GitHub PullRequestReviewCommentEvent at 2014-04-02 21:29:24
Repository: puppet-hilary
Actor: simong
Payload: {"comment":{"url":"https://api.github.com/repos/oaeproject/puppet-hilary/pulls/comments/11228818","id":11228818,"diff_hunk":"@@ -0,0 +1,87 @@\n+<SPConfig xmlns=\"urn:mace:shibboleth:2.0:native:sp:config\" xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\"\n+    clockSkew=\"1800\">\n+\n+    <!-- The entityID is the name TestShib made for your SP. -->\n+    <ApplicationDefaults entityID=\"https://shib-sp.oae-performance.oaeproject.org/shibboleth\" REMOTE_USER=\"eppn persistent-id targeted-id\">\n+\n+        <!-- You should use secure cookies if at all possible.  See cookieProps in this Wiki article. -->\n+        <!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions -->\n+        <Sessions lifetime=\"28800\" timeout=\"3600\" checkAddress=\"false\" relayState=\"ss:mem\" handlerSSL=\"false\" consistentAddress=\"false\">\n+\n+            <!--\n+                Create a session initiator that responds to /Shibboleth.sso/Login .\n+                The entityID of the Identity provider can be passed in via the query string.\n+                e.g.:\n+                    Log in with the Cambridge IdP:\n+                        /Shibboleth.sso/Login?entityID=https://shib.raven.cam.ac.uk/shibboleth&target=http://collab.cam.ac.uk/api/auth/shibboleth/returned\n+\n+                    Log in with the GATech IdP:\n+                        /Shibboleth.sso/Login?entityID=https://idp.gatech.edu/idp/shibboleth&target=http://oae.gatech.edu/api/auth/shibboleth/returned\n+\n+                More information can be found at\n+                    https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionInitiator and\n+                    https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionCreationParameters\n+            -->\n+            <SessionInitiator type=\"SAML2\" Location=\"/Login\" template=\"bindingTemplate.html\" isDefault=\"true\" acsIndex=\"1\" />\n+\n+            <!-- Which \"authentication methods\" we will support. -->\n+            <!-- Note that for each tenant we add to our SP, we will have to output these, -->\n+            <!-- so it's probably best to keep these as short as possible. -->\n+            <md:AssertionConsumerService Location=\"/SAML2/POST\" index=\"1\" Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\"/>\n+\n+            <!--\n+                Extension service that generates \"approximate\" metadata based on SP configuration.\n+                We override this in Nginx as we need to add all the tenant in there manually.\n+                If you make *ANY* changes other than adding an `md:AssertionConsumerService`\n+                statement for a tenant, re-enable this, remove the nginx override, get the metadata from Shib\n+                so you can edit it properly\n+            -->","path":"modules/shibboleth/templates/shibboleth2.xml.erb","position":38,"original_position":38,"commit_id":"64b303f65b5a413901098c76ec0168630f3e130f","original_commit_id":"64b303f65b5a413901098c76ec0168630f3e130f","user":{"login":"simong","id":92180,"avatar_url":"https://avatars.githubusercontent.com/u/92180?","gravatar_id":"a26ca1903e9f76a08cdc2e8c3f70ead8","url":"https://api.github.com/users/simong","html_url":"https://github.com/simong","followers_url":"https://api.github.com/users/simong/followers","following_url":"https://api.github.com/users/simong/following{/other_user}","gists_url":"https://api.github.com/users/simong/gists{/gist_id}","starred_url":"https://api.github.com/users/simong/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simong/subscriptions","organizations_url":"https://api.github.com/users/simong/orgs","repos_url":"https://api.github.com/users/simong/repos","events_url":"https://api.github.com/users/simong/events{/privacy}","received_events_url":"https://api.github.com/users/simong/received_events","type":"User","site_admin":false},"body":"This handler will enable an API handler at `/Shibboleth.sso/Metadata` that spits out an XML file with the metadata about our SP. This usually contains:\r\n * The public key that the SP uses\r\n * Which protocols it supports\r\n * The URLs where users should be redirected to when they come back from the IdP for those protocols (including the hostname)\r\n * ..\r\nThis is what we used to output at `/api/authentication/shibboleth/metadata` on the old code ( [example](https://oae.gatech.edu/api/auth/shibboleth/metadata) )\r\n\r\nUnfortunately, it can't output the URLs for *all* the hostnames that it's running on, only the host on which the request is dealt with. We generate such a file through puppet and serve it with nginx. The documentation is trying to explain that when a new tenant comes in, or we change something to our SP config, we'll have to re-generate that metadata file.\r\n\r\nIt's usually a good idea to start from an existing one, so you might want to:\r\n * Disable the nginx override for a minute\r\n * Enable this handler for a short while\r\n * Get the metadata as generated by the shibboleth SP software from /Shibboleth.sso/Metadata\r\n * Edit the puppet template (modules/shibboleth/templates/shibboleth-sp.xml)\r\n * Run puppet (so the nginx override is enabled and this handler gets disabled)\r\n * Restart nginx, apache and mod_shib","created_at":"2014-04-02T21:29:24Z","updated_at":"2014-04-02T21:29:24Z","html_url":"https://github.com/oaeproject/puppet-hilary/pull/89#discussion_r11228818","pull_request_url":"https://api.github.com/repos/oaeproject/puppet-hilary/pulls/89","_links":{"self":{"href":"https://api.github.com/repos/oaeproject/puppet-hilary/pulls/comments/11228818"},"html":{"href":"https://github.com/oaeproject/puppet-hilary/pull/89#discussion_r11228818"},"pull_request":{"href":"https://api.github.com/repos/oaeproject/puppet-hilary/pulls/89"}}}}