Shibboleth IdP 3に関する情報をまとめているページです。
OS | Java | Servlet | IdP |
---|---|---|---|
CentOS 6.5 | OpenJDK 7 (CentOS 6.5付属) | Apache Tomcat 7.0.62 | Shibboleth IdP 3.1.1 |
CentOS 6.5 | Oracle Java 8u45 + JCE Unlimited Strength Jurisdiction Policy Files | Apache Tomcat 8.0.23 | Shibboleth IdP 3.1.1 |
学認メタデータの読み込みはmetadata-providers.xml
で設定します。
metadata-providers.xml
<MetadataProvider id="HTTPMetadata" xsi:type="FileBackedHTTPMetadataProvider" backingFile="%{idp.home}/metadata/gakunin-metadata-backing.xml" metadataURL="https://metadata.gakunin.nii.ac.jp/gakunin-metadata.xml"> <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P15D" /> <MetadataFilter xsi:type="SignatureValidation" requireSignedMetadata="true" certificateFile="%{idp.home}/credentials/gakunin-signer-2010.cer"/> <MetadataFilter xsi:type="EntityRoleWhiteList"> <RetainedRole>md:SPSSODescriptor</RetainedRole> </MetadataFilter> </MetadataProvider> |
//saml2:Subject/saml2:NameID
はattribute-filter.xml
に記述しなくてもsaml-nameid.properties
とsaml-nameid.xml
の設定により、SPメタデータの<NameIDFormat>に従って
下記の通り送信します。
SPメタデータの<NameIDFormat> の値 | 送信する属性 | |
---|---|---|
urn:oasis:names:tc:SAML:2.0:nameid-format:transient | transient-id | |
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent | persistent-id
| |
<NameIDFormat> がない |
|
<NameIDFormat>
がないSPの場合と<NameIDFormat>がurn:oasis:names:tc:SAML:2.0:nameid-format:persistent
の場合の//saml2:Subject/saml2:NameID
の例を下記に示す。
<NameIDFormat>
がないSPの場合
<saml2:Subject> <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://idp.example.ac.jp/idp/shibboleth" SPNameQualifier="https://sp1.example.jp/shibboleth-sp">AAdzZWNyZXQxgUnobM3/AN3fn8DfZPDqBp/GnKNxc5JR4nxXAxDAXZZSg0AZSrDh1Sip1fl9JGYrm2NWjl8zHKxHmbsgS/mFZ1ZlSYQ2U/Kz7tCQ+SDswixwLRcGg3tDvVSAY8imKSrElGWSm5gMM45D4rkeQONJYr7gQZ13</saml2:NameID> |
<NameIDFormat>がurn:oasis:names:tc:SAML:2.0:nameid-format:persistent
の場合
<saml2:Subject> <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://idp.example.ac.jp/idp/shibboleth" SPNameQualifier="https://sp2.example.jp/shibboleth-sp">oiUiApwGnBP8pS3HZJ02ZW/aOTI=</saml2:NameID> |
transient-id
のデフォルトはCryptoTransient
に変更になりました。CryptoTransient
の使用例を下記に示します。
IdP 2系と同じ短いTransient
を使いたい場合は下記の変更を行います。
saml-nameid.properties
idp.transientId.generator
をアンコメントして、値をshibboleth.StoredTransientIdGenerator
に変更します。
# Set to shibboleth.StoredTransientIdGenerator for server-side storage idp.transientId.generator = shibboleth.StoredTransientIdGenerator |
Transient
の使用例を下記に示します。
<saml2:Subject> <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://idp.example.ac.jp/idp/shibboleth" SPNameQualifier="https://sp1.example.jp/shibboleth-sp">_f358fb015b9b45c7d18a4a2647e79c33</saml2:NameID> |
computedIdでの設定を下記に示します。
saml-nameid.xml
<ref bean="shibboleth.SAML2PersistentGenerator" />
をアンコメントして有効にします。
<!-- Uncommenting this bean requires configuration in saml-nameid.properties. --> <!-- --> <ref bean="shibboleth.SAML2PersistentGenerator" /> <!-- --> |
saml-nameid.propertiesidp.persistentId.generator
のデフォルトはComputedId
の設定のため、idp.persistentId.sourceAttribute
とidp.persistentId.salt
のみを設定します。
# Set to shibboleth.StoredPersistentIdGenerator for db-backed storage # and uncomment/name the PersistentIdStore bean to use #idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator # Otherwise for computed PersistentIDs set the source attribute and salt. idp.persistentId.sourceAttribute = uid4persistentId idp.persistentId.salt = changethistosomethingrandom |
attribute-resolver.xml
とattribute-filter.xml
idp.persistentId.sourceAttribute
の値をattribute-resolver.xml
の//resolver:AttributeDefinition
で定義して、attribute-filter.xml
で送信設定を行います。
<!-- ========================================== --> <!-- PersistentId Definition --> <!-- ========================================== --> <!-- Attribute Definition for %{idp.persistentId.sourceAttribute} --> <resolver:AttributeDefinition id="%{idp.persistentId.sourceAttribute}" xsi:type="ad:Simple" sourceAttributeID="uid"> <resolver:Dependency ref="myLDAP" /> </resolver:AttributeDefinition> |
