Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision |
en:production [2022/04/29 10:39] – Wolfgang Pempe | en:production [2023/01/09 14:21] – [1. Metadata Administration Tool] updated for new metadata admin tool Silke Meyer |
---|
===== 1. Metadata Administration Tool ===== | ===== 1. Metadata Administration Tool ===== |
| |
Using the Metadata Admin Tool (entity edit view, section "Federations"), the respective entity has to be added to the federation / metadata set that is considered to fit best the needs for productive operations (cf. [[en:degrees_of_reliance|Degrees of Reliance]]). The system will check whether the metadata of this entity meet all requirements of the production environment (especially the registered certificate[s]) - and whether the account is linked with a contract. If the checks are positive, the entity will be unlocked. | Using the Metadata Admin Tool (entity edit view, section "Federations"), the respective entity has to be added to the federation / metadata set that is considered to fit best the needs for productive operations (cf. [[en:degrees_of_reliance|Degrees of Reliance]]). The system will check whether the metadata of this entity meet all requirements of the production environment (especially the registered certificate[s]) - and whether the account is linked with a contract. If the checks are positive, the button will be unlocked. The metadata entry in question is then reviewed by the DFN-AAI team. |
| |
| {{:en:metadata_admin_tool:mdv-produktiv-pending-neuemdv-en.png?600|}} |
===== 2. Configuration Changes ===== | ===== 2. Configuration Changes ===== |
| |
xsi:type="FileBackedHTTPMetadataProvider" | xsi:type="FileBackedHTTPMetadataProvider" |
backingFile="%{idp.home}/metadata/dfn-aai-sp-metadata.xml" | backingFile="%{idp.home}/metadata/dfn-aai-sp-metadata.xml" |
metadataURL="http://www.aai.dfn.de/fileadmin/metadata/dfn-aai-sp-metadata.xml" | metadataURL="http://www.aai.dfn.de/metadata/dfn-aai-sp-metadata.xml" |
maxRefreshDelay="PT2H"> | maxRefreshDelay="PT2H"> |
<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true" | <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true" |
xsi:type="FileBackedHTTPMetadataProvider" | xsi:type="FileBackedHTTPMetadataProvider" |
backingFile="%{idp.home}/metadata/dfn-aai-edugain+sp-metadata.xml" | backingFile="%{idp.home}/metadata/dfn-aai-edugain+sp-metadata.xml" |
metadataURL="http://www.aai.dfn.de/fileadmin/metadata/dfn-aai-edugain+sp-metadata.xml" | metadataURL="http://www.aai.dfn.de/metadata/dfn-aai-edugain+sp-metadata.xml" |
maxRefreshDelay="PT2H"> | maxRefreshDelay="PT2H"> |
<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true" | <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true" |
| |
==== SP Example ==== | ==== SP Example ==== |
| |
| <callout type="danger" title="Important note: Make sure that redirectLimit is set to the value 'host' or 'exact'!"> |
| Please make sure that in **''shibboleth2.xml''** in all **''<Sessions>''** elements the XML attribute **''redirectLimit''** |
| - is set and |
| - has the value **''host''** or **''exact''**! (if necessary in combination with ''allow'') |
| This measure prevents the possible open redirect misuse of the SP e.g. in the context of a phishing attack, cf. https://shibboleth.atlassian.net/browse/SSPCPP-714. |
| For more information on the configuration parameters of the ''<Sessions>'' element see the [[https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334342/Sessions|Shibboleth Wiki]]. |
| </callout> |
| |
**For metadata URLs and the certificate for signature validation please refer to [[en:metadata|the Metadata documentation]].** | **For metadata URLs and the certificate for signature validation please refer to [[en:metadata|the Metadata documentation]].** |
| |
<file xml /etc/shibboleth/shibboleth2.xml> | <file xml /etc/shibboleth/shibboleth2.xml> |
<MetadataProvider type="XML" | <MetadataProvider type="XML" |
uri="http://www.aai.dfn.de/fileadmin/metadata/dfn-aai-idp-metadata.xml" | uri="http://www.aai.dfn.de/metadata/dfn-aai-idp-metadata.xml" |
backingFilePath="dfn-aai-idp-metadata.xml" reloadInterval="3600"> | backingFilePath="dfn-aai-idp-metadata.xml" reloadInterval="3600"> |
<MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" /> | <MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" /> |
| |
<MetadataProvider type="XML" | <MetadataProvider type="XML" |
uri="http://www.aai.dfn.de/fileadmin/metadata/dfn-aai-edugain+idp-metadata.xml" | uri="http://www.aai.dfn.de/metadata/dfn-aai-edugain+idp-metadata.xml" |
backingFilePath="dfn-aai-edugain+idp-metadata.xml" reloadInterval="3600"> | backingFilePath="dfn-aai-edugain+idp-metadata.xml" reloadInterval="3600"> |
<MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" /> | <MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" /> |
<file xml /etc/shibboleth/shibboleth2.xml> | <file xml /etc/shibboleth/shibboleth2.xml> |
<MetadataProvider type="XML" validate="true" | <MetadataProvider type="XML" validate="true" |
url="http://www.aai.dfn.de/fileadmin/metadata/dfn-aai-idp-metadata.xml" | url="http://www.aai.dfn.de/metadata/dfn-aai-idp-metadata.xml" |
backingFilePath="dfn-aai-idp-metadata.xml" reloadInterval="3600"> | backingFilePath="dfn-aai-idp-metadata.xml" reloadInterval="3600"> |
<MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" /> | <MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" /> |