRule attributeID對應的編號
 xsi:type使用principal name attribute definition  
 resolver:Dependency ref 用於和dataconnector對應的編號
AttributeEncoder部份
 xsi:type使用"SAML2StringNameID"

ex:
新增principal屬性,並用myldap連接idp
#vi $IDP_HOME/conf/attribute-resolver.xml
< resolver:AttributeDefinition id="principal" xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad">
 < resolver:Dependency ref="myldap" />
 < resolver:AttributeEncoder
  xsi:type="SAML2StringNameID"
  xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
  nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
< /resolver:AttributeDefinition>

ps:
release the attribute
修改attribute-filter.xml以設定attribute filter policy,才可使用新的attribute,如下步驟4

.....
4
設定attribute存取規則

透過policy設定attribute的存取規則
#vi IDP_HOME/conf/attribute-filter.xml
< afp:AttributeFilterPolicy id="unique name">
 < afp:PolicyRequirementRule xsi:type="< type>" />
 < afp:AttributeRule attributeID="< attributeid>">
  < afp:PermitValueRule xsi:type="< type>" />
 < /afp:AttributeRule>
< /afp:AttributeFilterPolicy>
說明如下
AttributeFilterPolicy id 自行設定一個不要重覆的唯一名稱
 
AttributeRule attributeID 用於和AttributeDefinition id對應的編號

ex:
設定principal屬性使用的policy
< afp:AttributeFilterPolicy id="releasetoanyone">
 < afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="google.com" />
 < afp:AttributeRule attributeID="principal">
  < afp:PermitValueRule xsi:type="basic:ANY" />
 < /afp:AttributeRule>
< /afp:AttributeFilterPolicy>

 

2012-11-04 11:05:20發表 2012-11-04 11:32:49修改   

數據分析
程式開發
計算機組織與結構
資料結構與演算法
Database and MySql
manage tool
windows
unix-like
linux service

network
network layer3
network layer2
network WAN
network service
作業系統
數位鑑識
資訊安全解決方案
資訊安全威脅
Cisco security
Cisco network
Cisco layer3
Cisco layer2



  登入      [牛的大腦] | [單字我朋友] Powered by systw.net