Archive for the ‘shibboleth’ Category

  • What is a Learning Platform – 3 simple video explanations

    Date: 2010.05.25 | Category: Primary School ICT., ict, learning platform, primary, primary school, shibboleth | Response: 1

  • One social web could make school social networking a reality

    Date: 2010.05.14 | Category: Primary School ICT., ict, primary, primary school, shibboleth, social network | Response: 0

    Ever wished you could have a school social network that has the the privacy settings to protect pupils yet the power to connect pupils and teachers globally?

    One Social Web may make this a reality.  The purpose of One Social Web is to enable free, open, and decentralized social applications on the web. *Like Facebook but not owned by Facebook, owned by, well um, everyone!

    Usually your school data exists only on your school server.  If your school server was integrated with One Social Web school pupils or teachers could easily be “transfered” to another school without losing any information, files etc. and/or be able to access their old school work whilst being access to connect their new file storage.

    The One Social Web platform is based in London, UK and has developers all around the world.  The platform is completely open so anyone can contribute and privacy settings are managed on a per user basis.

    It would be interesting to see the first school deployment of this, I certainly hope I will get the opportunity to tie Primary School Teaching into the platform!  It would also be interesting to debate how One Social Web can work with Shibboleth providing not only single level accessibility but accessibility at an organizational level.

    Related articles by Zemanta
    Reblog this post [with Zemanta]

  • Etherpad with Shibboleth Authentication (Technical document)

    Date: 2010.03.05 | Category: etherpad, shibboleth | Response: 0

    I want to login to Etherpad with my UK federation/Shibboleth login.

    Firstly I need to get my SP working.
    Configure SP & Apache initially..
    I need to configure Tomcat to use Shibboleth for Authentication configure Jetty to use Shibboleth Authentication.
    Once this is done I will have the users attributes as environment variables.

    Now I have the variables I need to create a script to check the variables and create an account if required.  All sounds pretty simple right?  Let’s hope so, as I make progress I will document my changes.

    I’m referring to the LDAP plugin patch code for how to handle “talking to etherpad”.

    ETA is 3/4 weeks.  Sucks that I need to use Apache but oh well!!

    Note:  Etherpad runs on Jetty, not Tomcat and doesn’t require Apache.  It is the shibboleth element of this that requires Apache to operate.

    Note:  Thanks to nuba for reminding me about Jetty.

  • Etherpad with Active Directory (LDAP/AD)

    Date: 2010.02.03 | Category: ad, etherpad, ldap, shibboleth, single sign on, sso | Response: 0

    So you want to host your own Etherpad deployment and you want to tie it into your schools AD/LDAP/Active directory? Below are the basic instructions for how to accomplish this. Alternatively you can pay us to do it.
    Get the patch
    lynx https://gist.github.com/10061b4b213619816db5
    Get the etherpad source (warning- may take some time- go make a cuppa tea)
    hg clone https://etherpad.googlecode.com/hg/ etherpad
    Go to the etherpad folder
    cd etherpad
    Extract the patch
    tar -xvz –strip-components=1 -f ../gist10061b4b213619816db5-e60df95e16c09700b4cf07cd87b9732dd7b15ace.tar.gz
    Apply the patch

    patch -p1 < ldap_support.patch

    Set your superdomain
    nano trunk/etherpad/src/etherpad/globals.js
    add yourdomain.whatever to the SUPERDOMAINS
    Edit pro_accounts.js
    nano trunk/etherpad/src/etherpad/pro/pro_accounts.js
    Change directory
    cd trunk/etherpad
    Add the useLdapconf to the config
    echo “etherpad.useLdapConfiguration = ./etc/json.config” >> etc/etherpad.localdev-default.properties
    Edit json.config
    nano etc/json.config
    Paste in (you need the {}’s):

    {
    “url” : “ldap://localhost:10389″,
    “principal” : “uid=admin,ou=system”,
    “password” : “secret”,
    “rootPath” : “ou=users,ou=system”,
    “userClass” : “person”,
    “nameAttribute” : “displayname“,
    “ldapSuffix” : “@ldap”
    }
    Replacing the above with your settings.
    Build your etherpad
    bin/rebuildjar.sh
    Test your etherpad
    bin/run-local.sh
    Browse to http://yourdomain.com:9000/ep/pro-account/sign-in
    Type in your email address (of the user in ldap) and password
    Fin! Credit to Elliot Kroo and Marcio Starke – discussed further in this google group.
    Shibboleth integration coming mid 2010 (if anyone wants to fund this please get in touch!)

  • Shibboleth IDP configuration for multiple organizations & Google apps

    Date: 2009.11.21 | Category: apps, google, idp, shibboleth, single sign on, sso | Response: 6

    So you want to configure your IDP to allow logins from multiple organizations google apps? IE you want SchoolA to sign into http://docs.SchoolA.com and SchoolB to sign into http://docs.SchoolB.com.

