The example values used in this guide are:

idp.example.org: The DNS name of the Identity Provider
/opt/uApprove: The directory, where the uApprove is installed
/opt/uApprove/conf: The directory, where the uApprove config is located
/opt/shibboleth-identityprovider: The Shibboleth IdP installation directory (where install.sh lives)
/opt/shibboleth-idp: The directory, where the Shibboleth IdP is installed
${CATALINA_HOME}: The directory, where Tomcat is installed (i.e. /usr/java/tomcat).

Before start install and configure uApprove.jp, assure that the following prerequisites are met:

Shibboleth Identity Provider 2.3.: Shibboleth Identity Provider has to be deployed properly.
That implied that Java and Tomcat are working.
SQL Database: If a SQL Database as storage is used, A SQL Server has to be prepared.
Shipped uApprove.jp is already configured for MySQL, but another SQL Server can be adapted.

Download and unzip the uApprove.jp package:

wget https://www.gakunin.jp/docs/files/uApprove.jp-2.2.1b-bin.zip
unzip uApprove.jp-2.2.1b-bin.zip -d /opt/
ln -s /opt/uApprove.jp-2.2.1b /opt/uApprove

Copy libraries and configuration:

cd /opt/uApprove
mkdir conf logs war
unzip idp-plugin-2.2.1b-bin.zip
cp idp-plugin-2.2.1b/conf-template/* conf/
cp idp-plugin-2.2.1b/lib/* /opt/shibboleth-identityprovider-2.x/lib/

Copy libraries and configuration:

cd /opt/uApprove
unzip viewer-2.2.1b-bin.zip
cp viewer-2.2.1b/conf-template/* conf/

The storage holds mainly the following data:

Username
Last version of the term of use that be accepted
List of encrypted attributes that were release to a Shibboleth SP
Entity ID of Shibboleth SP

First you have to decide which storage implementation should be used:

File based: This is only recommended for small installation (< 100 users)
SQL Database: MySQL database is fully supported, but any SQL Database which has a JDBC connector should work. May be advanced configuration is needed.

A file based storage have to be setup in /opt/uApprove/conf/common.properties:

#storageType=database
#databaseConfig=/opt/uApprove/conf/database.properties

storageType=file
flatFile = /opt/uApprove/data/uApprove-log.xml

NoteAssure that the directory in which uApprove-log.xml is stored is read- and writable by Tomcat.

WarningDon't create uApprove-log.xml beforehand because uApprove.jp generates it.

First, a databases and a user have to be created:

mysql -u root -p
mysql>
CREATE DATABASE uApprove;
CREATE USER 'uApprove'@'localhost' IDENTIFIED BY 'uApprove';
GRANT USAGE ON *.* TO 'uApprove'@'localhost';
GRANT SELECT , INSERT , UPDATE , DELETE ON `uApprove`.* TO 'uApprove'@'localhost';
ALTER DATABASE uApprove DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci;

Second, generate the table structures:

mysql -u root -p
mysql>
use uApprove;

create table ArpUser (
  idxArpUser int unsigned auto_increment primary key,
  auUserName varchar(255) not null,
  auLastTermsVersion varchar(255),
  auFirstAccess timestamp,
  auLastAccess timestamp
);
create index idxUserName on ArpUser (auUserName );

create table ShibProvider (
  idxShibProvider int unsigned auto_increment primary key,
  spProviderName varchar(255)
);

insert into ShibProvider (idxShibProvider) values (1);
create index idxProvidername on ShibProvider (spProviderName);

create table AttrReleaseApproval (
  idxAttrReleaseApproval int unsigned auto_increment primary key,
  araIdxArpUser int unsigned references ArpUser ( idxArpUser ),
  araIdxShibProvider int unsigned references ShibProvider( idxShibProvider ),
  araTimeStamp timestamp not null,
  araTermsVersion varchar(255),
  araAttributes text(2048)
);

create table ProviderAccess (
  idxProviderAccess int unsigned auto_increment primary key,
  paIdxArpUser int unsigned references ArpUser( idxArpUser ),
  paIdxShibProvider int unsigned references ShibProvider( idxShibProvider ),
  paAttributesSent text,
  paTermsVersion varchar(255),
  paIdxAttrReleaseApproval int unsigned references AttrReleaseApproval ( idxAttrReleaseApproval ),
  paShibHandle varchar(255),
  paTimeStamp timestamp not null
);

create table CheckAlways (
  idxCheckAlways int unsigned auto_increment primary key,
  caIdxArpUser int unsigned references ArpUser ( idxArpUser ),
  caIdxShibProvider int unsigned references ShibProvider ( idxShibProvider ),
  caTimeStamp timestamp not null
);

Note CheckAlways is a new table which does not in uApprove.

