Shibboleth IdP 2安装手记

[root@idp ~]# jar -xf shibboleth-identityprovider-2.1.4-bin.zip
[root@idp ~]# cd shibboleth-identityprovider-2.1.4

[root@idp shibboleth-identityprovider-2.1.4]# mkdir /opt/tomcat/endorsed
[root@idp shibboleth-identityprovider-2.1.4]# cp -v lib/shibboleth-jce-1.1.0.jar /opt/tomcat/lib/
`lib/shibboleth-jce-1.1.0.jar’ -> `/opt/tomcat/lib/shibboleth-jce-1.1.0.jar’
[root@idp shibboleth-identityprovider-2.1.4]# cp shibboleth-identityprovider-2.1.4/endorsed/*.jar /opt/tomcat/endorsed/ -v
`/root/shibboleth-identityprovider-2.1.4/endorsed/resolver-2.9.1.jar’ -> `endorsed/resolver-2.9.1.jar’
`/root/shibboleth-identityprovider-2.1.4/endorsed/serializer-2.9.1.jar’ -> `endorsed/serializer-2.9.1.jar’
`/root/shibboleth-identityprovider-2.1.4/endorsed/xalan-2.7.1.jar’ -> `endorsed/xalan-2.7.1.jar’
`/root/shibboleth-identityprovider-2.1.4/endorsed/xercesImpl-2.9.1.jar’ -> `endorsed/xercesImpl-2.9.1.jar’
`/root/shibboleth-identityprovider-2.1.4/endorsed/xml-apis-2.9.1.jar’ -> `endorsed/xml-apis-2.9.1.jar’

[root@idp shibboleth-identityprovider-2.1.4]# chmod a+x install.sh
[root@idp shibboleth-identityprovider-2.1.4]# ./install.sh
Buildfile: src/installer/resources/build.xml

install:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Be sure you have read the installation/upgrade instructions on the Shibboleth website before proceeding.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Where should the Shibboleth Identity Provider software be installed? [/opt/shibboleth-idp]

What is the fully qualified hostname of the Shibboleth Identity Provider server? [idp.example.org]
idp.nottingham.edu.cn
A keystore is about to be generated for you. Please enter a password that will be used to protect it.
******** (为生成数字证书设置密码保护)
Updating property file: /root/shibboleth-identityprovider-2.1.4/src/installer/resources/install.properties
Created dir: /opt/shibboleth-idp
Created dir: /opt/shibboleth-idp/bin
Created dir: /opt/shibboleth-idp/conf
Created dir: /opt/shibboleth-idp/credentials
Created dir: /opt/shibboleth-idp/lib
Created dir: /opt/shibboleth-idp/lib/endorsed
Created dir: /opt/shibboleth-idp/logs
Created dir: /opt/shibboleth-idp/metadata
Created dir: /opt/shibboleth-idp/war
Generating signing and encryption key, certificate, and keystore.
Copying 5 files to /opt/shibboleth-idp/bin
Copying 8 files to /opt/shibboleth-idp/conf
Copying 1 file to /opt/shibboleth-idp/metadata
Copying 49 files to /opt/shibboleth-idp/lib
Copying 5 files to /opt/shibboleth-idp/lib/endorsed
Copying 1 file to /root/shibboleth-identityprovider-2.1.4/src/installer
Building war: /root/shibboleth-identityprovider-2.1.4/src/installer/idp.war
Copying 1 file to /opt/shibboleth-idp/war
Deleting: /root/shibboleth-identityprovider-2.1.4/src/installer/web.xml
Deleting: /root/shibboleth-identityprovider-2.1.4/src/installer/idp.war

BUILD SUCCESSFUL
Total time: 1 minute 5 seconds

[root@idp shibboleth-identityprovider-2.1.4]# ln -s /opt/shibboleth-idp/logs /var/log/shibboleth

[root@idp shibboleth-identityprovider-2.1.4]# cd /opt/shibboleth-idp/
[root@idp shibboleth-idp]# chown -R tomcat6. logs metadata credentials
[root@idp shibboleth-idp]# chmod 755 logs metadata
[root@idp shibboleth-idp]# chown tomcat6. conf/attribute-filter.xml
[root@idp shibboleth-idp]# chown -R tomcat6. /opt/tomcat/endorsed/
[root@idp shibboleth-idp]# chmod 660 conf/attribute-filter.xml
[root@idp shibboleth-idp]# cd credentials/
[root@idp credentials]# chown tomcat6:tomcat6 idp.key
[root@idp credentials]# chgrp root idp.{key,crt}
[root@idp credentials]# chmod 440 idp.key
[root@idp credentials]# chmod 644 idp.crt

docBase=”/opt/shibboleth-idp/war/idp.war”
privileged=”true”
antiResourceLocking=”false”
antiJARLocking=”false”
unpackWAR=”false” />

[root@idp credentials]# vim /opt/tomcat/conf/server.xml

scheme=”https”
secure=”true”
clientAuth=”true”
sslProtocol=”TLS”
sslImplementation=”edu.internet2.middleware.shibboleth.tomcat.DelegateToApplicationJSSEImplementation”
keystoreFile=”IDP_HOME/credentials/idp.jks”
keystorePass=”PASSWORD” />

[root@idp credentials]# cd /etc/pki
[root@idp pki]# openssl req -new -x509 -nodes -out shibidp.crt -keyout shibidp.key
Generating a 1024 bit RSA private key
……..++++++
……………………..++++++
writing new private key to ‘shibidp.key’
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:Zhejiang
Locality Name (eg, city) [Newbury]:Ningbo
Organization Name (eg, company) [My Company Ltd]:The University of Nottingham Ningbo, China
Organizational Unit Name (eg, section) []:Information Services
Common Name (eg, your name or your server’s hostname) []:idp.nottingham.edu.cn
Email Address []:it-services@nottingham.edu.cn

[root@idp credentials]# service tomcat restart
Stopping /opt/tomcat/bin/catalina.sh:
Using CATALINA_BASE:   /opt/tomcat
Using CATALINA_HOME:   /opt/tomcat
Using CATALINA_TMPDIR: /opt/tomcat/temp
Using JRE_HOME:       /usr/lib/jvm/java/

waiting for processes to exit
waiting for processes to exit
Starting /opt/tomcat/bin/catalina.sh:
Using CATALINA_BASE:   /opt/tomcat
Using CATALINA_HOME:   /opt/tomcat
Using CATALINA_TMPDIR: /opt/tomcat/temp
Using JRE_HOME:       /usr/lib/jvm/java/

[root@idp credentials]# service httpd restart
Stopping httpd:                                            [  OK  ]
Starting httpd:                                            [  OK  ]

[root@idp credentials]# links http://localhost/idp/status