|
IDP Deployment URI
|
Deployment URI for the deployed sample WAR on machine-A
(for example, /idp)
|
|
|
How do I run the Liberty
ID-WSF sample?
Assuming you have completed How
do I set up the Liberty ID-WSF sample?, access the
following URL in a browser and follow the link to execute the
sample:
machine-B_protocol://machine-B_hostname:port/deployment_uri/wsc/index.jsp
The following procedures are optional setups:
1. How do I enable
interactions for querying and modifying the Personal Profile
service?
Run the following commands to turn on policy evaluation
for all queries to, and modifications of, the Personal Profile
service:
famadm set-attr-defs
-s sunIdentityServerLibertyPPService -u amadmin -f
admin_password_file_name -t
Global -a "sunIdentityServerPPisQueryPolicyEvalRequired=true"
famadm set-attr-defs -s
sunIdentityServerLibertyPPService -u amadmin -f
admin_password_file_name -t
Global -a
"sunIdentityServerPPisModifyPolicyEvalRequired=true"
Create a policy for the Personal Profile service with
the following procedure:
Access the OpenSSO login page on machine-A at:
machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri/UI/Login
and login as the top-level administrator (by default,
amadmin).
Click the top-level realm opensso.
Click the Policies tab.
Click New Policy.
Enter a name for the policy as a value for Name.
Click New... under Rules.
Select Liberty Personal Profile Service (with resource
name) and click Next.
Enter a rule name as a value for Name.
Enter * (an asterisk) as the value of
Resource Name.
Select the MODIFY and QUERY action boxes.
Select interactForConsent in both drop
down menus under Value and click Finish.
Click New... under Subjects.
Select Authenticated Users and click Next.
Enter the name of the user created for the identity
provider in Name and click Finish.
Click OK to save this policy.
Completing this procedure ensures that only authenticated
users are allowed access to the Personal Profile service.
2. How do I enable
name ID encryption in the session context of a discovery
bootstrap?
Set up a keystore.
This needs to be done on both machine-A and
machine-B. If machine-C is different from
machine-B, copy keystore.jks, .keypass
and .storepass from machine-B to
corresponding directory on machine-C. See How
do I setup a keystore?.
Use the following procedure to set up machine-A
as the identity provider:
Run the following command to set the default attribute
values for the discovery service:
famadm set-attr-defs -s
sunIdentityServerDiscoveryService -u amadmin -f
admin_password_file_name -t
Global -a
"sunIdentityServerDiscoProviderID=machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri"
Run the following command to set the default attribute
values for name ID encryption:
famadm set-attr-defs -s
sunIdentityServerDiscoveryService -u amadmin -f
admin_password_file_name -t
Global -a
"sunIdentityServerBootstrappingEncryptNIinSessionContext=true"
Run the following command to display the default
attribute values for bootstrapping:
famadm get-attr-defs -s
sunIdentityServerDiscoveryService -u amadmin -f
admin_password_file_name -t
Global -a sunIdentityServerBootstrappingDiscoEntry
From the previous step's output, save the entire line
beginning with sunIdentityServerBootstrappingDiscoEntry=
to a file.
In this case, we will call the file datafile.
Change the datafile you just created as
follows:
Replace
<ProviderID>machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri/Liberty/disco</ProviderID>
with
<ProviderID>machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri</ProviderID>
Replace
<SecurityMechID>urn:liberty:security:2003-08:null:null</SecurityMechID>
with
<SecurityMechID>urn:liberty:security:2003-08:null:SAML</SecurityMechID>
Replace
</ResourceOffering></DiscoEntry>
with
</ResourceOffering><AuthorizeRequester
xmlns="urn:liberty:disco:2003-08"/></DiscoEntry>
Run the following command to set the default attribute
values for the discovery service in datafile:
famadm set-attr-defs -s
sunIdentityServerDiscoveryService -u amadmin -f
admin_password_file_name -t
Global -D datafile
Logon to console as top
level administrator. Goto Configuration -> Global ->
Liberty ID-WSF Security Service, edit the values of the
following properties:
Trusted Authority signing certificate alias
to test
Default WSC certificate alias to test
Trusted CA signing certificate aliases
to test
test is the sample value.
Run the following command to delete the identity
provider metadata:
famadm delete-entity -y machine-A_entityid
-u amadmin -f admin_password_file_name
-c metadata_spec
where
|
|
machine-A_entityid
|
The provider's entity ID in the format:
machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri
For example, http://happy.red.sun.com:80/openfm
|
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Run the following command to delete the service
provider metadata:
famadm delete-entity -y machine-B_entityid
-u amadmin -f admin_password_file_name
-c metadata_spec
where
|
|
machine-B_entityid
|
The provider's entity ID in the format:
machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri
For example, http://sad.red.sun.com:80/openfm
|
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Run the following command to create a metadata file
for the identity provider:
famadm create-metadata-templ -u amadmin -f
admin_password_file_name -y
machine-A_entityid -m
standard_metadata -x
extended_metadata -i
idpMetaAlias -b
idpSCertAlias -g
idpeCertAlias -c
metadata_spec
where
|
|
machine-A_entityid
|
The provider's entity ID in the format:
machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri
For example, http://happy.red.sun.com:80/openfm
|
|
|
standard_metadata
|
Path to, and name of, the standard metadata XML file
|
|
extended_metadata
|
Path to, and name of, the extended metadata XML file
|
|
idpMetaAlias
|
Specify a metaAlias for the identity provider being created.
|
|
idpSCertAlias
|
Specify a signing certificate alias for the identity
provider being created.
|
|
idpeCertAlias
|
Specify an encryption certificate alias for the identity
provider being created.
