Mac OS X 10.3 deployments of the Shibboleth SP must be built from source, but binaries are available for 10.4's default distribution. Mac OS X 10.3 and 10.4 both come pre-packaged with various versions of Apache 1.3.x. The default Apache and OpenSSL bundled with Mac OS X is capable of running Shibboleth, as is an OS X installation of Apache 2.0.x.
/opt/shibboleth-sp/libto the environment variable
DYLD_INSERT_LIBRARIESenvironment variable point to
/opt/shibboleth-sp/lib/libshib-target.dylib:/opt/shibboleth-sp/lib/libshib.dylib(substituting the actual path of these libraries, if not in the location shown). The simplest thing to do is place a command to set and export this variable in
/usr/sbin/apachectl, such as:
libphp4Apache module are written in C++, as is the Shibboleth SP. There is a known conflict on Unix-based platforms between the PHP extensions
libsablot.sowhich will manifest itself as segmentation faults when starting Apache. If a site wants to use
libphp4.soand Shibboleth at the same time, then one of the following may be done:
--with-xslt-sablotfrom PHP's configuration;
It is recommended that the Shibboleth binary be installed from the supplied tarball on the Shibboleth site when possible by untarring it into the root directory.
tar -xvzf /path/to/shibboleth-sp-1.3-macosx-10.4.tar.gz
If you will be building the module yourself, follow the build instructions, which include a large number of additional prerequisite packages.
Add the newly compiled or installed modules to Apache next.
/opt/shibboleth-sp/etc/shibboleth/apache22.configwhich must be
httpd.conffile used locally. Be wary of placing the Include directive in the wrong
# Example for Apache 2.2.x Include /opt/shibboleth-sp/etc/shibboleth/apache22.config
UseCanonicalNamedirective should be set to
Onor resource mapping errors will result.
ServerNamedirective is properly set, and that Apache is being started with SSL enabled.
/opt/shibboleth-sp/sbin/shibdmust be independently started and run in order to handle access requests. In most cases, the build process ensures that
shibdcan locate the configuration file and schemas, but the
SHIBSCHEMASenvironment variables may be used as well. Command line options can also be used to specify them.
/opt/shibboleth-sp/var/log/httpd/native.log, though this can be changed by modifying the
.loggerfiles pointed to by the configuration. For this log to be created, Apache must have permission to write to this file, which may require that the file be manually created and permissions assigned to whatever user Apache is configured to run under. If the file does not appear when Apache runs with the modules loaded, check for permission problems or change the location used.
shibdcreates its own separate logs at
/opt/shibboleth-sp/var/log/shibboleth/shibd.logand must have appropriate write permissions itself as well.
At this point, you should have a fully functional SP, but before it can be tested, you'll need to configure it to interoperate with an !IdP. Many federations will provide these for their community, and TestShib is available for anyone to test with.