<!-- Release to anyone --> <afp:AttributeFilterPolicy id="PolicyforAnyone"> <afp:PolicyRequirementRule xsi:type="basic:ANY" /> <afp:AttributeRule attributeID="%{idp.persistentId.sourceAttribute}"> <afp:PermitValueRule xsi:type="basic:ANY" /> </afp:AttributeRule> </afp:AttributeFilterPolicy> |
storedIdでの設定を下記に示します。
saml-nameid.xml
<ref bean="shibboleth.SAML2PersistentGenerator" />
をアンコメントして有効にします。
<!-- Uncommenting this bean requires configuration in saml-nameid.properties. --> <!-- --> <ref bean="shibboleth.SAML2PersistentGenerator" /> <!-- --> |
saml-nameid.propertiesidp.persistentId.generator,
idp.persistentId.store, idp.persistentId.sourceAttributeとidp.persistentId.salt
を設定します。
# Set to shibboleth.StoredPersistentIdGenerator for db-backed storage # and uncomment/name the PersistentIdStore bean to use idp.persistentId.generator = shibboleth.StoredPersistentIdGenerator idp.persistentId.store = PersistentIdStore # Set this to null to skip hash-based generation of first stored ID #idp.persistentId.computed = shibboleth.ComputedPersistentIdGenerator # Otherwise for computed PersistentIDs set the source attribute and salt. idp.persistentId.sourceAttribute = uid4ppersistentId idp.persistentId.salt = changethistosomethingrandom |
global.xml
idp.persistentId.storeの値をglobal.xmlの//bean
で定義します。
<!-- Use this file to define any custom beans needed globally. --> <bean id="shibboleth.MySQLDataSource" class="org.apache.tomcat.dbcp.dbcp.BasicDataSource" p:driverClassName="com.mysql.jdbc.Driver" p:url="jdbc:mysql://localhost:3306/shibboleth" p:username="username" p:password="password" p:maxActive="10" p:maxIdle="5" p:maxWait="15000" p:testOnBorrow="true" p:validationQuery="select 1" p:validationQueryTimeout="5" /> <bean id="PersistentIdStore" class="net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStore" p:dataSource-ref="shibboleth.MySQLDataSource" /> |
<!-- Use this file to define any custom beans needed globally. --> <bean id="shibboleth.MySQLDataSource" class="org.apache.tomcat.dbcp.dbcp2.BasicDataSource" p:driverClassName="com.mysql.jdbc.Driver" p:url="jdbc:mysql://localhost:3306/shibboleth" p:username="username" p:password="password" p:maxIdle="5" p:testOnBorrow="true" p:validationQuery="select 1" p:validationQueryTimeout="5" /> <bean id="PersistentIdStore" class="net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStore" p:dataSource-ref="shibboleth.MySQLDataSource" /> |
Tomcat 8の場合に、 |
attribute-resolver.xml
とattribute-filter.xml
idp.persistentId.sourceAttribute
の値をattribute-resolver.xml
の//resolver:AttributeDefinition
で定義して、attribute-filter.xml
で送信設定を行います。
<!-- ========================================== --> <!-- PersistentId Definition --> <!-- ========================================== --> <!-- Attribute Definition for %{idp.persistentId.sourceAttribute} --> <resolver:AttributeDefinition id="%{idp.persistentId.sourceAttribute}" xsi:type="ad:Simple" sourceAttributeID="uid"> <resolver:Dependency ref="myLDAP" /> </resolver:AttributeDefinition> |
<!-- Release to anyone --> <afp:AttributeFilterPolicy id="PolicyforAnyone"> <afp:PolicyRequirementRule xsi:type="basic:ANY" /> <afp:AttributeRule attributeID="%{idp.persistentId.sourceAttribute}"> <afp:PermitValueRule xsi:type="basic:ANY" /> </afp:AttributeRule> </afp:AttributeFilterPolicy> |
//saml2:Subject/saml2:NameID
とは別に//saml2:AttributeStatement/saml2:Attribute
[@FriendlyName="eduPersonTargetedID"]
としてeduPersonTargetedId
属性を送信する設定は下記の通りです。
なお、この機能はShibboleth IdP 3ではDeprecated Featuresとなっています。
computedIdでの設定を下記に示します。Shibboleth IdP 2と同じ設定で送信可能です。
attribute-resolver.xml
<!-- ========================================== --> <!-- Attribute Definitions --> <!-- ========================================== --> <!-- Schema: eduPerson attributes --> <!-- Attribute Definition for eduPersonTargetedID --> <resolver:AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID" xmlns="urn:mace:shibboleth:2.0:resolver:ad" nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" sourceAttributeID="computedID"> <resolver:Dependency ref="computedID" /> <resolver:AttributeEncoder xsi:type="SAML1XMLObject" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" /> <resolver:AttributeEncoder xsi:type="SAML2XMLObject" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" /> </resolver:AttributeDefinition> <!-- ========================================== --> <!-- Data Connectors --> <!-- ========================================== --> <!-- Computed targeted ID connector --> <resolver:DataConnector xsi:type="ComputedId" xmlns="urn:mace:shibboleth:2.0:resolver:dc" id="computedID" generatedAttributeID="computedID" sourceAttributeID="uid" salt="changethistosomethingrandom"> <resolver:Dependency ref="myLDAP" /> </resolver:DataConnector> |