    The documentation on googles site isn’t very clear so here are some step by step instructions.
    Before you even make a start, backup ALL of your IDP configuration files.
    PreReqs:
    • Working IDP
    • Google Apps Educational Account
    • CNAME records set for docs.SchoolA.com and docs.SchoolB.com
    Firstly complete the steps documented beautifully by Will Norris – Do the config for any school, we are just doing this to make sure you have a working IDP.
    Test the above config changes by browsing to http://apps.SchoolA.com where SchoolA.com is the domain of the school you have configure google apps for. A usual misconception new users have about google apps is that it will create user accounts when you first login. This is not true. Your user account name on google apps must match the value being passed by the IDP. I have written a perl google apps provisioning tool, get in touch if you want it.
    It worked? Great! If not, don’t continue. Get Will’s configuration working first then continue.
    Now let’s get started configuring your IDP to allow multiple organizations to authenticate to Google Apps.
    1. Log into your google apps admin account at http://google.com/a/SchoolA.com

    2. Click Advanced tools – Set up Single Sign on – Tick Use a domain specified issuer
    You are done in Google Apps. Congrats.
    3. Ssh into your IDP
    4. Is your Google Metadata located at /opt/shibboleth-idp/metadata/google-metadata.xml ? It should be, if not, modify the below guide to suite your paths. It will make sense..

    5. Edit /opt/shibboleth-idp/metadata/google-metadata.xml to read
    <EntityDescriptor entityID=”google.com/a/schoola.com” xmlns=”urn:oasis:names:tc:SAML:2.0:metadata”>
    <SPSSODescriptor protocolSupportEnumeration=”urn:oasis:names:tc:SAML:2.0:protocol”>
    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
    <AssertionConsumerService index=”1″ Binding=”urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST”
    Location=”https://www.google.com/a/schoola.com/acs” />
    </SPSSODescriptor>
    </EntityDescriptor>
    6. Copy google-metadata.xml to google-metadata2.xml
    7. Edit /opt/shibboleth-idp/metadata/google-metadata2.xml to read
    <EntityDescriptor entityID=”google.com/a/schoolb.com” xmlns=”urn:oasis:names:tc:SAML:2.0:metadata”>
    <SPSSODescriptor protocolSupportEnumeration=”urn:oasis:names:tc:SAML:2.0:protocol”>
    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
    <AssertionConsumerService index=”1″ Binding=”urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST”
    Location=”https://www.google.com/a/schoolb.com/acs” />
    </SPSSODescriptor>
    </EntityDescriptor>
    8. Edit /etc/shibboleth/relying-party.xml

    9. Smile

    10. Make me a cup of tea
    11. Replace the entire Relying Party section for the google connectivity. After you are done it should read something like…
    <RelyingParty id=”google.com/a/schoola.com”
    provider=”https://idp.youridp.com/idp/shibboleth”
    defaultSigningCredentialRef=”IdPCredential”>
    <ProfileConfiguration xsi:type=”saml:SAML2SSOProfile” encryptAssertions=”never” encryptNameIds=”never” />
    </RelyingParty>
    <RelyingParty id=”google.com/a/schoolb.com”
    provider=”https://idp.youridp.com/idp/shibboleth”
    defaultSigningCredentialRef=”IdPCredential”>
    <ProfileConfiguration xsi:type=”saml:SAML2SSOProfile” encryptAssertions=”never” encryptNameIds=”never” />
    </RelyingParty>
    12. Search for Google.com again – look for the MetadataProvider section

    13. Copy and paste the first reference replacing .xml with 2.xml, change the second schools id value to GoogleMD2, it should read something like this:
    <MetadataProvider id=”GoogleMD” xsi:type=”FilesystemMetadataProvider” xmlns=”urn:mace:shibboleth:2.0:metadata”
    metadataFile=”/opt/shibboleth-idp/metadata/google-metadata.xml” maintainExpiredMetadata=”true” />
    <MetadataProvider id=”GoogleMD2″ xsi:type=”FilesystemMetadataProvider” xmlns=”urn:mace:shibboleth:2.0:metadata”
    metadataFile=”/opt/shibboleth-idp/metadata/google-metadata2.xml” maintainExpiredMetadata=”true” />
    Congrats, you are done in relying-party.xml!
    14. Edit /etc/shibboleth/attribute-filter.xml

    15. Search for google.com
    16. Edit the value to read “google.com/a/schoola.com”

    17. Copy and paste the policy, replace schoola.com with schoolb.com in the new policy.
    It should read:
    <AttributeFilterPolicy>
    <PolicyRequirementRule xsi:type=”basic:AttributeRequesterString” value=”google.com/a/schoola.com” />
    <AttributeRule attributeID=”principal”>
    <PermitValueRule xsi:type=”basic:ANY” />
    </AttributeRule>
    </AttributeFilterPolicy>
    <AttributeFilterPolicy>
    <PolicyRequirementRule xsi:type=”basic:AttributeRequesterString” value=”google.com/a/schoolb.com” />
    <AttributeRule attributeID=”principal”>
    <PermitValueRule xsi:type=”basic:ANY” />
    </AttributeRule>
    </AttributeFilterPolicy>
    18. I restarted tomcat using the ./Shutdown ./Startup script to test and it worked fine. Test by browsing to http://apps.schoola.com/(assuming you have this cname set). If you have problems please check that you replaced schoola.com and schoolb.com with your domain and also your IDP references.

Older posts

Latest chatter

Posting tweet...

Sponsored by

Primary Games Arena
 
 
 
 
 
 
 
 

RSS Recommended Reads

Links