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Change the value of the enableNameIDEncryption
attribute in the extended metadata file just created to true.
Run the following command to import the standard and
extended metadata files into the circle of trust previously
created:
famadm import-entity -u amadmin -f
admin_password_file_name -m
standard_metadata -x
extended_metadata -t
cot_name -c metadata_spec
where
|
|
standard_metadata
|
Path to, and name of, the standard metadata XML file
|
|
|
extended_metadata
|
Path to, and name of, the extended metadata XML file
|
|
cot_name
|
The name of the circle into which the files are being
imported; in this case, sampleidffcot.
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Copy the standard metadata file (created during the
service provider procedure documented in the next step) from
machine-B to the /tmp directory on this
machine.
Run the following command to import the standard
metadata file just copied from machine-B:
famadm import-entity -u amadmin -f
admin_password_file_name -m
standard_metadata -t
cot_name -c metadata_spec
where
|
|
standard_metadata
|
Path to, and name of, the standard metadata XML file
|
|
|
cot_name
|
The name of the circle into which the files are being
imported; in this case, sampleidffcot.
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Use the following procedure to set up machine-B
as the service provider:
Run the following command to delete the sample
identity provider entity:
famadm delete-entity -y sample_idp_entityid
-u amadmin -f admin_password_file_name
-c metadata_spec
Run the following command to delete the sample service
provider entity:
famadm delete-entity -y sample_sp_entityid
-u amadmin -f admin_password_file_name
-c metadata_spec
Run the following command to create a metadata file
for the service provider:
famadm create-metadata-templ -u amadmin -f
admin_password_file_name -y
machine-B_entityid -m
standard_metadata -x
extended_metadata -s
spMetaAlias -a spSCertAlias
-r speCertAlias -c
metadata_spec
where
|
|
machine-B_entityid
|
The provider's entity ID in the format:
machine-B_protocol://machine-B_host:machine-B_port/machine-B_deploy_uri
For example, http://sad.red.sun.com:80/openfm
|
|
|
standard_metadata
|
Path to, and name of, the standard metadata XML file
|
|
extended_metadata
|
Path to, and name of, the extended metadata XML file
|
|
spMetaAlias
|
Specify a metaAlias for the service provider being created.
|
|
spSCertAlias
|
Specify a signing certificate alias for the identity
provider being created.
|
|
speCertAlias
|
Specify an encryption certificate alias for the identity
provider being created.
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Run the following command to import the metadata file
just created:
famadm import-entity -u amadmin -f
admin_password_file_name -m
standard_metadata -x
extended_metadata -t
cot_name -c metadata_spec
where
|
|
standard_metadata
|
Path to, and name of, the standard metadata XML file
|
|
|
extended_metadata
|
Path to, and name of, the extended metadata XML file
|
|
cot_name
|
Name of the circle to which the metadata is being imported;
in this case, sampleidffcot.
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Copy the standard metadata file (created during the
identity provider procedure documented in the previous step)
from machine-A to the /tmp
directory on this machine.
Run the following command to import the sample
identity provider entity into the circle of trust:
famadm import-entity -u amadmin -f
admin_password_file_name -m
standard_metadata -t
cot_name -c metadata_spec
where
|
|
standard_metadata
|
Path to, and name of, the standard metadata XML file
|
|
|
cot_name
|
Name of the circle to which the metadata is being imported;
in this case, sampleidffcot.
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Restart web containers on all three machines and you
have enabled name ID encryption in the session context of a
discovery bootstrap.
|
|
Q: How do I turn on signing
using SAML v1.x?
When used, the SAML POST Profile automatically turns on
signing. The following procedure illustrates how to turn on
signing using the SAML v1.x SAML Artifact Profile.
Run the following command to turn on signing for all
SAML responses:
famadm set-attr-defs -s iPlanetAMSAMLService -t
global -u amadmin -f admin_password_file_name
--attributevalues iplanet-am-saml-signresponse=true -d
Run the following command to turn on signing for all
SAML requests:
famadm set-attr-defs -s iPlanetAMSAMLService -t
global -u amadmin -f admin_password_file_name
--attributevalues iplanet-am-saml-signrequest=true -d
Run the following command to turn on signing for all
SAML assertions:
famadm set-attr-defs -s iPlanetAMSAMLService -t
global -u amadmin -f admin_password_file_name
--attributevalues iplanet-am-saml-signassertion=true -d
|
|
Q: How do I turn on
signing using the Liberty ID-FF?
