No edit summary |
No edit summary |
||
| (6 intermediate revisions by 3 users not shown) | |||
| Line 11: | Line 11: | ||
First, install the IPA-client packages: | First, install the IPA-client packages: | ||
# | # dnf install freeipa-client | ||
If you installed IPA with DNS then configure /etc/resolv.conf to point to it | If you installed IPA with DNS then configure /etc/resolv.conf to point to it | ||
| Line 25: | Line 25: | ||
Install the Ipsilon packages: | Install the Ipsilon packages: | ||
# | # dnf install ipsilon-tools ipsilon-saml2 | ||
Configure the SP: | Configure the SP: | ||
| Line 31: | Line 31: | ||
# ipsilon-client-install --saml-idp-metadata https://idp.example.com/idp/saml2/metadata --saml-auth /sp | # ipsilon-client-install --saml-idp-metadata https://idp.example.com/idp/saml2/metadata --saml-auth /sp | ||
The metadata will be downloaded from your IDP and since the IDP is on our IPA master, we use that | The metadata will be downloaded from your IDP and since the IDP is on our IPA master, we use that hostname. | ||
Get the metadata from the SP: | We need to enable port 443 in the firewall: | ||
# firewall-cmd --permanent --add-port=443/tcp | |||
# firewall-cmd --permanent --add-port=80/tcp | |||
# systemctl restart firewalld | |||
Enable and restart Apache on the SP | |||
# systemctl enable httpd.service | |||
# systemctl restart httpd.service | |||
Get the metadata from the SP (the path may need to be adjusted to match the hostname of your SP): | |||
# cat /etc/httpd/saml2/sp.example.com/metadata.xml | # cat /etc/httpd/saml2/sp.example.com/metadata.xml | ||
Or you can also browse to https://sp.example.com/saml2/metadata and download the file. This second option | |||
will also verify that your firewall is properly configured to let HTTP/HTTPS communications through and | |||
you have valid X509 certs. | |||
Add the SP to the IDP: | Add the SP to the IDP: | ||
# On the IDP launch firefox and authenticate to the IDP as the admin user, https://idp.example.com/idp/ | # On the IDP launch firefox and authenticate to the IDP as the admin user, https://idp.example.com/idp/ | ||
# Click on ''Administration''. | |||
# Select Identity Providers -> SAML2 -> Manage -> Add New | |||
# Fill in the ''Name'' field. The name you give the SP isn't important. | # Fill in the ''Name'' field. The name you give the SP isn't important. | ||
# Paste the SP metadata you previously obtained into the ''Metadata Text'' field on the form. | # Paste the SP metadata you previously obtained into the ''Metadata Text'' field on the form. | ||
# Click the ''Save'' button. | # Click the ''Save'' button. | ||
==== Create Content ==== | ==== Create Content ==== | ||
| Line 70: | Line 70: | ||
# mkdir /var/www/html/sp | # mkdir /var/www/html/sp | ||
Create /var/www/html/sp/index.html with these contents: | Create /var/www/html/sp/index.html with these contents ('''be sure to modify the hostname in the link to match the hostname of your SP'''): | ||
<nowiki><html> | <nowiki><html> | ||
| Line 95: | Line 95: | ||
We'll verify that everything is working in the next test case. | We'll verify that everything is working in the next test case. | ||
|results= | |results= | ||
Latest revision as of 16:43, 12 March 2015
Description
Service Provider Installation testing.
Setup
- For testing purposes, a machine (or VM) with 1GB of RAM and 4 GB of free disk space for binaries, data and logs should be plenty.
- The machine needs to be enrolled as an IPA client.
How to test
Installation
First, install the IPA-client packages:
# dnf install freeipa-client
If you installed IPA with DNS then configure /etc/resolv.conf to point to it
nameserver xx.xx.xx.xx
Enroll the machine against your IPA master
# ipa-client-install
If you are using the IPA DNS server then it should discover the IPA master and prompt you for credentials to enroll. Use admin and the admin password selected during IPA install.
Install the Ipsilon packages:
# dnf install ipsilon-tools ipsilon-saml2
Configure the SP:
# ipsilon-client-install --saml-idp-metadata https://idp.example.com/idp/saml2/metadata --saml-auth /sp
The metadata will be downloaded from your IDP and since the IDP is on our IPA master, we use that hostname.
We need to enable port 443 in the firewall:
# firewall-cmd --permanent --add-port=443/tcp # firewall-cmd --permanent --add-port=80/tcp # systemctl restart firewalld
Enable and restart Apache on the SP
# systemctl enable httpd.service # systemctl restart httpd.service
Get the metadata from the SP (the path may need to be adjusted to match the hostname of your SP):
# cat /etc/httpd/saml2/sp.example.com/metadata.xml
Or you can also browse to https://sp.example.com/saml2/metadata and download the file. This second option will also verify that your firewall is properly configured to let HTTP/HTTPS communications through and you have valid X509 certs.
Add the SP to the IDP:
- On the IDP launch firefox and authenticate to the IDP as the admin user, https://idp.example.com/idp/
- Click on Administration.
- Select Identity Providers -> SAML2 -> Manage -> Add New
- Fill in the Name field. The name you give the SP isn't important.
- Paste the SP metadata you previously obtained into the Metadata Text field on the form.
- Click the Save button.
Create Content
The installer automatically configures Apache to protect /sp/ so all we need to do is create the directory and add some content.
Create the secure directory and add some content
# mkdir /var/www/html/sp
Create /var/www/html/sp/index.html with these contents (be sure to modify the hostname in the link to match the hostname of your SP):
<html> <p> Congratulations, you're authenticated! </p> <p> <a href="/saml2/logout?ReturnTo=https://sp.example.com/logged_out.html">Log out</a> </p> </html>
Create /var/www/html/logged_out.html (note that this isn't in the sp directory) with these contents:
<html> <title>Logout</title> <p> You've been logged out! </p> <p> Now try to <a href="/sp/">log back in</a> </p> </html>
We'll verify that everything is working in the next test case.
Expected Results
All the test steps should end with the specified results.