From Fedora Project Wiki

No edit summary
No edit summary
Line 77: Line 77:
</p>
</p>
<p>
<p>
<a href="/saml2/logout?ReturnTo=https://sp.example.com.com/logged_out.html">Log out</a>
<a href="/saml2/logout?ReturnTo=https://sp.example.com/logged_out.html">Log out</a>
</p>
</p>
</html></nowiki>
</html></nowiki>


Create /var/www/html/logged_out.html with these contents:
Create /var/www/html/logged_out.html (note that this isn't in the sp directory) with these contents:


  <nowiki><html>
  <nowiki><html>

Revision as of 23:51, 11 March 2015

Description

Service Provider Installation testing.

Setup

  1. For testing purposes, a machine (or VM) with 1GB of RAM and 4 GB of free disk space for binaries, data and logs should be plenty.
  2. The machine needs to be enrolled as an IPA client.

How to test

Installation

First, install the IPA-client packages: 

# yum install freeipa-client

If you installed IPA with DNS then configure /etc/resolv.conf to point to it 

nameserver xx.xx.xx.xx

Enroll the machine against your IPA master 

# ipa-client-install

If you are using the IPA DNS server then it should discover the IPA master and prompt you for credentials to enroll. Use admin and the admin password selected during IPA install.

Install the Ipsilon packages: 

# yum install ipsilon-tools ipsilon-saml2

Configure the SP: 

# ipsilon-client-install --saml-idp-metadata https://idp.example.com/idp/saml2/metadata --saml-auth /sp

The metadata will be downloaded from your IDP and since the IDP is on our IPA master, we use that name.

Get the metadata from the SP: 

# cat /etc/httpd/saml2/sp.example.com/metadata.xml

Add the SP to the IDP:

  1. On the IDP launch firefox and authenticate to the IDP as the admin user, https://idp.example.com/idp/
  2. Fill in the Name field. The name you give the SP isn't important.
  3. Select Identity Providers -> SAML2 -> Manage -> Add New
  4. Paste the SP metadata you previously obtained into the Metadata Text field on the form.
  5. Click the Save button.

Configure Apache to tell the browser to never cache the contents of /sp:

  1. Edit /etc/httpd/conf.d/ipsilon-saml.conf
  2. Find the Location section for /sp
  3. Add Header append Cache-Control "no-cache"

It should look like: 

<Location /sp>
    Header append Cache-Control "no-cache"
    MellonEnable "auth"
</Location>

Restart Apache on the SP 

# systemctl restart httpd.service

Create Content

The installer automatically configures Apache to protect /sp/ so all we need to do is create the directory and add some content.

Create the secure directory and add some content 

# mkdir /var/www/html/sp

Create /var/www/html/sp/index.html with these contents: 

<html>
<p>
Congratulations, you're authenticated!
</p>
<p>
<a href="/saml2/logout?ReturnTo=https://sp.example.com/logged_out.html">Log out</a>
</p>
</html>

Create /var/www/html/logged_out.html (note that this isn't in the sp directory) with these contents: 

<html>
<title>Logout</title>
<p>
You've been logged out!
</p>
<p>
Now try to <a href="/sp/">log back in</a>
</p>
</html>

We'll verify that everything is working in the next test case.

Configure Firewall

We need to enable port 443 in the firewall: 

# firewall-cmd --permanent --add-port=443/tcp
# systemctl restart firewalld

Expected Results

All the test steps should end with the specified results.

Retrieved from "https://fedoraproject.org/w/index.php?title=QA:Testcase_ipsilonv1_sp1_install&oldid=406309"