If all of the following points are true, Liberty ID-FF
signing is enabled. If not, follow the procedures below to make
the necessary modifications and then restart the web
containers.
A keystore is set up on the hosted provider. See How
do I setup a keystore? for the procedure.
The signingCertAlias and KeyDescriptor
attributes in the hosted provider's standard metadata XML file
are set properly.
To verify this:
Run the following command on the hosted provider to
export the metadata XML files.
famadm export-entity -y hosted_entity_id
-u amadmin -f admin_password_file_name
-m standard_metadata -x
extended_metadata -c
metadata_spec
where
|
|
hosted_entityid
|
The provider's entity ID in the format:
protocol://host:port/deploy_uri
For example, http://happy.red.sun.com:80/openfm
|
|
|
standard_metadata
|
The standard metadata file being exported.
|
|
extended_metadata
|
The extended metadata file being exported.
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
If a value is set for signingCertAlias in
extended_metadata and KeyDescriptor in
standard_metadata, you are finished. If there is no
value set, continue to the next step.
Re-generate the hosted provider's metadata with the
security information as follows:
For a hosted identity provider, run the following
command:
famadm create-metadata-templ -y idp_entity_id
-u amadmin -f admin_password_file_name
-m standard_metadata -x
extended_metadata -i
idpMetaAlias -b
idpSCertAlias -c
metadata_spec
For a hosted service provider, run the following
command:
famadm create-metadata-templ -y sp_entity_id
-u amadmin -f admin_password_file_name
-m standard_metadata -x
extended_metadata -s
spMetaAlias -a spSCertAlias
-c metadata_spec
You may modify the extended metadata attributes (for
example, providerHomePageURL) as needed.
Run the following command on the hosted provider to
delete the metadata XML files.
famadm delete-entity -y hosted_entity_id
-u amadmin -f admin_password_file_name
-e realm -c metadata_spec
Run the following command on the hosted provider to
load the modified metadata XML files.
famadm import-entity -u amadmin -f
admin_password_file_name -m
standard_metadata -x
extended_metadata -t
cot_name -c metadata_spec
Logon to console as top level administrator, goto
Configuration -> Global -> Liberty ID-FF Service
Configuration, set the "XML signing on" field to
"true".
The KeyDescriptor attribute in the remote
provider's standard metadata XML file is set properly.
To verify this:
Run the following command on the hosted provider to
export the remote provider's standard metadata XML file.
famadm export-entity -y remote_entity_id
-u amadmin -f admin_password_file_name
-m remote_standard_metadata
-x remote_extended_metadata
-c metadata_spec
Search the XML file(s) for the KeyDescriptor
attribute and make sure it contains a value.
If none exists, get the updated standard metadata XML file
from the remote provider using the following procedure:
Run the following command to delete the remote
provider metadata from the hosted provider machine.
famadm delete-entity -y remote_entity_id
-u amadmin -f admin_password_file_name
-e realm -c metadata_spec
Run the following command to import the updated
remote provider metadata (retrieved from the remote provider
machine) to the hosted provider machine.
famadm import-entity -u amadmin -f
admin_password_file_name -m
new_remote_standard_metadata
-t circle-of-trust_name -c
metadata_spec
where
|
|
new_remote_standard_metadata
|
The standard metadata file to which a value for
KeyDescriptor was added.
|
|
|
remote_extended_metadata
|
The extended metadata file that was previously exported.
|
If the remote provider
is running on an instance of Sun Java System Federation
Manager, the standard metadata (including the KeyDescriptor
attribute) can be obtained by running the following command
on the machine in which the remote provider is hosted.
famadm
export-entity -y remote_entity_id
-u amadmin -f admin_password_file_name
-m remote_standard_metadata
-x remote_extended_metadata
-c metadata_spec
Optional: To enable signing of authentication
requests on a hosted service provider, verify (or modify, if
applicable) the hosted service provider's standard metadata
using the following procedure:
Run the following command to export the standard and
extended metadata from the hosted service provider:
famadm export-entity -y hosted_entity_id
-u amadmin -f admin_password_file_name
-m hosted_standard_metadata
-x hosted_extended_metadata
-c metadata_spec
Make sure the value of the AuthnRequestsSigned
attribute in the hosted_standard_metadata is set to
true.
If not set the value correctly and proceed.
Run the following command to delete the hosted
provider's metadata:
famadm delete-entity -y hosted_entity_id
-u amadmin -f admin_password_file_name
-e realm -c metadata_spec
Run the following command to import the hosted
provider's updated metadata:
famadm import-entity -u amadmin -f
admin_password_file_name -m
hosted_standard_metadata -x
hosted_extended_metadata -c
metadata_spec
|
|
Q: How do I setup a keystore?
The following procedure illustrates how to setup a keystore
using the keytool command line interface which is
part of the Java Development Kit (JDK).