attribute-filter.xml
<!-- Release to sp.example.jp --> <afp:AttributeFilterPolicy id="PolicyforSP1ExampleJP"> <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://sp.example.jp/shibboleth-sp" /> <afp:AttributeRule attributeID="eduPersonTargetedID"> <afp:PermitValueRule xsi:type="basic:ANY" /> </afp:AttributeRule> </afp:AttributeFilterPolicy> |
attribute-resolver.xml
のData ConnectorはShibboleth IdP 3の機能を用いて、persistent-idの設定で定義したsaml-nameid.propertiesの
プロパティを使って書くこともできます。
attribute-resolver.xml
<!-- ========================================== --> <!-- Data Connectors --> <!-- ========================================== --> <!-- Computed targeted ID connector --> <resolver:DataConnector xsi:type="ComputedId" xmlns="urn:mace:shibboleth:2.0:resolver:dc" id="computedID" generatedAttributeID="computedID" sourceAttributeID="%{idp.persistentId.sourceAttribute}" salt="changethistosomethingrandom"> <!-- salt="%{idp.persistentId.salt}"> --> <resolver:Dependency ref="%{idp.persistentId.sourceAttribute}" /> </resolver:DataConnector> |
Shibboleth IdP 3.1.1では、 |
storedIdでの設定を下記に示します。Shibboleth IdP 2と同じ設定で送信可能です。
attribute-resolver.xml
<!-- ========================================== --> <!-- Attribute Definitions --> <!-- ========================================== --> <!-- Schema: eduPerson attributes --> <!-- Attribute Definition for eduPersonTargetedID --> <resolver:AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID" xmlns="urn:mace:shibboleth:2.0:resolver:ad" nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" sourceAttributeID="computedID"> <resolver:Dependency ref="computedID" /> <resolver:AttributeEncoder xsi:type="SAML1XMLObject" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" /> <resolver:AttributeEncoder xsi:type="SAML2XMLObject" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" /> </resolver:AttributeDefinition> <!-- ========================================== --> <!-- Data Connectors --> <!-- ========================================== --> <!-- Stored targeted ID connector --> <resolver:DataConnector xsi:type="StoredId" xmlns="urn:mace:shibboleth:2.0:resolver:dc" id="storedID" generatedAttributeID="storedID" sourceAttributeID="uid" salt="changethistosomethingrandom"> <resolver:Dependency ref="myLDAP" /> <ApplicationManagedConnection jdbcDriver="com.mysql.jdbc.Driver" jdbcURL="jdbc:mysql://localhost:3306/shibboleth?autoReconnect=true" jdbcUserName="username" jdbcPassword="password" /> </resolver:DataConnector> |
attribute-filter.xml
<!-- Release to sp.example.jp --> <afp:AttributeFilterPolicy id="PolicyforSP1ExampleJP"> <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://sp.example.jp/shibboleth-sp" /> <afp:AttributeRule attributeID="eduPersonTargetedID"> <afp:PermitValueRule xsi:type="basic:ANY" /> </afp:AttributeRule> </afp:AttributeFilterPolicy> |
attribute-resolver.xml
のData ConnectorはShibboleth IdP 3の機能を用いて、persistent-id の設定で定義したglobal.xmlの
beanとsaml-nameid.propertiesのプ
ロパティを使って書くこともできます。
attribute-resolver.xml
<!-- ========================================== --> <!-- Data Connectors --> <!-- ========================================== --> <!-- Stored targeted ID connector --> <resolver:DataConnector xsi:type="StoredId" xmlns="urn:mace:shibboleth:2.0:resolver:dc" id="storedID" generatedAttributeID="storedID" sourceAttributeID="%{idp.persistentId.sourceAttribute}" salt="changethistosomethingrandom"> <!-- salt="%{idp.persistentId.salt}"> --> <resolver:Dependency ref="%{idp.persistentId.sourceAttribute}" /> <BeanManagedConnection>shibboleth.MySQLDataSource</BeanManagedConnection> </resolver:DataConnector> |
Shibboleth IdP 3.1.1では、 |