# System-wide Java configuration file -*- sh -*- |
<VirtualHost 123.123.123.123:443> |
<!-- Added for Shibboleth Identity Provider 2.0 --> |
<Host name="idp2.example.com" debug="0" appBase="webapps/idp2" |
<MetadataProvider id="DFNprod" xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata" |
<LoginHandler xsi:type="UsernamePassword" |
| edu.vt.middleware.ldap.jaas.LdapLoginModule required host="ldap.example.com" port="636" ssl="true" serviceUser="cn=ReadProxyShibboleth,ou=services,dc=example,dc=com" serviceCredential="ProxyUserPassword" base="ou=users,dc=example,dc=com" userField="uid,mail"; |
<logger name="edu.vt.middleware.ldap"> |
<resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc" |
<resolver:AttributeDefinition id="eduPersonEntitlement" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" |
<resolver:AttributeDefinition id="Vorname_Nachname" xsi:type="Template" xmlns="urn:mace:shibboleth:2.0:resolver:ad"> </resolver:AttributeDefinition> </resolver:AttributeDefinition> |
<resolver:DataConnector xsi:type="ComputedId" xmlns="urn:mace:shibboleth:2.0:resolver:dc" </resolver:DataConnector> |
<AttributeFilterPolicy id="DefaultPolicy"> |
| <Host
...> <Realm className="org.apache.catalina.realm.JNDIRealm" debug="99" alternateURL="ldaps://ldap.example.com" connectionName="cn=proxyuser,ou=services,dc=example,dc=com" connectionPassword="proxyuserpassword" userBase="ou=users,dc=example,dc=com" userSearch="(|(uid={0})(mail={0}))" userSubtree="true" userRoleName="objectclass" /> </Host> <Connector port="8080" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" redirectPort="8443" acceptCount="100" debug="0" connectionTimeout="20000" disableUploadTimeout="true" tomcatAuthentication="false" /> <Connector port="8009" enableLookups="false" redirectPort="8443" debug="0" protocol="AJP/1.3" tomcatAuthentication="false" /> |
| <!--
Servlet for doing Username/Password authentication --> <!-- <servlet> <servlet-name>UsernamePasswordAuthHandler</servlet-name> <servlet-class> edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet </servlet-class> </servlet> <servlet-mapping> <servlet-name>UsernamePasswordAuthHandler</servlet-name> <url-pattern>/Authn/UserPassword</url-pattern> </servlet-mapping> <error-page> <error-code>500</error-code> <location>/error.jsp</location> </error-page> <error-page> <error-code>404</error-code> <location>/error-404.jsp</location> </error-page> --> |
| <security-constraint> <display-name>Shibboleth IdP</display-name> <web-resource-collection> <web-resource-name>user authentication</web-resource-name> <url-pattern>/Authn/RemoteUser</url-pattern> <http-method>GET</http-method> <http-method>POST</http-method> </web-resource-collection> <auth-constraint> <role-name>*</role-name> </auth-constraint> <user-data-constraint> <transport-guarantee>CONFIDENTIAL</transport-guarantee> </user-data-constraint> </security-constraint> <login-config> <auth-method>FORM</auth-method> <realm-name>IDPAuth</realm-name> <form-login-config> <form-login-page>/login.jsp</form-login-page> <form-error-page>/login.jsp</form-error-page> </form-login-config> </login-config> |
| CREATE
DATABASE arpviewer42; CREATE USER 'arpadmin42'@'localhost' IDENTIFIED BY 'arpadmin123'; GRANT USAGE ON *.* TO 'arpadmin42'@'localhost'; GRANT SELECT , INSERT , UPDATE , DELETE ON `arpviewer42`.* TO 'arpadmin42'@'localhost'; ALTER DATABASE arpviewer42 DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci; use arpviewer42; create table ArpUser ( idxArpUser int unsigned auto_increment primary key, auUserName varchar(255) not null, auLastTermsVersion varchar(255), auFirstAccess timestamp, auLastAccess timestamp ); create index idxUserName on ArpUser (auUserName ); create table ShibProvider ( idxShibProvider int unsigned auto_increment primary key, spProviderName varchar(255) ); insert into ShibProvider (idxShibProvider) values (1); create index idxProvidername on ShibProvider (spProviderName); create table AttrReleaseApproval ( idxAttrReleaseApproval int unsigned auto_increment primary key, araIdxArpUser int unsigned references ArpUser ( idxArpUser ), araIdxShibProvider int unsigned references ShibProvider( idxShibProvider ), araTimeStamp timestamp not null, araTermsVersion varchar(255), araAttributes text(2048) ); create table ProviderAccess ( idxProviderAccess int unsigned auto_increment primary key, paIdxArpUser int unsigned references ArpUser( idxArpUser ), paIdxShibProvider int unsigned references ShibProvider( idxShibProvider ), paAttributesSent text, paTermsVersion varchar(255), paIdxAttrReleaseApproval int unsigned references AttrReleaseApproval ( idxAttrReleaseApproval ), paShibHandle varchar(255), paTimeStamp timestamp not null ); |
|
<init-param> <param-name>compilerSourceVM</param-name> <param-value>1.5</param-value> </init-param> <init-param> <param-name>compilerTargetVM</param-name> <param-value>1.5</param-value> </init-param> |
| <!-- Original des Shibbleth IDP: <LoginHandler xsi:type="PreviousSession"> <AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession</AuthenticationMethod> </LoginHandler> --> <!-- Version fuer ArpViewer 2.0 --> <LoginHandler xsi:type="PreviousSession" servletPath="/Authn/PreviousSession"> <AuthenticationMethod> urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession </AuthenticationMethod> </LoginHandler> |
| <!-- Eintraege fuer ArpViewer 2.0 --> <servlet> <servlet-name>PreviousSession</servlet-name> <servlet-class>ch.SWITCH.aai.arpfilter.ArpFilterPreviousSessionServlet</servlet-class> </servlet> <servlet-mapping> <servlet-name>PreviousSession</servlet-name> <url-pattern>/Authn/PreviousSession</url-pattern> </servlet-mapping> <filter> <filter-name>ArpFilter</filter-name> <filter-class>ch.SWITCH.aai.arpfilter.ArpFilter</filter-class> <init-param> <param-name>Config</param-name> <param-value> /local/idp/ArpViewer/arpfilter/ArpFilter.properties; /local/idp/ArpViewer/common/Common.properties; </param-value> </init-param> </filter> <filter-mapping> <filter-name>ArpFilter</filter-name> <url-pattern>/Authn/RemoteUser</url-pattern> </filter-mapping> <filter-mapping> <filter-name>ArpFilter</filter-name> <url-pattern>/Authn/PreviousSession</url-pattern> </filter-mapping> <!-- Ende ArpViewer 2.0 Eintraege --> |
| <resolver:DisplayName xml:lang="de">Angezeigter Attributsname</resolver:DisplayName> <resolver:DisplayDescription xml:lang="de">Hilfetext zu diesem Attribut</resolver:DisplayDescription> |