Installing Shibbolized Tiqr

Following document instructs how to install shibbolized Tiqr Shibbolized Tiqr (or "tiqrshib") in the IdP environment. You don't have to hack the IdP itself. It works as an external login handler. Please feel free to contact us (tiqr at meatmail.jp) if you have any difficulty while installing this.

1. Installation of Shibboleth SP in IdP Server

SP function is required when Tiqr account will enroll in the IdP. This SP does not need to join to the federation but only need to communicate with the IdP. The IdP includes the SP's metadata in its relying-party.xml. Installed SP also includes the IdP's metadata solely. 

2. Deployment of TiqrShib

Checkout the source code from the repository then,

svn co https://forge.gakunin.nii.ac.jp/anonsvn/tiqrshib/trunk tiqrshib

• Copy tiqrzenddemo to /var/tiqrzenddemo 

• Copy var/www/html/TiqrShib to /var/www/html/TiqrShib (deploy trans.php)
  If you are using PHP version 5.1 or any prior version, please modify trans.php as follows.

  コード ブロック
  // for php5.1 and prior ini_set('session.cookie_httponly', 1); setcookie($cookieName, $value, $timeout, $cookiepath, "", TRUE); // for php5.2 and later //setcookie($cookieName, $value, $timeout, $cookiepath, "", TRUE, TRUE);

• Copy var/www/html/tiqrenroll/index.html to /var/www/html/tiqrenroll (deploy index.html)
  Modify the server FQDN in the above index.html (the following part)

  コード ブロック
  <input style="font:8pt" type=button value="Register" onclick="window.location.href='https://(FQDN of the IdP server)/TiqrShib/trans.php'">

• php-ldap is required

3. Deployment of Related Library

Download the following application and deploy

mkdir /var/www/library
cp -rp tiqr-server-library-1.0.0/library/tiqr /var/www/library/libTiqr
cp -rp tiqr-server-zendframework-1.0.0/library/tiqr-zf /var/www/library/
cp -rp phpqrcode /var/www/library/
cp -rp ZendFramework-1.12.3-minimal /usr/share/
ln -s ZendFramework-1.12.3-minimal ZendFramework

　　　Confirm the following links. If not provide soft links as follows.

ln -s /var/www/library/libTiqr    /var/tiqrzenddemo/library/tiqr
ln -s /var/www/library/phpqrcode  /var/tiqrzenddemo/library/phpqrcode
ln -s /var/www/library/tiqr-zf    /var/tiqrzenddemo/library/tiqr-zf
ln -s /usr/share/ZendFramework    /var/tiqrzenddemo/library/zend

   (*) If you don't like the link, you can copy the files in both directory. 
     　In that case, the libraries should be stored in /var/tiqrzenddemo/library/ . Following modification also required in /var/tiqrzenddemo/public/index.php

// Ensure library/ is on include_path
  set_include_path(implode(PATH_SEPARATOR, array(
    realpath(APPLICATION_PATH . '/../library/zend/library'),
    realpath(APPLICATION_PATH . '/../library/tiqr'),
    realpath(APPLICATION_PATH . '/../library/tiqr-zf'),
    realpath(APPLICATION_PATH . '/../library/libTiqrShib'),
    get_include_path(),
  )));

Configure Library Path

Include the following configuration in /etc/php.ini

include_path = ".:/usr/share/ZendFramework/library:/var/www/library/libTiqr"

4. Modification of Library

Modification of ZendFramework

Following function have to be added in /usr/share/ZendFramework/library/Zend/View/Helper/Placeholder/Container/Abstract.php

/**
    * Sort the array by key
    *
    * @return array
    */
    public function ksort()
    {
        $items = $this->getArrayCopy();
        return ksort($items);
    }