Run the following command:
JDK Home/bin/keytool -genkey
-keyalg rsa -alias test -dname "cn=sun-unix,ou=SUN Java
System Access Manager,o=Sun, c=US" -keypass 11111111
-keystore keystore.jks -storepass 11111111
Copy the
keystore.jks file to
<configuration_dir>/<deploy_uri> directory,
where <configuration_dir> is the directory name
entered when configuring the opensso WAR and <deploy_uri>
is the opensso WAR deployment URI.
Access the encode.jsp file on the instance
to encrypt the keystore password:
server_protocol://server_host:server_port/server_deploy_uri/encode.jsp
opensso.war must be deployed for access to
encode.jsp.
Enter the text password and click Encode.
For example, 11111111 becomes
AQICQS+KlLm9oNd2l98bnkd7TraHI/cv8B1p.
Create a new file named .storepass under
<configuration_dir>/<deploy_uri> directory
and paste the encrypted password for the keystore in it.
In this case, we paste AQICQS+KlLm9oNd2l98bnkd7TraHI/cv8B1p
into .storepass.
Create a new file named .keypass under
<configuration_dir>/<deploy_uri> directory
and paste the encrypted password for the private key in it.
In this case, we again paste
AQICQS+KlLm9oNd2l98bnkd7TraHI/cv8B1p into
.keypass.
Restart web container.
|
|
Q: How do I setup single sign-on
using SAML 1.x and the famadm
command line interface?
To accomplish single sign-on using SAML 1.x, follow this
procedure on the instances of Open Federation that will serve
as the SAML producer and the SAML consumer.
Run the following command on the remote site to get the
site ID:
famadm get-attr-defs -s iPlanetAMSAMLService -t
global -u amadmin -f admin_password_file_name
-a iplanet-am-saml-siteid-issuername-list
The output of this command is
iplanet-am-saml-siteid-issuername-list=instanceID=http://host.exampleA.com:58080|siteid=VhqieajnHbbNX1usZkmnQLTxNeQ=|issuerName=host.exampleA.com:58080
The site ID is the value of the siteid
property, VhqieajnHbbNX1usZkmnQLTxNeQ=.
Configure a trusted partner entry for the remote site
in the hosted site's SAML Service using the following
procedure:
Display any existing trusted partners by running the
following command:
famadm get-attr-defs -s iPlanetAMSAMLService -t
global -u amadmin -f admin_password_file_name
-a iplanet-am-saml-partner-urls
The output will be
iplanet-am-saml-partner-urls=
Put the remote partner's information in a new file
called, for this procedure, partner.txt.
The file will contain the following attributes and
corresponding values:
target=partner_hostname
sourceid=remote_siteid_from_previous_step
samlurl=protocol://partner_hostname:partner_port/uri/SAMLAwareServlet
soapurl=protocol://partner_hostname:partner_port/uri/SAMLSOAPReceiver
posturl=protocol://partner_hostname:partner_port/uri/SAMLPOSTProfileServlet
issuer=partner_hostname:partner_port
hostlist=partner_hostname
For example:
iplanet-am-saml-partner-urls=target=provider.com|sourceid=VhqieajnHbbNX1usZkmnQLTxNeQ=|samlurl=http://host.exampleA.com:58080/amserver/SAMLAwareServlet|
soapurl=http://host.exampleA.com:58080/amserver/SAMLSOAPReceiver|posturl=http://host.exampleA.com:58080/amserver/SAMLPOSTProfileServlet|
issuer=host.exampleA.com:58080|hostlist=host.exampleA.com
Other keys that can also be used for
iplanet-am-saml-partner-urls include:
Version
Certalias
AuthType
authuser
authpassword
AttributeMapper
PartnerAccountMapper
SiteAttributeMapper
ActionMapper
nameidentifiermapper
NOTE
These
keys are case insensitive. Refer to the Sun
Java System Access Manager 7.1 Federation and SAML Guide
for details.
Import the file you just created using the following
command:
famadm add-attr-defs -s iPlanetAMSAMLService -t
global -u amadmin -f admin_password_file_name
--datafile ./partner.txt
To verify that the file was imported correctly, run
the following command on the hosted site to display the
information:
famadm get-attr-defs -s iPlanetAMSAMLService -t
global -u amadmin -f admin_password_file_name
-a iplanet-am-saml-partner-urls
In this case, the output will be:
iplanet-am-saml-partner-urls=target=iplanet.com|sourceid=VhqieajnHbbNX1usZkmnQLTxNeQ=|samlurl=http://host.exampleA.com:58080/amserver/SAMLAwareServlet|
soapurl=http://host.exampleA.com:58080/amserver/SAMLSOAPReceiver|posturl=http://host.exampleA.com:58080/amserver/SAMLPOSTProfileServlet|
issuer=host.exampleA.com:58080|hostlist=host.exampleA.com
Restart the hosted site's web container.
To access the SAML Artifact Profile or the SAML POST
Profile, login to the SAML source site and:
Access the SAML Artifact Profile at this URL:
protocol://hostname:port/uri/SAMLAwareServlet?TARGET=target_protocol://target_hostname:target_port/target_uri/UI/Login
You will be redirected to the target site without
authentication.
