Federated Identity MetaData

[TochukwuEze_d974]

Pls i am taking SP101 course on courses.sci-gaia.eu https://courses.sci-gaia.eu/courses/GARR/SP101/2015_T4/courseware/fff6bfc70b4b4cd180968c3a9b80a6fb/ and i have gotten to the point (Step 4) where i need a federated Identity Metadata as a service provider. Pls i need help on how to get this metadata so that i can complete the implementation of my portal to support single signon for fedrated users

[brucellino]

Hi @TochukwuEze_d974, thanks for the topic.

This is one for @MarcoFargetta_0c9b1 I think, who is the test federation manager. He will be able to send you the link to the test federation metadata and tell you how to configure the service-side shibboleth.

[MarcoFargetta_0c9b1]

The metadata of our test federation are: https://gridp.garr.it/metadata/gridp-test.xml

If you want to include the SP just send me the link to your metadata.

[brucellino]

If you want to include the SP just send me the link to your metadata.

@MarcoFargetta_0c9b1, @TochukwuEze_d974 is currently developing a service on his laptop, so the url of the service metadata won't be resolveable. What do you suggest he does while going through the dev phase ?

[TochukwuEze_d974]

pls i need to fill up dis parameters in the shibboleth2.xml on my local machine

<ApplicationDefaults entityID="https://sp1.local/shibboleth" REMOTE_USER="eppn persistent-id targeted-id">

<SSO entityID="https://idp.corso.irccs.garr.it/idp/shibboleth" discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
              SAML2 SAML1
            </SSO>

<MetadataProvider type="XML" uri="http://federation.org/federation-meta$
              backingFilePath="federation-metadata.xml" reloadInterval="7200">
            <MetadataFilter type="RequireValidUntil" maxValidityInterval="24192$
            <MetadataFilter type="Signature" certificate="fedsigner.pem"/>
        </MetadataProvider>

tanks

[MarcoFargetta_0c9b1]

Metadata contains link to end-points in the resources so these have to be accessible from the internet.
I do not think there is a easy work-around to work with local service.

A possibility I was using some times ago it is to create a local federation. You need at least two VMs (or container if you prefer) where one is the SP and the other is an IdP.

[MarcoFargetta_0c9b1]

Hi @TochukwuEze_d974,

If your service run on localhost only I cannot enable it in the test federation so configure the metadata provider is useless.
You have to solve the url problem first of create your own federation locally.

[brucellino]

You need at least two VMs (or container if you prefer) where one is the SP and the other is an IdP.

After discussion, it seems this application will be hosted for development purposes on the Sci-GaIA cloud temporarily. We should discuss in a different topic how to ensure 12 factor compliance. The contract with the infrastructure provider should be at the application level. Configuration of the federated identity service should be taken care of for all applications on the infrastructure at a lower level.