Modification of Tiqr,Tiqr-zf

Modification in /var/www/library/tiqr-zf/Tiqr/Resource/Tiqr.php

# require_once "Tiqr/Server.php";
require_once "Tiqr/Service.php";

Modification in /var/www/library/tiqr-zf/Tiqr/Controller/Login/Abstract.php

# case Tiqr_Server::AUTH_RESULT_AUTHENTICATED:
case Tiqr_Service::AUTH_RESULT_AUTHENTICATED:
# case Tiqr_Server::AUTH_RESULT_INVALID_CHALLENGE:
case Tiqr_Service::AUTH_RESULT_INVALID_CHALLENGE:
# case Tiqr_Server::AUTH_RESULT_INVALID_REQUEST:
case Tiqr_Service::AUTH_RESULT_INVALID_REQUEST:
# case Tiqr_Server::AUTH_RESULT_INVALID_RESPONSE:
case Tiqr_Service::AUTH_RESULT_INVALID_RESPONSE:
# case Tiqr_Server::AUTH_RESULT_INVALID_USERID:
case Tiqr_Service::AUTH_RESULT_INVALID_USERID:

Addition in /var/www/library/libTiqr/Tiqr/Random.php

(Add following statement under the "public static function randomBytes($length)", just before the "if" function.)
   $strong = false;
   $rnd = "";

Modification in /var/tiqrzenddemo/application/configs/application.ini (modify these parameters depending on your environments)

resources.tiqr.identifier = "idp.gakunin.nii.ac.jp"
resources.tiqr.name = "gakunin-test-tiqr"
resources.tiqr.logoUrl  = "https://openidp.nii.ac.jp/images/gakunin-logo.png"
resources.tiqr.session.secret = "enter something truly random here, preferably generated using openssl"

Modification in /var/tiqrzenddemo/library/tiqr-zf/Tiqr/Controller/Enroll/Abstract.php

# $this->view->enrollmentURL = $this->_getTiqr()->generateEnrollmentURL($metadataURL);
$this->view->enrollmentURL = $metadataURL;

Modification in /var/tiqrzenddemo/library/tiqr-zf/Tiqr/Controller/Login/Abstract.php

//$secret = pack('H*', $this->_getUserSecret($userId));
$secret = $this->_getUserSecret($userId);

5. Configuration of Apache

httpd.conf (Add)

Alias /tiqr/ "/var/tiqrzenddemo/public/"
Alias /tiqrenroll/ "/var/www/html/tiqrenroll/"

ssl.conf (Add)

<Location /tiqr>
       RewriteEngine On
       RewriteBase /tiqr
       RewriteCond %{REQUEST_FILENAME} -s [OR]
       RewriteCond %{REQUEST_FILENAME} -l [OR]
       RewriteCond %{REQUEST_FILENAME} -d
       RewriteRule ^.*$ - [NC,L]
       RewriteRule ^.*$ /tiqr/index.php [NC,L]
</Location>

6. Configuration of TiqrShib Handler in Shibboleth

Generate tiqrshibAuthn.class by compiling the tiqrshibAuthn.java
Copy the class file into /usr/java/tomcat/webapps/idp/WEB-INF/classes/
Following is an example of compiling option.

javac -classpath /usr/java/tomcat/lib/servlet-api.jar:/opt/shibboleth-idp/lib/shibboleth-common-1.3.2.jar:/opt/shibboleth-idp/lib/shibboleth-identityprovider-2.3.2.jar:/opt/shibboleth-idp/lib/shibboleth-jce-1.1.0.jar:/opt/shibboleth-idp/lib/slf4j-api-1.6.1.jar:/opt/shibboleth-idp/lib/openws-1.4.2.jar:/opt/shibboleth-idp/lib/xmltooling-1.3.2.jar tiqrshibAuthn.java

Configuration of web.xml and handler.xml
(*) In the handler.xml configuration, UserPassword handler should remain. That is, UserPassword handler should not be commented out and following TiqrShib handler should be added as a new handler. 