Access the SAML POST Profile at this URL:
protocol://hostname:port/uri/SAMLPOSTProfileServlet?TARGET=target_protocol://target_hostname:target_port/target_uri/UI/Login
You will be redirected to the
target site without authentication.
NOTE
You
must setup a keystore before accessing the SAML POST Profile.
See How do I setup a keystore? for
the procedure.
|
|
Q: How do I set up single
sign-on using the Liberty ID-FF and the famadm
command line interface?
To set up single sign-on using the Liberty ID-FF and the
famadm command line interface, repeat the following procedure
on both the identity provider instance and the service
provider instance of Open Federation.
Run the following command to create a circle of
trust.
famadm create-cot -t cot_name
-u amadmin -f admin_password_file_name
-e realm -c metadata_spec
where
|
|
cot_name
|
The name of the circle being created.
|
|
|
realm
|
The realm into which the circle will be put.
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Use one of the following procedures to generate the
standard and extended metadata files for a hosted identity
provider or a hosted service provider.
|
|
idp_entity_id
|
The provider's entity ID in the format:
protocol://host:port/deploy_uri
For example, http://happy.red.sun.com:80/openfm
|
|
|
hosted_standard_metadata
|
Path to, and name of, the standard metadata XML file
|
|
hosted_extended_metadata
|
Path to, and name of, the extended metadata XML file
|
|
idpMetaAlias
|
Specify a metaAlias for the hosted identity provider to be
created.
|
|
idpSCertAlias
|
Specify a signing certificate alias for the hosted
identity provider to be created.
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
|
|
sp_entity_id
|
The provider's entity ID in the format:
protocol://mhost:port/deploy_uri
For example, http://happy.red.sun.com:80/openfm
|
|
|
hosted_standard_metadata
|
Path to, and name of, the standard metadata XML file
|
|
hosted_extended_metadata
|
Path to, and name of, the extended metadata XML file
|
|
spMetaAlias
|
Specify a metaAlias for the hosted identity provider to be
created.
|
|
spSCertAlias
|
Specify a signing certificate alias for the hosted
identity provider to be created.
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Run the following command if a keystore has NOT
been set up:
famadm create-metadata-templ -y sp_entity_id
-u amadmin -f admin_password_file_name
-m hosted_standard_metadata
-x hosted_extended_metadata
-i spMetaAlias -c
metadata_spec
Use the procedures in the previous step to get the
metadata for the remote provider.
If the hosted provider is an identity provider, the
remote provider will be a service provider. Conversely, if
the hosted provider is a service provider, the remote
provider will be an identity provider.
NOTE
If
the remote provider is hosted on Sun Java System Federation
Manager, you can run the command documented previously on
the remote machine and copy the generated standard metadata
file to the hosted machine.
Run the following command to load hosted metadata.
famadm import-entity -u amadmin -f
admin_password_file_name -m
hosted_standard_metadata -x
hosted_extended_metadata -t
cot_name -c metadata_spec
The value of cot_name is the name of the circle of
trust created in the first step.
Run the following command to load remote metadata.
famadm import-entity -u amadmin -f
admin_password_file_name -m
remote_standard_metadata -t
cot_name -c metadata_spec
The value of cot_name is the name of the circle of
trust created in the first step.
Restart the web container(s).
|
|
Q: How do I setup single
sign-on using SAML v2 and the famadm
command line interface?
To accomplish single sign-on using SAML v2, follow this
procedure on the instances of Open Federation that will serve
as the identity provider and the service provider.
BEFORE YOU BEGIN
Decide
which instance you are configuring as the service provider
and as the identity provider.
Create the service provider metadata files.
Run the following command on the service provider
instance to create the service provider metadata files.
famadm create-metadata-templ -y sp_entity_id
-u amadmin -f admin_password_file_name
-m sp_standard_metadata -x
sp_extended_metadata -s
sp_meta_alias
Edit the default values of any attributes in the
sp_extended_metadata to reflect your deployment, if
required.
For example, attribute mappers might need to be changed.
Create the identity provider metadata files.
Run the following command on the identity provider
instance to create the Identity Provider metadata file.
famadm create-metadata-templ -y idp_entity_id
-u amadmin -f admin_password_file_name
-m idp_standard_metadata
-x idp_extended_metadata
-i idp_meta_alias
Edit the default values of any attributes in the
idp_extended_metadata to reflect your deployment, if
required.
For example, attribute mappers might need to be changed.
Import the metadata files into the service provider
instance.
Run the following command on the service provider
instance to create a circle of trust.
famadm create-cot -t cot_name
-u amadmin -f admin_password_file_name
Run the following command to import the service
provider metadata files into the circle just created.
famadm import-entity -u amadmin -f
admin_password_file_name
-m sp_standard_metadata -x
sp_extended_metadata -t
cot_name
Copy the standard identity provider metadata file
from the identity provider instance to the service provider
instance.
