ページ履歴

svn co https://forge.gakunin.nii.ac.jp/svn/tiqrshib/trunk tiqrshib

// for under php5.2
ini_set('session.cookie_httponly', 1);
setcookie($cookieName, $value, $timeout, $cookiepath, "", TRUE);
// for php5.2 over
//setcookie($cookieName, $value, $timeout, $cookiepath, "", TRUE, TRUE);

<input style="font:8pt" type=button value="Register" onclick="window.location.href='https://(FQDN of the IdP server)/TiqrShib/trans.php'">

mkdir /var/www/library
cp -rp tiqr-server-library-1.0.0/library/tiqr /var/www/library/libTiqr
cp -rp tiqr-server-zendframework-1.0.0/library/tiqr-zf /var/www/library/
cp -rp phpqrcode /var/www/library/
cp -rp ZendFramework-1.12.3-minimal /usr/share/
ln -s ZendFramework-1.12.3-minimal ZendFramework

ln -s /var/www/library/libTiqr    /var/tiqrzenddemo/library/tiqr
ln -s /var/www/library/phpqrcode  /var/tiqrzenddemo/library/phpqrcode
ln -s /var/www/library/tiqr-zf    /var/tiqrzenddemo/library/tiqr-zf
ln -s /usr/share/ZendFramework    /var/tiqrzenddemo/library/zend

include_path = ".:/usr/share/ZendFramework/library:/var/www/library/libTiqr"

/**
    * Sort the array by key
    *
    * @return array
    */
    public function ksort()
    {
        $items = $this->getArrayCopy();
        return ksort($items);
    }

# require_once "Tiqr/Server.php";
require_once "Tiqr/Service.php";

# case Tiqr_Server::AUTH_RESULT_AUTHENTICATED:
case Tiqr_Service::AUTH_RESULT_AUTHENTICATED:
# case Tiqr_Server::AUTH_RESULT_INVALID_CHALLENGE:
case Tiqr_Service::AUTH_RESULT_INVALID_CHALLENGE:
# case Tiqr_Server::AUTH_RESULT_INVALID_REQUEST:
case Tiqr_Service::AUTH_RESULT_INVALID_REQUEST:
# case Tiqr_Server::AUTH_RESULT_INVALID_RESPONSE:
case Tiqr_Service::AUTH_RESULT_INVALID_RESPONSE:
# case Tiqr_Server::AUTH_RESULT_INVALID_USERID:
case Tiqr_Service::AUTH_RESULT_INVALID_USERID:

(Add following statement under the "public static function randomBytes($length)", just before the "if" function.)
   $strong = false;
   $rnd = "";

resources.tiqr.identifier = "idp.gakunin.nii.ac.jp"
resources.tiqr.name = "gakunin-test-tiqr"
resources.tiqr.logoUrl  = "https://openidp.nii.ac.jp/images/gakunin-logo.png"
resources.tiqr.session.secret = "enter something truly random here, preferably generated using openssl"

# $this->view->enrollmentURL = $this->_getTiqr()->generateEnrollmentURL($metadataURL);
$this->view->enrollmentURL = $metadataURL;

//$secret = pack('H*', $this->_getUserSecret($userId));
$secret = $this->_getUserSecret($userId);

<Location /tiqr>
       RewriteEngine On
       RewriteBase /tiqr
       RewriteCond %{REQUEST_FILENAME} -s [OR]
       RewriteCond %{REQUEST_FILENAME} -l [OR]
       RewriteCond %{REQUEST_FILENAME} -d
       RewriteRule ^.*$ - [NC,L]
       RewriteRule ^.*$ /tiqr/index.php [NC,L]
</Location>

javac -classpath /usr/java/tomcat/lib/servlet-api.jar:/opt/shibboleth-idp/lib/shibboleth-common-1.3.2.jar:/opt/shibboleth-idp/lib/shibboleth-identityprovider-2.3.2.jar:/opt/shibboleth-idp/lib/shibboleth-jce-1.1.0.jar:/opt/shibboleth-idp/lib/slf4j-api-1.6.1.jar:/opt/shibboleth-idp/lib/openws-1.4.2.jar:/opt/shibboleth-idp/lib/xmltooling-1.3.2.jar tiqrshibAuthn.java

<!-- Servlet protected by container used for TiqrShib authentication -->
    <servlet>
        <servlet-name>TiqrShibAuthHandler</servlet-name>
        <servlet-class>tiqrshibAuthn</servlet-class>
            <init-param>
                 <param-name>authnMethod</param-name>
                 <param-value>urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract</param-value>
            </init-param>
        <load-on-startup>3</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>TiqrShibAuthHandler</servlet-name>
        <url-pattern>/Authn/TiqrShib</url-pattern>
    </servlet-mapping>

<ph:LoginHandler xsi:type="ph:ExternalAuthn"
                     externalAuthnPath="/Authn/TiqrShib" >

    <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract</ph:AuthenticationMethod>
</ph:LoginHandler>

<!-- Servlet for doing Username/Password authentication -->
    <servlet>
        <servlet-name>UsernamePasswordAuthHandler</servlet-name>
        <servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet</servlet-class>
            <init-param>
                 <param-name>authnMethod</param-name>
                 <param-value>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</param-value>
            </init-param>
        <load-on-startup>3</load-on-startup>
    </servlet>

<rp:DefaultRelyingParty provider="https://IDP SERVER/idp/shibboleth"
                         defaultSigningCredentialRef="IdPCredential"
                         defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">

<!-- Special SessionInitiator for Tiqr!!! -->
            <SessionInitiator type="SAML2" Location="/TiqrShib" id="siid1" entityID="https://IDP-SERVER-FQDN/idp/shibboleth" template="bindingTemplate.html" authnContextClassRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />

Alias /TiqrShib/ "/var/www/html/TiqrShib/"
<Location /TiqrShib>
  AuthType shibboleth
  ShibRequestSetting requireSessionWith siid1
  require valid-user
</Location>

<SessionInitiator type="Chaining" Location="/DS" isDefault="true" id="tiqrshiblogin" authnContextClassRef="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract">
               <SessionInitiator type="SAML2" template="bindingTemplate.html"/>
               <SessionInitiator type="Shib1"/>
               <SessionInitiator type="SAMLDS" URL="https://DS SERVER/ds/WAYF"/>
            </SessionInitiator>

resources.tiqr.identifier = "tiqr.nii.ac.jp"
↑replace as your server FQDN
resources.tiqr.name = "vm2"
↑server name of Tiqr (it will be appeared in the application)
resources.tiqr.logoUrl  = "https://tiqr.nii.ac.jp/icons/gakunin-logo.png"
↑logo file appeared in the application. 5KB is better. Over 100KB file takes long time to load it.
constants.TIQRSHIB_DOMAIN = "nii.ac.jp"
↑eppn security domain of the IdP

↓Following LDAP configuration is same with attribute-resolver.xml
constants.TIQRSHIB_LDAP_HOST = "localhost"
constants.TIQRSHIB_LDAP_PORT = "389"
constants.TIQRSHIB_LDAP_BASEDN = "o=test_o,dc=ac,c=JP"
constants.TIQRSHIB_LDAP_BINDREQUIRESDN = "true"
constants.TIQRSHIB_LDAP_USERNAME = "cn=Manager,o=test_o,dc=ac,c=JP"
constants.TIQRSHIB_LDAP_PASSWORD = "password"