shibboleth idp與google app認證整合
ps:shibboleth idp建置與設定可參考https://systw.net/note/af/sblog/more.php?id=255
shibboleth idp部份,步驟摘要
1建立google app的sp metadata
2透過relying-party.xml將該sp metadata納入idp
3透過attribute-resolver.xml新增attribute連接idp的ldap
4透過attribute-policy.xml設定該attribute存取規則
…..
1
建立sp metadata
在IDP_HOME/metadata下建立metadata,並擁有以下資料
< md:EntityDescriptor entityID=”< sp_entityid>” validUntil=”2010-01-01T00:00:00Z”>
< md:SPSSODescriptor protocolSupportEnumeration=”< value>” >
< md:NameIDFormat>< /md:NameIDFormat>
< md:AssertionConsumerService
Location=”< relative path>” index=”< unsigned integer>” Binding=”< URI>“
/>
< /md:SPSSODescriptor>
< /md:EntityDescriptor>
說明如下
EntityDescriptor
entityID=”< sp_entityid>” ,若沒勾選Use a domain specific issuer,則sp_entiyid為google.com
xmlns=”urn:oasis:names:tc:SAML:2.0:metadata”
protocolSupportEnumeration
支援以下,若設多個需以空白分隔
urn:oasis:names:tc:SAML:1.1:protocol
urn:oasis:names:tc:SAML:2.0:protocol
NameIDFormat(選擇性)
指定sp saml name identifiers格式
AssertionConsumerService(至少需設定一個)
需設定location,binding,index
location
需設定sp acs的url位置
This is the location to which an IdP sends assertions using whatever protocol and binding it shares with the SP.
Each combination of SSO protocol and binding is usually installed at a unique location to improve efficiency.
binding
支援以下uri
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact
urn:oasis:names:tc:SAML:2.0:bindings:PAOS
index
是一個acs endpoint的tag,用來參照到其他組態元素或應用,一般都設1
ex
假設
sp_entityid=google.com
location=https://www.google.com/a/systw.net/acs
則
#vi $IDP_HOME/metadata/google-metadata.xml
< EntityDescriptor entityID=”google.com” xmlns=”urn:oasis:names:tc:SAML:2.0:metadata”>
< SPSSODescriptor protocolSupportEnumeration=”urn:oasis:names:tc:SAML:2.0:protocol”>
< NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified< /NameIDFormat>
< AssertionConsumerService
index=”1″
Binding=”urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST”
Location=”https://www.google.com/a/systw.net/acs” />
< /SPSSODescriptor>
< /EntityDescriptor>
…..
2
定義sp metadata來源
編輯$IDP_HOME/conf/relying-party.xml,並設定以下
ex:
#vi $IDP_HOME/conf/relying-party.xml
ps:以下YOUR-ENTITY-ID及IDP_HOME需依實際環境做設定
2.1定義新的RelyingParty element
格式如下
< RelyingParty id=”< sp_entityid>”
provider=”< idp_entityid>”
defaultSigningCredentialRef=”IdPCredential”>
< ProfileConfiguration xsi:type=”saml:SAML2SSOProfile” encryptAssertions=”never” encryptNameIds=”never” />
< /RelyingParty>
說明如下
relying party 主要有以下3種類型
< AnonymousRelyingParty> 需設定provider屬性
< DefaultRelyingParty> 需設定provider屬性
< RelyingParty> 需設定id及provider屬性
id 設定sp的entityid
provider 設定idp的entityid
defaultSigningCredentialRef 使用IdPCredential
xsi:type 使用saml:SAML2SSOProfile
ps:relying party相關設定請參考https://spaces.internet2.edu/display/SHIB2/IdPRelyingParty
ps:relying party相關說明https://spaces.internet2.edu/display/SHIB2/IdPUnderstandingRP
ex:
將以下relyingparty放入
< RelyingParty id=”google.com”
provider=”YOUR-ENTITY-ID”
