forked from lordal/idp-installer-SWAMID
-
Notifications
You must be signed in to change notification settings - Fork 0
/
README
135 lines (90 loc) · 4.84 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
Introduction to the Federated Identity Appliance Deployer Tool
-------------------------------------------------------------------------------
This tool is a set of scripts that automates the deployment and configuration
of software used to participate with your SAML2 or eduroam identity federation
services.
Configured deployment profiles listed alphabetically are:
CAF - Canadian Access Federation ( http://www.canarie.ca/en/caf-service/about )
SWAMID - Swedish Academic Identity ( http://www.swamid.se/ )
Each federation may have a different deployment profile and supported
configurations. What follows are the generic steps to follow to do an installation.
Please consult ~/docs/README.<federation_name> for federation
specific deployment instructions.
Supported Platforms
-------------------------------------------------------------------------------
This installer script is intended to be used on a clean install of:
- Ubuntu Server 14.04 (SWAMID, CAF)
- CentOS 7 'minimal' (SWAMID, CAF)
- RedHat EL7.2 'minimal' (CAF only)
It *MAY* run on pre-existing installations of these OS', but steps in the installer
presume the installed services are 'alone' on the machine and may modify your
existing host settings.
Configuration
-------------------------------------------------------------------------------
This script requires a configuration file to run.
The configuration file is generated using a local HTML based configuration builder
to construct it. This technique purposely avoids storing sensitive data
anywhere other than where you create the configuration and where you place the config file.
The configuration builder pages are federation specific.
To Launch them, download this distribution, unzip it locally and use Chrome of Firefox to
open the respective configuration page:
for CAF - ~/www/appconfig/CAF/index.html
for SWAMID - ~/www/appconfig/SWAMID/index.html
The configuration builder uses javascript to perform basic validation and
has the ability to import existing configuration files avoiding retyping
information.
For best configuration builder experience, we strongly recommend using Firefox
or Google Chrome. Using IE for the configuration builder is discouraged and not supported.
General Installation Steps
-------------------------------------------------------------------------------
These steps expect that the implementer will perform backups or snapshots as necessary.
1. Review your federation specific post install steps
2. Determine your deployment style (dev? production?)
3. Create a configuration from your federations' configuration builder
4. save configuration as 'config' in this directory on your server
5. run the script ./deploy_idp.sh
6. answer any inline questions (self signed cert? password creation for keystores?)
7. perform any post installation steps per ~/docs/README.<federation_name>
Default behaviour of this tool
-------------------------------------------------------------------------------
The default behaviour of this tool is to deploy a test instance for any service.
This configuration can also be used as the base for the production deployment
with post installation steps per your respective federation.
Per service defaults:
eduroam (RADIUS):
- uses MS-CHAPv2 to authenticate any user present
- uses self signed CA and server certificate
Shibboleth (SAML2):
- uses self signed server certificate
- blank passwords autogenerate for SSL keystores
- optional anonymized usage reporting in FTICKS formats
Please see: ~/docs/README.<federation_name> for federation specific usage
Profile of installed software
-------------------------------------------------------------------------------
SAML2 Uses:
jetty-9.2.14
shibboleth-identityprovider-3.2.1
cas-client-3.3.3-release
mysql-connector-java-5.1.35 (for EPTID)
mysql DB 5.6 Community Release
eduroam uses:
freeRADIUS-3.0.1
samba-4.1.1 (to connect to AD for MS-CHAPv2)
A detailed view of the versions and various components: http://bit.ly/idpInstaller3-SoftwareProfile
Disclamer
-------------------------------------------------------------------------------
This software is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
It is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this software. If not, see <http://www.gnu.org/licenses/>.
Contributors
-------------------------------------------------------------------------------
Anders Lördal, SWAMID
Chris Phillips, CANARIE
Cybera.ca