Run the following command to import the identity
provider metadata files to the service provider instance.
famadm import-entity -u amadmin -f
admin_password_file_name
-m idp_standard_metadata
-t cot_name
Run the following command to verify that the files
have been imported successfully.
famadm list-cot-members -u amadmin -f
admin_password_file_name
-t cot_name
This will display all members of the named circle of
trust. In this case, the hosted service provider and remote
identity provider are listed. You can also export the
metadata files for verification using the following
command:
famadm export-entity -u amadmin -f
admin_password_file_name
-y provider_entityid -m
provider_standard_metadata
-x provider_extended_metadata
Restart the Web Container.
Import the metadata files into the identity provider
instance.
Run the following command on the identity provider
instance to create a circle of trust.
famadm create-cot -t cot_name
-u amadmin -f admin_password_file_name
Run the following command to import the identity
provider metadata files.
famadm import-entity -u amadmin -f
admin_password_file_name
-m idp_standard_metadata
-x idp_extended_metadata
-t cot_name
Copy the standard service provider metadata file
from the service provider instance to the identity provider
instance.
Run the following command to import the service
provider metadata files to the identity provider instance.
famadm import-entity -u amadmin -f
admin_password_file_name
-m sp_standard_metadata -t
cot_name
Run the following command to verify that the files
have been imported successfully.
famadm list-cot-members -u amadmin -f
admin_password_file_name
-t cot_name
This will display all members of the named circle of
trust. In this case, the remote service provider and hosted
identity provider are listed. You can also export the
metadata files, using the following command, for
verification:
famadm export-entity -u amadmin -f
admin_password_file_name
-y provider_entityid -m
provider_standard_metadata
-x provider_extended_metadata
Restart the web container.
Verify single sign-on using one of the following
URLs:
To initiate single sign-on from the Service
Provider, access the following URL:
sp_protocol://sp_host:sp_port/sp_deploy_URI/spssoinit?metaAlias=spMetaAlias&idpEntityID=idp_entityID
To initiate single sign-on from the Identity
Provider, access the following URL:
sp_protocol://idp_host:idp_port/idp_deploy_URI/idpssoinit?metaAlias=idpMetaAlias&spEntityID=sp_entityID
Initially, you will need to authenticate to both the
service provider and the identity provider site to establish
federation. After that, you will be redirected to the remote
partner site without re-authentication.
|
|
Q: How do I turn on signing
and encryption using SAML v2?
The following procedure
illustrates how you turn on signing and encryption using SAML
v2.
BEFORE YOU BEGIN
Setup a keystore using
the keytool
command line interface on the machines acting as service
provider and identity provider. See How
do I setup a keystore? for details.
After
setting up the keystore, import the applicable signing and
encryption certificates into it, again, using the keytool
command line interface.
Run the following command on the service provider
machine to regenerate the service provider metadata
(including the newly added signing and encryption key
information).
famadm create-metadata-templ -y sp_entityid
-u amadmin -f admin_password_file_name
-m sp_standard_metadata -x
sp_extended_metadata -s
sp_metaAlias -a
sp_certalias -r
sp_enc_alias
Run the following command on the identity provider
machine to regenerate the identity provider metadata
(including the newly added signing and encryption key
information).
famadm create-metadata-templ -y idp_entityid
-u amadmin -f admin_password_file_name
-m idp_standard_metadata -x
idp_extended_metadata -i
idp_metaAlias -b
idp_certalias -g
idp_enc_alias
Modify the values of the following attributes in the
appropriate file to enable signing and encryption.
Identity Provider Standard Metadata Configuration
File Attribute
Service Provider Standard Metadata Configuration
File Attributes
AuthnRequestsSigned
WantAssertionsSigned
Identity Provider Extended Metadata Configuration
File Attributes
Service Provider Extended Metadata Configuration
File Attributes
NOTE
To
use the SAML POST profile, signing must be enabled. It is
enabled automatically when using the SAML Artifact profile.
Use the following procedure to remove the old metadata
from, and import the new metadata to, the service provider
machine:
Run the following command to remove the old hosted
service provider metadata:
famadm delete-entity -y sp_entityid
-u amadmin -f admin_password_file_name
Run the following command to remove the old remote
identity provider metadata:
famadm delete-entity -y idp_entityid
-u amadmin -f admin_password_file_name
Run the following command to import the new hosted
service provider metadata:
famadm import-entity -u amadmin -f
admin_password_file_name
-m sp_standard_metadata -x
sp_extended_metadata -t
cot_name
Copy the new standard and extended metadata files
from the remote identity provider machine to the hosted
service provider machine.
Change the hosted="1"
attribute to hosted="0" in the
extended metadata file that was just copied from the remote
identity provider to the service provider side.
Run the following command to import the newly
modified remote identity provider metadata:
famadm import-entity -u amadmin -f
admin_password_file_name
-m idp_standard_metadata
-x idp_extended_metadata
-t cot_name
Use the following procedure to remove the old
metadata from, and import the new metadata to, the identity
provider machine:
Run the following command to remove the old hosted
identity provider metadata:
famadm delete-entity -y idp_entityid
-u amadmin -f admin_password_file_name
Run the following command to remove the old remote
service provider metadata:
famadm delete-entity -y sp_entityid
-u amadmin -f admin_password_file_name
Run the following command to import the new hosted
identity provider metadata:
famadm import-entity -u amadmin -f
admin_password_file_name
-m idp_standard_metadata
-x idp_extended_metadata
-t cot_name
Copy the new standard and extended metadata files
from the remote service provider machine to the hosted
identity provider machine.
