From: wassa Date: Thu, 31 Jul 2003 20:38:56 +0000 (+0000) Subject: Integrating new doc changes from Steven. X-Git-Tag: 2.4~2174 X-Git-Url: http://www.project-moonshot.org/gitweb/?p=shibboleth%2Fsp.git;a=commitdiff_plain;h=77d46ef11e9729c718cb36b787605bd7507e4e9a Integrating new doc changes from Steven. git-svn-id: https://svn.middleware.georgetown.edu/cpp-sp/trunk@686 cb58f699-b61c-0410-a6fe-9272a202ed29 --- diff --git a/doc/DEPLOY-GUIDE-ORIGIN.html b/doc/DEPLOY-GUIDE-ORIGIN.html index bb661eb..a14f29d 100644 --- a/doc/DEPLOY-GUIDE-ORIGIN.html +++ b/doc/DEPLOY-GUIDE-ORIGIN.html @@ -332,6 +332,9 @@ that arises. Please ensure that you have the
  • Local Error Page
    • + +
  • 5.f. Using a New Attribute
    • +
  • @@ -732,13 +735,15 @@ and JSP specification 1.2.

    to the <Ajp13Connector> configuration element to ensure that the user's identity is passed from Apache to the servlet environment.
    • +
  • The AJP13Connector for tomcat is not compatible with the new JMX support. To remove some warnings that will appear in the tomcat log every time tomcat is restarted, comment out all of the JMX stuff (anything that says "mbeans").
  • It is strongly recommended that the AA be SSL-protected to protect attributes in transit. To do so, add an appropriate location block to httpd.conf:

    <Location /shibboleth/AA> - SSLVerifyClient optional SSLOptions +StdEnvVars +ExportCertData +
     SSLVerifyClient optional +
     SSLOptions +StdEnvVars +ExportCertData </Location>

    • @@ -780,8 +785,7 @@ and JSP specification 1.2.

  • edu.internet2.middleware.shibboleth.hs.HandleServlet.siteName = <URI>
    -

    The value of this must entered as assigned by the federation used - for testing or initial operation.

    +

    Enter the value assigned to the site by the federation.

  • @@ -1753,7 +1757,7 @@ Java keystores (optional)
    An element of the element JNDIDirectoryDataConnector. Specifies an optional duration in seconds for which the attribute resolver - may cache information retrieved from this connector.
    + may cache information retrieved from this connector. The default is zero seconds (no caching)

    A representation of a properly constructed JNDIDirectoryDataConnector element would look like:

    @@ -1767,6 +1771,14 @@ Java keystores (optional)   <cacheTime="2400"/>
    </JNDIDirectoryDataConnector>

    +

    If the ldap server must be accessed over SSL, and JDK 1.4.1 is being used, two changes must be made to the JNDIDirectoryDataConnector element:

    +

    1. On the java.naming.provider.url Property, add :!lt;port number!gt; after the hostname in the ldap url (the default port for ldap over SSL is 636),

    +

    2. Add this Property element:

    +
    +

    <Property name="java.naming.security.protocol" value="ssl" ">

    +
    +

    If the ldap server must be accessed over SSL, and JDK 1.4.2 is being used, then change ldap: to ldaps: in the value of the java.naming.provider.url Property.

    +

    NOTE: This assumes that the ldap server's cert is rooted with a CA that is in the JVM's default keystore (ie: a commercial CA). If not, the CA cert must be added.

    SimpleAttributeDefinition:

    id = <string>
    @@ -1859,7 +1871,7 @@ Java keystores (optional) requesting SHAR. It outputs the resulting SAML <Attribute /> elements. This allows administrators to view the results of tweaking the resolver configuration without having to continually reload the origin web - application. Initially, the following two steps must be performed:

    + application. resolvertest is also useful for testing when the AA is first configured to use an attribute repository (ldap or sql). Initially, the following two steps must be performed:

    1. Set the shell variable SHIB_HOME to the directory path where the Shibboleth tarball was exploded (typically @@ -1895,6 +1907,16 @@ Java keystores (optional)



      +

      5.f. Using a New Attribute

      +

      In order for an attribute to be sent to a target, two steps are required:

      +

      1. The attribute has to be defined in resolver.xml. See section 5.d.

      +

      2. The effective ARP for that target has to release this attribute value. See section 5.b..

      +

      Note: resolvertest is a useful tool for verifying the correctness of the definitions.

      +

      Note: the AAP at the target must also define this attribute. See the Shibboleth Target Deploy Guide.

      + +


      +
      +