Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
titleshibboleth IdP, relying-party.xml
.
.
<!-- Haka MetadataProvider -->
<metadata:MetadataProvider id="HAKAMD" xsi:type="FileBackedHTTPMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"  maxRefreshDelay="PT2H"
    metadataURL="https://haka.funet.fi/metadata/haka-metadata.xml"
    backingFile="/path/to/backup/location/haka-metadata.xml">
    <metadata:MetadataFilter xsi:type="SignatureValidation" trustEngineRef="Haka-trustEngine" />
</metadata:MetadataProvider>

<!-- eduGAIN MetadataProvider -->
<metadata:MetadataProvider id="EDUGAINMD" xsi:type="FileBackedHTTPMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"  maxRefreshDelay="PT2H"
    metadataURL="https://haka.funet.fi/edugain-nightly/gen-edugain/idp-XX-metadata-eduGain.xml"
    backingFile="/path/to/backup/location/idp-XX-metadata-eduGain.xml" requireValidMetadata="false">
    <metadata:MetadataFilter xsi:type="SignatureValidation" trustEngineRef="eduGAIN-trustEngine" />
</metadata:MetadataProvider>
.
.
<!-- Haka TrustEngine -->
<security:TrustEngine id="Haka-trustEngine" xsi:type="security:StaticExplicitKeySignature">
    <security:Credential id="Haka_MD_signing" xsi:type="security:X509Filesystem">
        <security:Certificate>/path/to/cert/haka-sign-v2.pem</security:Certificate>
    </security:Credential>
</security:TrustEngine>

<!-- eduGAIN TrustEngine -->
<security:TrustEngine id="eduGAIN-trustEngine" xsi:type="security:StaticExplicitKeySignature">
    <security:Credential id="eduGAIN_MD_signing" xsi:type="security:X509Filesystem">
        <security:Certificate>/path/to/cert/haka-edugain-sign.csc.fi.pem</security:Certificate>
    </security:Credential>
</security:TrustEngine>
.
.

 


Esimerkki näyttää suuntaa kuinka ottaa käyttöön Resurssirekisterin luoman IdP-kohtaisen attribute-filter.xml -tiedoston Haka-filterin rinnalle:

...

Haka IdP -palvelimen oikeanlaista konfiguraatiota ja attribuuttien luovutuksen onnistumista voi testata vaikkapa Sveitsin SWITCHaai-luottamusverkoston testipalvelinta vasten. Testipalvelin on sitoutunut GÉANT-tietosuojakäytäntöön.