Modification in /usr/java/tomcat/webapps/idp/WEB-INF/web.xml

<!-- Servlet protected by container used for TiqrShib authentication -->
    <servlet>
        <servlet-name>TiqrShibAuthHandler</servlet-name>
        <servlet-class>tiqrshibAuthn</servlet-class>
            <init-param>
                 <param-name>authnMethod</param-name>
                 <param-value>urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered</param-value>
            </init-param>
        <load-on-startup>3</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>TiqrShibAuthHandler</servlet-name>
        <url-pattern>/Authn/TiqrShib</url-pattern>
    </servlet-mapping>

Modification in handler.xml of shibboleth IdP

<ph:LoginHandler xsi:type="ph:ExternalAuthn"
                     externalAuthnPath="/Authn/TiqrShib" >

    <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered</ph:AuthenticationMethod>
</ph:LoginHandler>

Configuration of Shibboleth

(1) Configuration of IdP

Make Username/PasswordHandler as default handler
Addition in /usr/java/tomcat/webapps/idp/WEB-INF/web.xml

<!-- Servlet for doing Username/Password authentication -->
    <servlet>
        <servlet-name>UsernamePasswordAuthHandler</servlet-name>
        <servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet</servlet-class>
            <init-param>
                 <param-name>authnMethod</param-name>
                 <param-value>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</param-value>
            </init-param>
        <load-on-startup>3</load-on-startup>
    </servlet>

Configuration in relying-party.xml

<rp:DefaultRelyingParty provider="https://IDP SERVER/idp/shibboleth"
                         defaultSigningCredentialRef="IdPCredential"
                         defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">

(2) Configuration of SP in IdP server

Add SessionInitiator in shibboleth2.xml

<!-- Special SessionInitiator for Tiqr!!! -->
            <SessionInitiator type="SAML2" Location="/TiqrShib" id="siid1" entityID="https://IDP-SERVER-FQDN/idp/shibboleth" template="bindingTemplate.html" authnContextClassRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />

Addition in /etc/httpd/conf.d/shib.conf

Alias /TiqrShib/ "/var/www/html/TiqrShib/"
<Location /TiqrShib>
  AuthType shibboleth
  ShibRequestSetting requireSessionWith siid1
  require valid-user
</Location>

(3) Configuration of SP (Application SP which requests Tiqr authentication)

Add ="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered" in SessionInitiator

About Enviroment

Shibbolized Tiqr is tested under the following environment.

• CentOS 7.3
• httpd 2.4
• PHP 5.4
• Oracle JDK 1.8
• Apache Maven 3.2
• Tomcat 8.0
• Shibboleth IdP 3.3.1
• Shibboleth SP 2.6

This document assumes Shibboleth IdP and SP are configured and ready for SAML SSO; IdP should be able to authenticate users per SP's authn request, and supply users' attributes back to SP appropriately. Some attributes must be supplied to SP because Shibbolized Tiqr implicitly requires them:

• ePPN (eduPersonPrincipalName)
• displayName

This document assumes they are installed based on the following document provided by GakuNin. If you installed them in a different way, consider modifying some of our procedures.

https://meatwiki.nii.ac.jp/confluence/pages/viewpage.action?pageId=20021624

Installation

Install dependent packages

To install depending packages, run the following command:

$ sudo yum -y install httpd php mod_ssl php-gd php-pdo php-mcrypt sqlite

Here, sqlite is installed as our sample configuration requires it. If you want to use MySQL for the backend DB, consider installing "mysql-connector-odbc" and "php-mysql" instead.

Deploy "tiqrzend" server

Checkout source code

Checkout the source code from the repository.

$ svn co https://forge.gakunin.nii.ac.jp/anonsvn/tiqrshib/trunk tiqrshib

It should contain two projects, "tiqrzend" and the IdP extension. Here we setup "tiqrzend" first.

• Extract all the content in "tiqrzend" package under /opt/tiqrzend/.
• Download phpqrcode 1.1.4 and unarchive under /opt/tiqrzend/library/phpqrcode/: http://phpqrcode.sourceforge.net/
• Make /opt/tiqrzend/application/logs writable from your httpd.

After the procedure above, you can check the result with tree command:

$ tree --charset=ascii -L 2 /opt/tiqrzend/
/opt/tiqrzend/
|-- application
|   |-- Bootstrap.php
|   |-- configs
|   |-- controllers
|   |-- layouts
|   |-- modules
|   `-- views
|-- library
|   |-- phpqrcode
|   |-- tiqr
|   |-- tiqrshib
|   |-- tiqr-zf
|   |-- zend -> ZendFramework-1.12.9-minimal
|   `-- ZendFramework-1.12.9-minimal
|-- public
|   |-- images
|   |-- index.php
|   `-- scripts
|-- resources
|   `-- Sample.php
`-- tests
    |-- application
    |-- library
    `-- phpunit.xml
20 directories, 4 files

Configure tiqrzend

Copy /opt/tiqrzend/application/configs/application.example.ini to /opt/tiqrzend/application/configs/application.ini.

