Configure CSM with Shibboleth

Shibboleth is a Java-based open-source SAML federation service normally installed on Linux systems, although it can also be installed on Windows. CSM provides integration with third-party identify providers, not support. For more information about the Shibboleth setup, work with a Shibboleth Administrator. Shibboleth can be configured to use different identity data stores. These instructions are for using LDAP to connect to Active Directory as the data store.

Shibboleth Diagnostics: Logs for Shibboleth are located in the Shib2IdP\logs folder in the Shibboleth installation folder, also check Tomcat logs.

To configure CSM with Shibboleth:

  1. Configure CSM as a SAML Service Provider (export the data to a service provider metadata file).
  2. Add the CSM Service Provider to Shibboleth as a relying party. For more information, see the detailed section below.
  3. Configure Shibboleth as a SAML Identity Provider (import the Shibboleth Identity Provider metadata file into CSM):
    1. Open the SAML Settings Identity Provider page (CSM Administrator>Security>Edit SAML settings>Identity Provider).
    2. Click the Import Metadata button.

      The Select Metadata File Location window opens.

    3. Import the Shibboleth Identity Provider metadata file (ex: Idp-metadata.xml in the metadata folder; the name used in the installation might be different). Typically, in C:\Program Files (x86)\Internet2\Shib2Idp/metadata).

Add CSM Service Provider to Shibboleth as a Relying Party

  1. Copy the CSM Service Provider metadata file exported (when CSM was configured as a service provider) to the Shibboleth metadata folder (typically, C:\Program Files (x86)\Internet2\Shib2Idp/metadata).
  2. Edit the configuration file Relying-party.xml located in the Shibboleth configuration folder (C:\Program Files (x86)\Internet2\Shib2Idp\conf\relying-party.xml). In the Metadata Configuration section, add an entry for CSM as shown below (replacing "sp-cherwell-metadata.xml" with the name of the metadata file).

    Shibboleth Code 2b

  3. To setup Shibboleth to use LDAP for authentication, edit the file login.config and create a configuration for LDAP based on the requirements (refer to the Shibboleth documentation for details – one possible example is shown below).

    Shibboleth Code 2b

    Note: When using LDAP, Users should never include the domain name with their user name (in the form domain\user) when entering User information in the Shibboleth login prompt because the domain information is already specified in the LDAP configuration.
  4. To specify what should be returned for the SAML Name ID, edit the file Attribute-filter.xml:
    • To return e-mail address, add the following attribute rule:

      Shibboleth Code d1

    • To return Windows login, add the following attribute rule:

      Shibboleth Code d2

      Note: If it has been configured to return Windows login, Shibboleth only returns the User’s login name and does not include the domain name. For example, instead of returning adomin\auser, Shibboleth returns only auser.
  5. Edit the file Attribute-resolver.xml:
    • If configuring to use e-mail address as the Name ID, in the Attribute Definitions sections, under Name Identifier related attributes, add the following entry:

      Shibboleth Code e1

    • If configuring to use Windows login as the Name ID, in the Attribute Definitions sections, under Name Identifier related attributes, add the following entry:

      Shibboleth Code e2

  6. Edit the Shibboleth Identity Provider metadata file (ex: Idp-metadata.xml in the metadata folder; the name used in your installation might be different):
    1. Find the existing <NameIDFormat> elements in the <IDPSSODescriptor> element and add the one of the following entries:
      • If using e-mail address as the Name ID:

        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

      • If using Windows login as the Name ID:

        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos </NameIDFormat>

    2. Also, provide the above entry in the "<AttributeAuthorityDescriptor> " element.

      Tip: Copy this metadata file and use it to import the identity provider information into the CSM identity provider configuration.

  7. Restart Shibboleth through the Tomcat Manager web page (for a typical installation, browse to the URL localhost:8080, and then select Tomcat Manager. Provide the manager login ID and password, and then find the Shibboleth Identity Provider application and click Stop, and then Start.
© Copyright 2018 Cherwell Software, LLC. All rights reserved.