Deploy Shibboleth Target 1.2.1 on IIS Web Server

Author: Patrik Schnellmann <schnellmann@switch.ch> - SWITCH
$Date: 2005/04/22 15:40:44 $
$Revision: 1.4 $

Introduction

This document shows you how to set up a Shibboleth 1.2 target within the SWITCHaai Federation on a Windows 2003 Server with IIS 6.0. It complements the "Shibboleth Target Deployment Guide" of Internet2. Even though this guide does not specifically refer to IIS 4 and 5, it will also help to get Shibboleth working on these versions, too.

Note: For general information about the deployment of Shibboleth within the SWITCHaai Federation, please consult the Deployment section of our website.

Original Deployment Documentation

To configure your resource within another federation or for another platform either check our website or refer directly to the original Shibboleth Target Deployment Guide.

Before you start...

..., please make sure you have the following things ready:

A DNS entry for your Shibboleth target (Resource) as you will need the Fully Qualified Domain Name (FQDN) for a working configuration within the Federation
IIS Web Server installed
The Shibboleth 1.2.1a installer package for win32 shibboleth-1.2.1a-win.32.exe [asc] from Internet2 (stored locally)
The SWITCHaai configuration files package
Be aware that you will have to request a SWITCHpki server certificate (see: www.switch.ch/pki)

Installation

Installation process of Shibboleth 1.2

Use default destination folder: c:\opt\shibboleth\
Use the default value for "Shar Port Information": 1600
Install Shar as service

Note: In the following, we assume you have installed Shibboleth in its default location. If you have not, you will have to adapt the configuration file accordingly.

When you are done with the installation program

The Shibboleth files are c:\opt\shibboleth
The SHAR is installed as a service, by default with the service name "SHAR_Default"
The Path=%Path%;C:\opt\shibboleth\lib is set by the installer
The server needs to be restarted.

Note: It may help to set Path=%Path%;C:\opt\shibboleth\bin to ease the use of (command line) tools provided by installer package (such as openssl.exe).

Configuration

Configuration of IIS Web Server

Configure IIS as described in Shibboleth Target Deployment Guide, section 3.d. "Configure Microsoft IIS". Some additional remarks

In IIS 6.0, there does not have to be an sspifilt entry in the ISAPI Filter list.
Make sure that the setting "Verify that file exists" for the ISAPI Filter (isapi_shib) is not checked.
The filter status should turn green when you make any request to the Web Server.

For the example path that gets protected via shibboleth.xml, create a directory secure in your web root.

Note: The Shibboleth.shire file is just a dummy, but it's necessary if the IIS option "Verify that file exists" is set for the mapping to isapi_shib.dll.

Shibboleth Target Configuration

Extract the SWITCHaai configuration files from shibboleth-1.2-switchaai.zip and put them into C:\opt\shibboleth\etc\shibboleth\. Use the provided shibboleth.switchaai.xml as your shibboleth.xml configuration file.

Note: As you will have to replace {HOSTNAME} several times with your FQDN, using search/replace within your editor may save you some time.

The relevant modifications in shibboleth.xml are:

In ShibbolethTargetConfig/SHIRE/RequestMapProvider

In the RequestMap/Host elements, set the {HOSTNAME} and define directories that need to be protected by Shibboleth (i.e. needing a session).
In the Implementation/ISAPI/Site element, set the name attribute to reflect your FQDN (name="{HOSTNAME}").

Applications

In the Applications Element, set the attributes: id="default" providerId="urn:mace:switch.ch:SWITCHaai:pilot:{HOSTNAME}"

Sessions

In the Sessions Element, set the attributes: wayfURL="https://wayf1.switch.ch/SWITCHaai/WAYF" shireURL="/secure/Shibboleth.shire"

Errors

In the Errors Element, set the attribute: supportContact="{YOUR_EMAIL}" and customize the error pages, logo and css-stylesheet.