Change the hosted="1"
attribute to hosted="0" in the
extended metadata file that was just copied from the remote
service provider to the identity provider side.
Run the following command to import the newly
modified remote service provider metadata:
famadm import-entity -u amadmin -f
admin_password_file_name
-m sp_standard_metadata -x
sp_extended_metadata -t
cot_name
Restart the web containers hosting both providers.
Verify single sign-on using one of the following
URLs:
To initiate single sign-on from the service
provider, access the following URL:
sp_protocol://sp_host:sp_port/sp_deploy_URI/spssoinit?metaAlias=spMetaAlias&idpEntityID=idp_entityID
To initiate single sign-on from the identity
provider, access the following URL:
idp_protocol://idp_host:idp_port/idp_deploy_URI/idpssoinit?metaAlias=idpMetaAlias&spEntityID=sp_entityID
Initially, you will need to authenticate to both the
service provider and the identity provider site to establish
federation. After that, you will be redirected to the remote
partner site without re-authentication.
|
|
Q: How do I setup
authentication using the Authentication Web Service?
The following procedure illustrates how to setup for
authentication using the Authentication Web Service.
Run the following command to get the current value
for the defined Authentication Web Service attribute:
famadm get-attr-defs -s
sunIdentityServerAuthnService -u amadmin -f
admin_password_file_name -t
Global -a MechanismHandlerList
From the previous command's output, save the entire
line beginning with MechanismHandlerList= to a
file.
In this case, we will call the file datafile.
Edit datafile to change the existing
handler class or add a new one.
The syntax of the value of the MechanismHandlerList
attribute is
key=mechanism_name|class=handler_class_for_mechanism_specified_in_key.
You can change this value by modifying the existing line or
adding a new one.
Run the following command to change the value of
MechanismHandlerList:
famadm set-attr-defs -s
sunIdentityServerAuthnService -u amadmin -f
admin_password_file_name -t
Global -D datafile
|
|
Q: How do I setup the
Discovery Service to issue X509, Bearer, and SAML tokens?
The following procedure illustrates how to configure the
Discovery Service to issue x509, Bearer, and SAML tokens.
BEFORE YOU BEGIN
Setup
an identity provider, a service provider, and a keystore on
each by following the procedures documented in How
do I set up and run the Liberty ID-FF sample? and How
do I setup a keystore?, respectively.
On the identity provider machine:
Run the following command to get the current value
for the defined Discovery Service attribute:
famadm get-attr-defs -s
sunIdentityServerDiscoveryService -u amadmin -f
admin_password_file_name
-t Global -a sunIdentityServerBootstrappingDiscoEntry
From the previous step's output, save the entire
line beginning with
sunIdentityServerBootstrappingDiscoEntry= to a
file.
In this case, we will call the file datafile.
Edit datafile to setup for the specific
token:
For SAML tokens, replace the following:
<SecurityMechID>urn:liberty:security:2003-08:null:null</SecurityMechID>
with
<SecurityMechID>urn:liberty:security:2003-08:null:SAML</SecurityMechID>
and
</ResourceOffering></DiscoEntry>
with
</ResourceOffering><AuthorizeRequester
xmlns="urn:liberty:disco:2003-08"/></DiscoEntry>
For X509 tokens, replace the following:
<SecurityMechID>urn:liberty:security:2003-08:null:null</SecurityMechID>
with
<SecurityMechID>urn:liberty:security:2003-08:null:X509</SecurityMechID>
For Bearer tokens, replace the following:
<SecurityMechID>urn:liberty:security:2003-08:null:null</SecurityMechID>
with
<SecurityMechID>urn:liberty:security:2004-04:null:Bearer</SecurityMechID>
and
</ResourceOffering></DiscoEntry>
with
</ResourceOffering><AuthenticateRequester
xmlns="urn:liberty:disco:2003-08"/><GenerateBearerToken
xmlns="urn:liberty:disco:2004-04"/></DiscoEntry>
Run the following command (using as datafile
input) to change the values of the attributes:
famadm set-attr-defs -s
sunIdentityServerDiscoveryService -u amadmin -f
admin_password_file_name
-t Global -D datafile
Logon to console as top
level administrator. Goto Configuration -> Global ->
Liberty ID-WSF Security Service, edit the values of the
following properties:
Trusted Authority signing certificate alias
to test
Default WSC certificate alias to test
Trusted CA signing certificate aliases
to test
test is the sample value.