For easy checking whether the setting of the database is right, you can use the following command:

echo 'SHOW TABLES' | mysql -u uApprove -p -h localhost uApprove
Enter password:
Tables_in_uApprove
ArpUser
AttrReleaseApproval
CheckAlways
ProviderAccess
ShibProvider

A Database setup is configured in /opt/uApprove/conf/common.properties:

storageType=database
databaseConfig=/opt/uApprove/conf/database.properties

#storageType=file
#flatFile=/opt/uApprove/data/uApprove-log.xml

Note uApprove.jp supports JDBC connection pooling provided by the BoneCP library.
It is possible to configure container managed connections as well as application managed connection pooling.

All database specific configuration is done in /opt/uApprove/conf/database.properties:

sqlCommands=/opt/uApprove/conf/mysql.commands

# first option to use jndi and container managed connections
# resourceName=jdbc/mypool

# second option to use application managed connection pooling
# this is provided by the bonecp library http://jolbox.com/
# these are the required parameters
driver=com.mysql.jdbc.Driver
url=jdbc:mysql://localhost:3306/uApprove
user=uApprove
password=uApprove

# optional parameters for bonecp
#
# connectionTestStatement=SELECT 1
# minConnectionsPerPartition=1
# maxConnectionsPerPartition=5
# partitionCount=2

NoteIf another SQL server than MySQL is used, the values above has to be adjusted.
Don't forget to put according JDBC driver into the library folder.
If it is necessary, the SQL commands can be re-defined in /opt/uApprove/conf/custom-sql.commands

The TermsOfUseManager, which shows a Terms of use text to the user is optional. If the TermsOfUseManager should be active, define the terms in /opt/uApprove/conf/common.properties:

termsOfUse=/opt/uApprove/conf/terms-of-use.xml

Note The shipped terms-of-use.xml is an empty one, which can be filled by custom terms of use version and text.
If you want see a real world example, take a look at the SWITCHaai VHO terms of use (doc/terms-of-use-SWITCH.xml).

Cause the IdP plugin and the viewer application exchange some confidential information, this is encrypted and decrypted by a shared secret (128 bit, 16 bytes) in /opt/uApprove/conf/common.properties:

sharedSecret=QErDXYZEAoS6jooPvdBhQg==

For easy creating a random value, containing 16 chars, you can use the following command:

openssl rand -base64 16 2>/dev/null

uApprove.jp shows all attributes which will be released for the current user to the target resource.

It is possible to define an order of the attribute listing and if necessary, attributes can also be hidden. The configuration of the attribute list is optional done by /opt/uApprove/conf/idp-plugin.properties:

attributeList=/opt/uApprove/conf/attribute-list

An attribute-list can be look like:

# Defined attribute order
surname
givenName
postalAddress
...

# attributes to hide
!persistentId
!transientId

Note The attribute name in attribute-list has to comply with the attribute id in /opt/shibboleth-idp/conf/attribute-resolver.xml

The viewer web application is multi lingual for the static text and dynamic text, like attribute names and descriptions.
For the static text, the following languages are supported: en, de, fr, it, pt, ja.
For the attribute names and descriptions, the localized content is taken from /opt/shibboleth-idp/conf/attribute-resolver.xml (Shibboleth IdP resolver). It's possible to adjust or extent it:

...

<resolver:AttributeDefinition id="postalAddress" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="postalAddress">
  <resolver:Dependency ref="myLDAP" />
  <resolver:DisplayName xml:lang="en">Business postal address</resolver:DisplayName>
  <resolver:DisplayName xml:lang="de">Geschäftsadresse</resolver:DisplayName>
  <resolver:DisplayName xml:lang="fr">Adresse Professionnelle</resolver:DisplayName>
  <resolver:DisplayName xml:lang="it">Indirizzo professionale</resolver:DisplayName>
  <resolver:DisplayName xml:lang="ja">所属組織住所</resolver:DisplayName>
  <resolver:DisplayDescription xml:lang="en">Business postal address: Campus or office address</resolver:DisplayDescription>
  <resolver:DisplayDescription xml:lang="de">Adresse am Arbeitsplatz</resolver:DisplayDescription>
  <resolver:DisplayDescription xml:lang="fr">Adresse de l'institut, de l'universite</resolver:DisplayDescription>
  <resolver:DisplayDescription xml:lang="it">Indirizzo professionale: Indirizzo dell'istituto o dell'ufficio</resolver:DisplayDescription>
  <resolver:DisplayDescription xml:lang="ja">所属組織(大学、会社など)の住所</resolver:DisplayDescription>
  <resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                             name="urn:mace:dir:attribute-def:postalAddress" />
  <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                             name="urn:oid:2.5.4.16" friendlyName="postalAddress" />
</resolver:AttributeDefinition>
...

