For a Shibboleth Identity Provider to join one of the Tuakiri Federations (Test/Dev or Pilot/Production), the following steps have to be done:
- Registering the IdP in the Federation Registry
- Configuring the IdP to load the federation metadata
- Configuring the IdP to release the attributes required by the federation.
There will be two federations available:
- Tuakiri Test/Development Environment (Operational and available now)
- Tuakiri Pilot Federation Service (Available from the 7th June11)
Metadata distribution point
Metadata signing certificate
Federation Registry URL
Discovery Service / WAYF URL
Registering an IdP into the Federation Registry
Go to the respecting Federation Registry URL and:
- Register an Organisation for your institution (if not already registered)
- Wait for the Organisation to be approved
- Register your IdP under that Organisation
- Provide the Contact Details for the IdP admin
- Select the organisation and provide a name and description for your IdP
- Enter the base URL for your IdP (
- Enter the PEM encoded certificate used by your IdP for signing Shibboleth assertions (the default is
- Select the attributes the IdP will be able to release to the federation
- Select supported NameID formats. By default,
urn:oasis:names:tc:SAML:2.0:nameid-format:transientis already selected. If supporting SAML1, select also
- Submit the details and wait for your IdP to be approved.
- After having your IdP registration approved, click on the link sent to you to become an Administrator of the IdP's registration.
- If supporting SAML1, define the SAML1 endpoints for your IdP.
Configuring your IdP to load the federation metadata:
The code snippets in this section have values for Tuakiri (Pilot) federation. Please update them accordingly as per the table above if configuring your IdP to join the Tuakiri TEST/DEV federation. (The key code snippets are for convenience given in Appendix A - Tuakiri-TEST Federation below.
NOTE: Check what your IdP home directory is: the directory is typically called
shibboleth-idp - and on Debian and Ubuntu systems, it's commonly
/usr/local/shibboleth-idp, while on RedHat and CentOS it's
/opt/shibboleth-idp. The snippets below are referring to the IdP home directory as
- Download the metadata signing certificate into
- Add the following snippet into the
- And add the following snippet into the
<security:TrustEngine id="shibboleth.MetadataTrustEngine" xsi:type="security:StaticExplicitKeySignature">element:
Remember to uncomment the
<security:TrustEngine id="shibboleth.MetadataTrustEngine" xsi:type="security:StaticExplicitKeySignature">element if it is still commented out (it is commented out in the default configuration).
- Add the following snippet into the
- Configure attribute release/filtering through the federation:
- Contact the federation administrators and request a URL for the Attribute Filter for your IdP. The attribute filter may have to be manually added to the list of attribute filters published. The URL would look like:
- Add the following entry into
$IDP_HOME/conf/service.xml(note that the URL varies for each IdP and has to be obtained from the federation administrators):
Note: if your
$IDP_HOMEis different from
/opt/shibboleth-idp, change the file path in the above snippet accordingly.
If configuring this in Shibboleth IdP 2.1.x, do not use the srv: namespace prefix - i.e., use just:
- We also strongly recommend you configure your IdP to periodically reload this file - we recommend at 2 hour interval. This is documented in detail in the IdP Install Manual: Reloading configuration section and Load AAF Atribute Filter sections. The simple step is to add the
configurationResourcePollingRetryAttempts="10"attributes to the
Now your IdP should be able to access service provides within the Tuakiri (Test/Dev) federation.
Appendix A - Tuakiri-TEST Federation
This section gives the variants of the commands to be used when configuring the IdP to join the Tuakiri-TEST Federation (instead of Tuakiri Pilot).
- To download the Tuakiri-TEST metadata signing certificate, run the following command:
- For loading the Tuakiri-TEST metadata, put the following into
- And the code to load the Tuakiri-TEST metadata signing certificate would be - also in
- The snippet to load attribute filter configuration would be (again, drop the srv namespace prefix with Shibboleth IdP 2.1.x):