defaultSigningCredentialRef=”IdPCredential”>
< ProfileConfiguration xsi:type=”saml:SAML2SSOProfile” encryptAssertions=”never” encryptNameIds=”never” />
< /RelyingParty>
2.2將剛才建立的sp metadata設定進去
格式如下
< MetadataProvider id=”< id>” xsi:type=”FilesystemMetadataProvider” xmlns=”urn:mace:shibboleth:2.0:metadata”
metadataFile=”< sp metadata path>” maintainExpiredMetadata=”true” />
說明如下
id
xsi:type使用”FilesystemMetadataProvider”
xmlns使用”urn:mace:shibboleth:2.0:metadata
metadataFile要定義metadata file的實際位置
ps:
Define a New Metadata Source(定義新metadata來源說明)
https://spaces.internet2.edu/display/SHIB2/IdPMetadataProvider
ex:
將以下metadataprovider放入< metadata:MetadataProvider id=”ShibbolethMetadata” xsi:type=”metadata:ChainingMetadataProvider”>和< /metadata:MetadataProvider>之間
< !– Google Metadata –>
< MetadataProvider id=”GoogleMD” xsi:type=”FilesystemMetadataProvider” xmlns=”urn:mace:shibboleth:2.0:metadata”
metadataFile=”IDP_HOME/metadata/google-metadata.xml” maintainExpiredMetadata=”true” />
…..
3
新增attribute連接idp的ldap
設定Attribute Definition和Attribute Encoding
#vi $IDP_HOME/conf/attribute-resolver.xml
< resolver:AttributeDefinition id=”principal” xsi:type=”PrincipalName” xmlns=”urn:mace:shibboleth:2.0:resolver:ad”>
< resolver:Dependency ref=”myldap” />
< resolver:AttributeEncoder
xsi:type=”SAML2StringNameID”
xmlns=”urn:mace:shibboleth:2.0:attribute:encoder”
nameFormat=”urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified” />
< /resolver:AttributeDefinition>
說明如下
AttributeDefinition部份
id 用於和AttributeRule attributeID對應的編號
xsi:type使用principal name attribute definition
resolver:Dependency ref 用於和dataconnector對應的編號
AttributeEncoder部份
xsi:type使用”SAML2StringNameID”
ex:
新增principal屬性,並用myldap連接idp
#vi $IDP_HOME/conf/attribute-resolver.xml
< resolver:AttributeDefinition id=”principal” xsi:type=”PrincipalName” xmlns=”urn:mace:shibboleth:2.0:resolver:ad”>
< resolver:Dependency ref=”myldap” />
< resolver:AttributeEncoder
xsi:type=”SAML2StringNameID”
xmlns=”urn:mace:shibboleth:2.0:attribute:encoder”
nameFormat=”urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified” />
< /resolver:AttributeDefinition>
ps:
release the attribute
修改attribute-filter.xml以設定attribute filter policy,才可使用新的attribute,如下步驟4
…..
4
設定attribute存取規則
透過policy設定attribute的存取規則
#vi IDP_HOME/conf/attribute-filter.xml
< afp:AttributeFilterPolicy id=”unique name”>
< afp:PolicyRequirementRule xsi:type=”< type>” />
< afp:AttributeRule attributeID=”< attributeid>”>
< afp:PermitValueRule xsi:type=”< type>” />
< /afp:AttributeRule>
< /afp:AttributeFilterPolicy>
說明如下
AttributeFilterPolicy id 自行設定一個不要重覆的唯一名稱
AttributeRule attributeID 用於和AttributeDefinition id對應的編號
ex:
設定principal屬性使用的policy
< afp:AttributeFilterPolicy id=”releasetoanyone”>
< afp:PolicyRequirementRule xsi:type=”basic:AttributeRequesterString” value=”google.com” />
< afp:AttributeRule attributeID=”principal”>
< afp:PermitValueRule xsi:type=”basic:ANY” />
< /afp:AttributeRule>
< /afp:AttributeFilterPolicy>