Shibboleth:Installation & Setup
Nate KlingensteinInternet2
ndk@internet2.edu
国立情報学研究所
２００７年６月１日

Installation Process &Requirements• Setting up a Shibboleth IdP• Moving from testing to real use• Setting up a Shibboleth SP• Moving from testing to real use• Federation• Again, this will get technical2Federated Identity
Solutions from Vendors• I want to encourage you to use all

federated identity, including vendor
products• EuroCAMP 2007 Panel Discussion• Oracle Identity Federation 11gR2+
supports native Shibboleth• Others, if SAML-compliant, caninteroperate

3Why Shibboleth?
• Free• Open-source• Standards-based• Designed for use with big federations• Works well with products from manyvendors• Very large deployment worldwide
4

Getting Ready to Install• The hard part is the rest of theidentity management system• Attributes• Enterprise authentication• Provisioning• Shibboleth itself is much easier5Standard Shibboleth IdPInstallation Procedure• Install Tomcat• 4.0.x+• Install and configure mod_jk or
mod_ajp_proxy• Install Shibboleth• Hit “Return” 4 times
6Standard Shibboleth IdPInstallation Procedure• Connect an existing institutional
authentication source to Apache• Or create one if needed• Test with TestShib• Join the test federation• Get keys, certificates, and configuration
made for you• Access http://sp.testshib.org to test7

Standard Shibboleth IdPInstallation Procedure• Connect to your attribute sources• LDAP or SQL Database are easiest• Test with others• Entire process takes 1-4+ hours,

mostly depending on how well you
know Apache and Tomcat• https://spaces.internet2.edu/display/SHIB/JKIdPInstall8

Making the IdP ready forreal use• The Shibboleth IdP is extremely fast
• One decent machine can handle 50,000+logins/day and 50 logins/sec• Penn State wanted to use Shibboleth
for all its students to use Napster• Installed 5 very big Blade servers for IdP’s• No noticeable CPU load on any machine• Only needed 2 at most for very large access
9Making the IdP ready forreal use• Multiple machines is necessary for
backup in case one dies

• Load-balancing can be done statelessly by
cryptographically encoding information• Or more heavily through HA-Shib• Almost any operating system is fine
• But installing on Windows is probably
hardest10

Getting Ready to Installa Shibboleth SP• SP must be installed on every

machine hosting Shibboleth-protectedresources• Unless you like reverse proxies• Installation on Fedora-based Linuxand Windows is very easy

• RedHat, CentOS, etc.
11

Getting Ready to Installa Shibboleth SP• Installation on Mac OS X and otherLinux distributions is also pretty easy

• Installation on Sun Solaris can beeasy, or very very hard

• The XML-processing dependencies

12Shibboleth SP Install byRPM/Installer• Download RPMs/Installer• Run RPMs/Installer• Restart web server• Start shibd• Test with TestShib• Binaries for Mac OS X are a little
more complicated to install13

Shibboleth SP SRPM’s• Source RPM’s; like an RPM, only

instead of binaries, it builds fromsource code

• Works in more environments, but a little
harder to use• Directions available for SuSE, Fedora, andDebian14

Shibboleth SP: Build itfrom Source• It’s easy on some platforms andimpossible on others• gcc 3/4 on Linux and Mac OS X
• Solaris GCC is unsupported; Solaris CC(usually) works• It’s the dependencies that are hard
• Solaris 2.8 binaries are available
15

SP Installation• Again, very little load; if it can run

your webapps, it can run Shibboleth
to protect them

• Total time is usually between 2-5hours

16

Making a Shibboleth SP
ready for real use• Backup is very hard to do on the web• You have one chance; if it fails, the browser
gives up, and you lose

• Clustering is easier, but usually doneby the applications• Much better session management in
Shibboleth 2.0 SP17

Making your NewProviders Talk Together• If they both joined TestShib
successfully, it’s very easy

1. Download fresh metadata
2. Tell the SP to choose your IdP to login
3. Tell your IdP which information tosend to your SP

18

Creating a Federation• Technical things• Policy things

19Technical things aFederation can do• Metadata• WAYF/DS Service• Attribute definitions• Attribute release and acceptanceguidelines• PKI keys and certificates20Policy things aFederation can do• Identify the authoritative servers foreach organization• Ask important organizations to join
• Tell people what SP’s are available• Helping with disagreements, liability• Set basic rules for attribute use
21

International Federation• There are working groups to connect
together national federations• “Inter-federation” or “Confederation”• NREN’s have MoU’s with each other• AIRC is the Japanese partner of Internet2• 日本の主要大学と研究機関による、日本先進インターネット研究コンソーシアム。アメリカのInternet 2を推進するUCAID（ユーケイド）の実験ネットワークとも相互接続して共同研究を進めています。

22

Opportunities for Japan• This is something you know better
than I can• Good identity management makes
research great• More sensitive data
• More researchers• More international collaboration
23

Opportunities for Japan• Shibboleth- and SAML-Based SSO on
individual campuses• Japanese testing federation• Research into NAREGI integration• Contracts with individual contentproviders• International team support
24

Deployment Resources
http://shibboleth.internet2.edu/
shibboleth-users@internet2.edu
http://spaces.internet2.edu/display/SHIB25