$ cp /opt/tiqrzend/application/configs/application.example.ini /opt/tiqrzend/application/configs/application.ini

The sample configuration file should contain detailed instructions for each setting. It is recommended to read it through and modify the setting as your organization requires.

At the very least, you probably need to configure two settings show below:

• resources.tiqrshib.eppnScope must be exactly same as idp.scope setting in Shibboleth IdP's idp.properties (/opt/shibboleth-idp/conf/idp.properties)
• resources.tiqr.identifier should contain your organization identifier

Prepare DB for tiqrshib's "SecretStorage". For evaluation purpose, run the following commands:

$ mkdir -p /opt/tiqrzend/db/
$ sqlite3 /opt/tiqrzend/db/secrets.db
sqlite> CREATE TABLE IF NOT EXISTS tiqrshibsecrets (
...> `id` integer NOT NULL PRIMARY KEY AUTOINCREMENT,
...> `uid` text NOT NULL UNIQUE,
...> `secret` text DEFAULT NULL,
...> `isActive` integer DEFAULT NULL);
sqlite> (exit)
$ sudo chown -R apache: /opt/tiqrzend/db

Configure httpd

Modify /etc/httpd/conf.d/ssl.conf (or whatever httpd config file you prefer) so httpd contain the following settings:

Alias /tiqr/ "/opt/tiqrzend/public/"
<Location /tiqr>
  RewriteEngine On
  RewriteBase /tiqr
  RewriteCond %{REQUEST_FILENAME} -s [OR]
  RewriteCond %{REQUEST_FILENAME} -l [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^.*$ - [NC,L]
  RewriteRule ^.*$ /tiqr/index.php [NC,L]
  require all granted
</Location>
<Location /tiqr/shib/enroll/process>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  require valid-user
</Location>

Confirm tiqrzend works

With the modifications above, tiqr authentication flow should be ready for evaluation.

Now try the following "enrollment" and "login" flow.

• Enrollment flow
  • Visit https://(your host name)/tiqr/shib/enroll
  • Check if a QR code is shown to the screen
  • Scan the QR code using Tiqr mobile application, and enter a 4-digit PIN code
  • You should be able to register the service via the mobile app.
• Login flow
  • After the enrollment, visit https://(your host name)/tiqr/shib/login
  • You will see another QR code
  • Scan the QR code with the Tiqr mobile app
  • You are asked to enter the 4-digit PIN code that you entered in the enrollment flow
  • If you enter the correct PIN, Tiqr mobile app ask you if you are ok with the login.
  • After you approve the login, the message "Login is successful" will be shown to the mobile app.
  • You will see HTTP 404 or similar error messages that happens because IdP is not ready yet.
    • At this step you can at least check enrollment and login in tiqr side is successful.

Note that web interface will show some error message at the last step. At this point it is expected. The tiqrzend's login interface is intended for IdP integration, and without IdP, it cannot correctly redirect back to the IdP.

What you should check here is if the redirect happens at this point. If the redirect does not happen and some other problem happens, you will need to trouble-shoot it here.

Checking tiqrzend log

There are multiple logs to be checked when there are some errors.

• httpd's logs in /var/log/httpd
• PHP's logs in syslog or whatever you configured at /etc/php.ini
• tiqrzend's login /opt/tiqrzend/application/logs/

Deploy Shibboleth IdP extension

Build the extension

Building the IdP extension requires Apache Maven. You can build the extension outside where IdP resides, but you need the same Java environment to build the extenion there.

Here is how to install Apache Maven 3.5.0 in /opt/ directory.