Note For the SWITCHaai attributes, there is a prepared doc/attribute-descriptions.xml for the languages: en, de, fr, it, ja.
For the GakuNin attributes, there is a prepared the same file for the languages: en, ja.

The viewer uses the language according to the users browsers request, if that language is not available, the default locale en will be taken.
It is possible to enforce a specific language. This can be defined optional in /opt/uApprove/conf/viewer.properties:

useLocale=en_US

Warning the description of the useLocale variable is commented in /opt/uApprove/conf/viewer.properties:

# If you want to enforce a given locale in the JSP 
# file, then you must specify it here. If you 
# do not specify, then the locale of the request
# (i.e. the browser) will be taken.
# Valid examples are CH_de, US_en, CH_fr, CH_it

However the above values cause an exception. use de_CH, en_US, and so on instead.

It is possible that a user can give global attribute release consent, which mean, that she/he is never be asked again by uApprove.jp. If it is required, that a user has to give consent to each different resource access, global consent has to be disabled in /opt/uApprove/conf/viewer.properties:

globalConsentPossible=true

The viewer web application uses LogBack (see references) like the Shibboleth IdP.
The logback configuration file is defined in /opt/uApprove/conf/viewer.properties:

loggingConfig=/opt/uApprove/conf/logging.xml

Adjust logging.xml for the log location, assure that the file is writable by Tomcat:

<configuration>
  ...
  <appender class="ch.qos.logback.core.FileAppender" name="RootFileAppender">
    <file>/opt/uApprove/logs/uApprove.log</file>
    ...
  </appender>
  ...
</configuration>

If you are using Apache HTTPd in front of your Tomcat setup, proxy the viewer web application in /etc/apache2/sites-enabled/idp.example.org:

<VirtualHost idp.example.org:443>
  ...
  <Location /uApprove>
    Allow from all
    ProxyPass ajp://localhost:8009/uApprove
  </Location>
  ...
</VirtualHost>

Restart Apache HTTPd:

/etc/init.d/apache2 restart

The optional reset-approvals can be operated in two ways:

In-flow mode: The In-flow operation means, that a user can reset his setting during the login process. As example this is done by a checkbox on the login form.
Standalone mode: The standalone operation can is as JSP which can be called directly.

In-flow mode

For enabling the In-Flow reset-approvals application, the Shibboleth UsernamePassword login form ${CATALINA_HOME}/webapps/idp/login.jsp can be adapted by adding a checkbox:

Warning Followed, the In-Flow reset-settings application configuration is for the shipped JAAS UsernamePassword login handler. If you are using another login handler (i.e. RemoteUser) you have to assure, that the GET parameter is transmitted to the IdP plugin.

...
<form ...>
  <table>
  ...
    <tr>
      <td colspan="2">
        <input type="checkbox" name="resetuserconsent" value="true" />
        Reset my attribute release approvals
      </td>
    </tr>
  </table>
</form>
...

Standalone mode

For the standalone mode, the JSP has to be protected either by container managed authentication or Shibboleth Service Provider, that the REMOTE_USER is provided.

The standalone JSP can be called like https://idp.example.org/uApprove/reset-approvals.jsp?standalone-next-url=http://go.here.org/after/reset. The parameter standalone-next-url has to be set.

1.5 Run

Restart Tomcat:

${CATALINA_HOME}/bin/shutdown.sh && sleep 10 && ${CATALINA_HOME}/bin/startup.sh

Note If the Tomcat manager (http://idp.example.org:8080/manager/html/) is installed, web applications can easily be restarted separate.

Note Check the logs, if the startup of the IdP and uApprove.jp web application was successful.
If it was successful, try to access any Service Provider using your Identity Provider.

1.6 Troubleshooting

1.6.1 Logging

Cause the IdP plugin runs within the Shibboleth IdP web application, it uses the IdP logger. The IdP logger is configured by /opt/shibboleth-idp/conf/logging.xml:

...
<logger name="ch.SWITCH.aai" level="DEBUG">
    <appender-ref ref="IDP_PROCESS"/>
</logger>
<logger name="jp.gakunin.shibboleth" level="DEBUG">
    <appender-ref ref="IDP_PROCESS"/>
</logger>
...

