Delete _/etc/shibboleth/attribute-map.xml_ and replace it with:
-
<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<GSSAPIAttribute name="urn:ietf:params:gss-eap:radius-avp urn:x-radius:89" id="local-login-user"/>
</Attributes>
In this case, 89 corresponds to _Chargeable-User-Identity_, which is mapped to _local-login-user_, which sets the local account that the user will be given access to.
-To load the moonshot extensions, under the root node in /etc/shibboleth/shibboleth2.xml, add:
+To load the moonshot extensions, under the root node in _/etc/shibboleth/shibboleth2.xml_, add:
<Extensions>
<Library path="plugins.so" fatal="true"/>
</Extensions>
-
Further down the same file, find this line:
<AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/>
##Testing Functionality
As mentioned earlier, we will be using the Kerberos test tools to make sure that things are working.<br />
-To start the gss-server, run:
+To start the _gss-server_, run:
/opt/moonshot/sbin/gss-server host@localhost &
-There are two ways to start gss-client – the first specifies an encryption method to use by its OID 1.3.6.1.4.1.5322.22.1.18 (as seen in /etc/gss/mech):
+There are two ways to start _gss-client_ – the first specifies an encryption method to use by its OID 1.3.6.1.4.1.5322.22.1.18 (as seen in /etc/gss/mech):
/opt/moonshot/bin/gss-client -mech "{1 3 6 1 4 1 5322 22 1 18}" 127.0.0.1 host@localhost bar
-The second uses Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO)<br />
-This chooses the "best" mutually-agreeable encryption method for between client and server. To invoke the client using SPNEGO, use:
+The second uses __Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO)__<br />
+This chooses the "best" mutually-agreeable encryption method for between client and server. To invoke the client using __SPNEGO__, use:
/opt/moonshot/bin/gss-client -spnego 127.0.0.1 host@localhost bar
##Sample Output
Signature verified.
NOOP token
-Running _gss- client produces_ a massive amount of output.<br />
+Running _gss-client_ produces a massive amount of output.<br />
The important part is at the end – you should see output similar to what is on the previous slide.<br />
If you do not see the line:
Attribute local-login-user Authenticated Complete