$ export MVN_VERSION=3.5.0
$ wget http://ftp.riken.jp/net/apache/maven/maven-3/${MVN_VERSION}/binaries/apache-maven-${MVN_VERSION}-bin.tar.gz
$ tar xf apache-maven-${MVN_VERSION}-bin.tar.gz -C /opt/
$ export PATH=/opt/apache-maven-${MVN_VERSION}/bin:$PATH
$ mvn --version
(Check Maven is installed)

Under the "idp/" directory in this project, run the following commands:

$ ls
pom.xml  src
$ mvn -DskipTests=false clean package
... (a lot of logs) ...
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.683 s
[INFO] Finished at: 2017-09-05T16:41:39+09:00
[INFO] Final Memory: 24M/361M
[INFO] ------------------------------------------------------------------------
$ ls
pom.xml  src  target
$ ls target/
classes  maven-archiver  tiqrshibauthn-2.0.jar

Here, tiqrshibauthn-2.0.jar in target/ is what we want.

If you are outside the host where IdP resides, copy the jar file to the server.

Install the extension into the IdP

From this step, we assume you logged in the host where IdP resides as root. You should also prepare IdP's installation package unpacked somewhere.

# pwd
/root/shibboleth-identity-provider-3.3.1

Before going forward, we recommend to stop Tomcat.

# systemctl stop tomcat

Place tiqrshibauthn-2.0.jar in IdP installer's webapp/WEB-INF/lib/ directory.

<servlet>
    <servlet-name>TiqrShibAuthnHandler</servlet-name>
    <servlet-class>jp.gakunin.tiqrshib.TiqrShibAuthnServlet</servlet-class>
    <load-on-startup>4</load-on-startup>
</servlet>
<servlet-mapping>
    <servlet-name>TiqrShibAuthnHandler</servlet-name>
    <url-pattern>/Authn/TiqrShib</url-pattern>
</servlet-mapping>

Install the modified IdP using bin/install.sh as usual IdP installation.

# bin/install.sh

Depending on your Tomcat configuration, you may need to copy `idp.war` in `/usr/java/tomcat/webapps/` and remove `idp/` directory there.

# cp -f /opt/shibboleth-idp/war/idp.war /usr/java/tomcat/webapps/
# rm -rf /usr/java/tomcat/webapps/idp

If you choose to run Tomcat under the user "tomcat", you may also need to review directory permissions in /opt/shibboleth-idp/ again.

# chown -R tomcat:tomcat /opt/shibboleth-idp/logs
# chgrp -R tomcat /opt/shibboleth-idp/conf
# chmod -R g+r /opt/shibboleth-idp/conf
# find /opt/shibboleth-idp/conf -type d -exec chmod -R g+s {} \;
# chgrp tomcat /opt/shibboleth-idp/metadata
# chmod g+w /opt/shibboleth-idp/metadata
# chmod +t /opt/shibboleth-idp/metadata

Configure IdP

Move to `/opt/shibboleth-idp/` and modify relevant configuration files.

# cd /opt/shibboleth-idp

Create `flows/authn/tiqrshib/` directory and copy some relevante XML files. Then edit copied files so they become ready for tiqrshib authentication.

You can use the following sequence of sed commands if original XML are untouched:

# mkdir flows/authn/tiqrshib/
# cp system/flows/authn/external-authn-flow.xml flows/authn/tiqrshib/tiqrshib-flow.xml
# sed -i 's/external-authn-beans\.xml/tiqrshib-beans.xml/' flows/authn/tiqrshib/tiqrshib-flow.xml
# cp system/flows/authn/external-authn-beans.xml flows/authn/tiqrshib/tiqrshib-beans.xml
# sed -i 's/external-authn-config\.xml/tiqrshib-authn-config.xml/' flows/authn/tiqrshib/tiqrshib-beans.xml
# cp dist/conf/authn/external-authn-config.xml.dist conf/authn/tiqrshib-authn-config.xml 
# sed -i 's/Authn\/External/Authn\/TiqrShib/' conf/authn/tiqrshib-authn-config.xml

Add the following XML content in `conf/authn/general-authn.xml`.