The logging of uApprove.jp viewer application is configured as described. Adjust the log level to DEBUG.

1.6.2 Tomcat, Jasper JSP compiling for 1.5 target

uApprove.jp is shipped for a JDK 1.5 target. However your Tomcat setup runs with a JDK ≥ 1.5, it could be that the Jasper engine compiles the JSP's on the fly for another target (e.g. 1.3). The following configuration in ${CATALINA_HOME}/conf/web.xml specifies for which target the JSP's has to be compiled:

<servlet>
  ...
  <init-param>
    <param-name>compilerSourceVM</param-name>
    <param-value>1.5</param-value>
  </init-param>
  <init-param>
    <param-name>compilerTargetVM</param-name>
    <param-value>1.5</param-value>
  </init-param>
  ...
</servlet>

1.7 References

2. Configuration of Shibboleth Service Provider

2.1 Metadata

An SP can define the attributes that the SP requires or desires using <RequestedAttribute> elements within <AttributeConsumingService> elements within <SPSSODescriptor> element. The <RequestedAttribute> element have the following attributes:

isRequired (optional): Boolean flag indicated that this attribute is required or desired by the SP,
Default value: false.

2.1.1 Description of attribute

Can be described the description of attribute by adding a following attribute to the <RequestedAttribute> element. The described description is displayed in Attribute Selection Page by the viewer application of uApprove.jp.

uajpmd:descrption (optional): The description of this attribute.

Using a <RequestedAttributeExtension> element can provide the description by multiple language. The descriptions defined by <RequestedAttributeExtension> element takes precedence over the descrived one by the uajpmd:description attribuite. The <RequestedAttributeExtension> element must be contained within the <Extensions> element that is a chiled of <SPSSODescriptor> element.

The <RequestedAttributeExtension> element must have the following attibutes:

FriendlyName: Specify the same value as the FriendlyName atttibute of the <RequestedAttribute> element to associate this element.

The description of attribute is described in the <Description> element. The <RequestedAttributeExtension> element can be contain one or more <Description> elements.

The <Description> element must have the following attibutes:

xml:lang: The language used in the description.

Example:

<md:EntitiesDescriptor Name="uapprovejp-dev-metadata.xml"
                    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
                    xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
                    xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
                    xmlns:uajpmd="http://www.gakunin.jp/ns/uapprove-jp/metadata"
                    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  ...
  <md:EntityDescriptor entityID="...">
    <md:SPSSODescriptor>
      ...

      <md:Extensions>
        ...
        <RequestedAttributeExtension
          xmlns="http://www.gakunin.jp/ns/uapprove-jp/metadata"
          FriendlyName="displayName">
          <Description xml:lang="en">Our SP uses the displayName attribute in order to display your name to our web page</Description>
          <Description xml:lang="ja">SPはウェブページに名前を表示するためにdisplayName属性を使用します</Description>
        </RequestedAttributeExtension>
        ...
      </md:Extensions>
      ...

      <md:AttributeConsumingService index="1">
      	<md:ServiceName xml:lang="en">Sample Service</md:ServiceName>
      	<md:ServiceDescription xml:lang="en">
      	    An example service that requires a human-readable identifier and optional name and e-mail address.
      	</md:ServiceDescription>

        <md:RequestedAttribute FriendlyName="eduPersonPrincipalName"
                           Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
                           NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                           isRequired="true"/>
        <md:RequestedAttribute FriendlyName="mail"
                           Name="urn:oid:0.9.2342.19200300.100.1.3"
                           NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                           uajpmd:description="Our SP uses the mail attribute in order to fill the registration form with your mail address."/>
        <md:RequestedAttribute FriendlyName="displayName"
                           Name="urn:oid:2.16.840.1.113730.3.1.241"
                           NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"/>
      </md:AttributeConsumingService>
      ...
  </md:SPSSODescriptor>

Installation and configuration of uApprove.jp

Table of contents

1. Installation and configuration of uApprove.jp for Shibboleth Identity Provider

1.1 Introduction

1.2 Prerequisites

1.3 Installation

1.3.1 IdP-Plugin

1.3.2 Viewer

1.4 Configuration

1.4.1 uApprove.jp common: Storage etc.

File based

Database

Other common configuration

1.4.2 IdP plugin configuration

Shibboleth IdP adjustments

SP blacklist

Attributes ordering and blacklisting

Other configuration

1.4.3 Viewer configuration

Localization

Global consent

Logging

Apache in front of Tomcat

1.4.4 Shibboleth IdP's profile handler

Define the Namespace

Modify Attribute Query Profile Handler

1.4.5 Shibboleth IdP's attribute filter