Run the following command to delete the identity
provider:
famadm delete-entity -y idp_entityid
-u amadmin -f admin_password_file_name
-c metadata_spec
where
|
|
idp_entityid
|
The provider's entity ID in the format:
protocol://host:port/deploy_uri
For example, http://happy.red.sun.com:80/openfm
|
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Run the following command to delete the remote
service provider:
famadm delete-entity -y remote_sp_entityid
-u amadmin -f admin_password_file_name
-c metadata_spec
where
|
|
remote_sp_entityid
|
The provider's entity ID in the format:
protocol://host:port/deploy_uri
For example, http://happy.red.sun.com:80/openfm
|
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Run the following command to create new standard and
extended metadata files for the identity provider:
famadm create-metadata-templ -u amadmin -f
admin_password_file_name
-y idp_entityid -m
standard_metadata -x
extended_metadata -i
idpMetaAlias -b
idpSCertAlias -c
metadata_spec
where
|
|
idp_entityid
|
The provider's entity ID in the format:
protocol://host:port/deploy_uri
For example, http://happy.red.sun.com:80/openfm
|
|
|
standard_metadata
|
Path to, and name of, the standard metadata XML file
|
|
extended_metadata
|
Path to, and name of, the extended metadata XML file
|
|
idpMetaAlias
|
Specify a metaAlias for the identity provider being
created.
|
|
idpSCertAlias
|
Specify a signing certificate alias for the identity
provider being created.
|
|
cot_name
|
The name of the circle into which the files are being
imported; in this case, sampleidffcot.
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Run the following command to import the new metadata
files into the defined circle:
famadm import-entity -u amadmin -f
admin_password_file_name
-m standard_metadata -x
extended_metadata -t
cot_name -c metadata_spec
where
|
|
standard_metadata
|
Path to, and name of, the standard metadata XML file
|
|
|
extended_metadata
|
Path to, and name of, the extended metadata XML file
|
|
cot_name
|
The name of the circle into which the files are being
imported; in this case, sampleidffcot.
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Copy the standard metadata file from the service
provider (created during the service provider procedure
documented in the next step) to the /tmp
directory on this machine.
See On the service provider machine.
Run the following command to import the standard
metadata file for the service provider into the defined
circle:
famadm import-entity -u amadmin -f
admin_password_file_name
-m standard_metadata -t
cot_name -c metadata_spec
where
|
|
standard_metadata
|
Path to, and name of, the standard metadata XML file
|
|
|
cot_name
|
The name of the circle into which the files are being
imported; in this case, sampleidffcot.
|
|
metadata_spec
|
Either idff or saml2; in this
case, idff.
|
Restart the web container.
On the service provider machine:
Run the following command to delete the service
provider:
famadm delete-entity -y sp_entityid
-u amadmin -f admin_password_file_name
-c metadata_spec
Run the following command to delete the remote
identity provider:
famadm delete-entity -y idp_entityid
-u amadmin -f admin_password_file_name
-c metadata_spec
Run the following command to create new standard and
extended metadata files for the service provider:
famadm create-metadata-templ -u amadmin -f
admin_password_file_name
-y sp_entityid -m
standard_metadata -x
extended_metadata -s
spMetaAlias -a
spSCertAlias -c
metadata_spec
Run the following command to import the new metadata
files into the defined circle:
famadm import-entity -u amadmin -f
admin_password_file_name
-m standard_metadata -x
extended_metadata -t
cot_name -c metadata_spec
Copy the standard metadata file from the identity
provider (created during the identity provider procedure
documented in the previous step) to the /tmp
directory on this machine.
See On the identity provider machine.
Run the following command to import the new standard
metadata file for the identity provider into the defined
entity:
famadm import-entity -u amadmin -f
admin_password_file_name
-m standard_metadata -t
cot_name -c metadata_spec
Logon to console as top level administrator. Goto
Configuration -> Global -> Liberty ID-WSF Security
Service, edit the values of the Default WSC
certificate alias field to correct certificate
alias.
The certificate alias will be used to generate
X509 tokens for the web service client.
Restart the web container.
|
|
Q: How do I setup a profile
for Policy Agents 3.0 using famadm
CLI?
See the OpenSSO
wiki for this procedure.
|
|
Q: How do I setup the
OpenSSO configuration data store for failover?
See DocTeger's blog entry The
OpenSSO Bootstrap File Deconstructed for this procedure.
|
|
Q: How do I deploy OpenSSO on Websphere 6.1 for AIX?
See DocTeger's blog entry Deploying OpenSSO on WebSphere 6.1 AIX for this procedure.
|
|
Q: How do I configure for authentication on OpenSSO using an identity web service?
See the first part of software architect Aravindan Ranganathan's article Securing Applications with Identity Services, Part 1: Authentication for this procedure.
|
|
Q: How do I configure for authorization on OpenSSO using an identity web service?
See the second part of software architect Aravindan Ranganathan's article Securing Applications with Identity Services, Part 2: Authorization for this procedure.
|
|
Q: How do I setup a SAMLv2 IDP Proxy?
See DocTeger's blog entry Setting Up a SAMLv2 IDP Proxy for this procedure. |
|
Q: How do I configure OpenSSO without using the configurator.jsp?
See DocTeger's blog entry Configuring OpenSSO without configurator.jsp for this procedure. Be sure to read the first comment for special instructions if configuring using the Linux or Windows operating environments. |