<bean id="authn/tiqrshib" parent="shibboleth.AuthenticationFlow"
    p:nonBrowserSupported="false">
    <property name="supportedPrincipals">
        <list>

<SessionInitiator type="Chaining" Location="/DS" isDefault="true" id="tiqrshiblogin" authnContextClassRef="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered">
               <SessionInitiator type="SAML2" template="bindingTemplate.html"/>
               <SessionInitiator<bean typeparent="Shib1shibboleth.SAML2AuthnContextClassRef"/>
               <SessionInitiator type="SAMLDS" URL="https://DS SERVER/ds/WAYF"/ c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered" />
        </list>
      </SessionInitiator>

7. Initial Setting of TiqrShib

Initial Setting of Tiqr

Modification in /var/tiqrzenddemo/application/config/application.ini

resources.tiqr.identifier = "tiqr.nii.ac.jp"
↑replace as your server FQDN
resources.tiqr.name = "vm2"
↑server name of Tiqr (it will be appeared in the application)
resources.tiqr.logoUrl  = "https://tiqr.nii.ac.jp/icons/gakunin-logo.png"
↑logo file appeared in the application. 5KB is better. Over 100KB file takes long time to load it.
constants.TIQRSHIB_DOMAIN = "nii.ac.jp"
↑eppn security domain of the IdP

↓Following LDAP configuration is same with attribute-resolver.xml
constants.TIQRSHIB_LDAP_HOST = "localhost"
constants.TIQRSHIB_LDAP_PORT = "389"
constants.TIQRSHIB_LDAP_BASEDN = "o=test_o,dc=ac,c=JP"
constants.TIQRSHIB_LDAP_BINDREQUIRESDN = "true"
constants.TIQRSHIB_LDAP_USERNAME = "cn=Manager,o=test_o,dc=ac,c=JP"
constants.TIQRSHIB_LDAP_PASSWORD = "password"

(*) "uid” filter is utilized for LDAP search

If you would like to use the different filter, please modify the following 'uid"s to your preference.

In /var/tiqrzenddemo/library/libTiqrShib/tiqrShibLdap.php
In the line of $result = $ldap->search('(uid='.$userId.')');
there are two parts to be modified. 

...

</property>
</bean>

You probably want to modify `classRef` settings, depending on what authnContext you want to use for the tiqrshib authn.

Modify `conf/idp.properties` so `idp.authn.flows` contain "tiqrshib"

idp.authn.flows=Password|tiqrshib

Finally, start Tomcat.

# systemctl start tomcat

Make Shibboleth SP Rely on Shibbolized Tiqr

Modify SP so that it requests the authnContext you specified in general-authn.xml on certain path.

Here's an example of httpd configuration on a Shibboleth SP server, assuming it is already under a same federation with the IdP.

<Location /shibtiqr_protected>
    AuthType shibboleth
    ShibRequestSetting requireSession 1
    ShibRequestSetting authnContextClassRef urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered
    Require valid-user
</Location>

Further Configuration

Now that you confirmed Shibbolized Tiqr works on your server, we recommend reviewing your tiqrshib settings. Check your application.ini and review your settings. If you copied it from application.example.ini, you will see prenty of comments that describe each configuration and some recommendations.

In this section, we'll describe some of most important aspects of possible configurations.

Encryption Key and IV

Change secrets shared between tiqrzend and the IdP extention.

• On tiqrzend side, modify resources.tiqrshib.encryption.key and resources.tiqrshib.encryption.iv.
• On the extension side, modify AES_KEY and AES_IV in TiqrShibConstants.java in the IdP extension.

Note that the modification requires recreating jar file and IdP re-installation.

Metadata for Tiqr Server

Tiqr mobile application will show users basic information about the Tiqr server. The information is provided from Tiqr server on enrollment process. You probably want to change it before production use.

Check the following three settings.

• resources.tiqr.identifier
• resources.tiqr.name
• resources.tiqr.logoUrl

Consult to the officitial document (https://tiqr.org/tiqr-simplesaml-integration-guide) for more information.

Storage Setting

When SQLite3 is used, all the secret for users will be stored in local storange.

You may want some redundancy or possibly more performance, in which case consider using MySQL instead of SQLite3. There are descriptions in the example config how to achieve it.