Shibboleth 2
Space shortcuts
Page tree

The Shibboleth 2.x software has reached its End of Life and is no longer supported. This documentation is available for historical purposes only. See the IDP30 and SP3 wiki spaces for current documentation on the supported versions.

Skip to end of metadata
  • Created by Unknown User (lajoie@idp.protectnetwork.org), last modified on Mar 21, 2008
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 14 Next »

Preparing JBoss for the Shibboleth Identity Provider

Version Requirements/Recommendations

  • JBoss AS 4 or greater
  • Java 5 or greater

Required Configuration Changes

  • Edit your the login-config.xml configuration file and comment out the <application-policy name = "other"> element. This default policy requires that a user authentication source also report a set of roles for the user. Most deployer's will not do this during the authentication step (though they may later on during the attribute resolution step). Therefore, this policy needs to be removed.

Supporting SOAP Endpoints

Shibboleth IdPs and SP may communicate directly, as opposed to sending messages via the user's browser, during certain operations (Attribute Query, Artifact Resolution, and Logout). In order to support these request the IdP needs an additional port (called a Connector within the Tomcat configuration), distinct from the one used by the user (because they have different, mutually exclusive, security requirements).

  1. Copy the following Connector definition into JBoss Tomcat's server/<serviceProfile>/deploy/jboss-web.deployer/server.xml. This definition should be placed either before the first, or after the last, connector already defined in the configuration file. 
    <Connector port="8443" 
           maxHttpHeaderSize="8192"
           maxSpareThreads="75"
           scheme="https"
           secure="true"
           clientAuth="true"
           sslProtocol="TLS" 
           keystoreFile="IDP_HOME/credentials/idp.jks"
           keystorePass="PASSWORD"
           truststoreFile="IDP_HOME/credentials/idp.jks"
           truststorePass="PASSWORD"
           algorithm="DelegateToApplication"/>
  2. Replace IDP_HOME with the directory you will install the IdP into and PASSWORD with the password you entered during installation.
  • No labels