Differenze tra le versioni di "Metadata"

Da WIKI IDEM GARR.
Jump to navigation Jump to search
 
(24 versioni intermedie di 4 utenti non mostrate)
Riga 1: Riga 1:
===Flussi di Metadata===
+
{{deprecated|1=Il Servizio IDEM ha implementato un nuovo sistema di distribuzione dei metadata basato su MDQ che riduce drasticamente l'occupazione di memoria e i tempi di caricamento. Vedi https://mdx.idem.garr.it per le istruzioni di configurazione.}}
  
 +
===Aggregati di metadata===
 +
{{Deprecated-small|NOTA BENE: Gli aggregati di metadata sono da considerare deprecati e da utilizzare solo per sistemi che non supportano MDQ (vedi https://mdx.idem.garr.it).}}
 
'''IDEM Produzione''':
 
'''IDEM Produzione''':
  http://md.idem.garr.it/metadata/idem-metadata-sha256.xml
+
  https://md.idem.garr.it/metadata/idem-metadata-sha256.xml
  
 
'''eduGAIN e IDEM Produzione''':
 
'''eduGAIN e IDEM Produzione''':
  http://md.idem.garr.it/metadata/edugain2idem-metadata-sha256.xml
+
  https://md.idem.garr.it/metadata/edugain2idem-metadata-sha256.xml
  
 
'''IDEM Test''':
 
'''IDEM Test''':
  http://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml
+
  https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml
  
 
===Certificato===
 
===Certificato===
Tutti i flussi di metadata della Federazione IDEM sono firmati fino al 30 Novembre 2021 con il seguente certificato.
+
Tutti i flussi di metadata della Federazione IDEM sono firmati con il seguente certificato:
https://md.idem.garr.it/certs/idem-signer-20220121.pem
+
https://md.idem.garr.it/certs/idem-signer-legacy.pem
Fingerprint sha1 del certificato:  
+
 
D1:68:6C:32:A4:E3:D4:FE:47:17:58:E7:15:FC:77:A8:44:D8:40:4D
+
1. Recuperare il certificato della Federazione:
 +
 
 +
*<code>wget https://md.idem.garr.it/certs/idem-signer-legacy.pem -O /tmp/idem-signer-legacy.pem</code>
 +
 
 +
2. Controllare la validità del certificato:  
 +
 
 +
*Eseguire il comando: <code>openssl x509 -in /tmp/idem-signer-legacy.pem -fingerprint -sha1 -noout</code><br />deve restituire: <code>SHA1 Fingerprint=7F:62:60:A1:CE:2B:11:B8:D9:35:CF:7F:04:37:3E:81:5F:B4:DE:86</code>
  
 
===Istruzioni di configurazione===
 
===Istruzioni di configurazione===
 +
{{Deprecated-small|NOTA BENE: Gli aggregati di metadata sono da considerare deprecati e da utilizzare solo per sistemi che non supportano MDQ (vedi https://mdx.idem.garr.it).}}
 
Le istruzioni sono relative alla sola configurazione dei metadata, per guide complete sull'installazione e la configurazione di IdP e SP andare alla sezione [[Guide]].  
 
Le istruzioni sono relative alla sola configurazione dei metadata, per guide complete sull'installazione e la configurazione di IdP e SP andare alla sezione [[Guide]].  
  
====Shibboleth Identity Provider 3.x+ & 4.x+====
+
====Shibboleth Identity Provider 3.x+ & 4.0:====
  
*scaricare il certificato da https://md.idem.garr.it/certs/idem-signer-20220121.pem
+
*Spostare il certificato in<code>/opt/shibboleth-idp/credentials</code>.
 +
*configurare certificato e flusso di metadata desiderato in <code>/opt/shibboleth-idp/conf/metadata-providers.xml,</code> ad es. per il flusso '''IDEM Test''':
 +
<syntaxhighlight lang="xml">
 +
<MetadataProvider id="URLMD-IDEM-Federation"
 +
                  xsi:type="FileBackedHTTPMetadataProvider"
 +
                  backingFile="%{idp.home}/metadata/idem-test-metadata-sha256.xml"
 +
                  metadataURL="https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml">
 +
  <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
 +
                  certificateFile="%{idp.home}/credentials/idem-signer-legacy.pem"/>
 +
  <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P10D"/>
 +
  <MetadataFilter xsi:type="EntityRoleWhiteList">
 +
      <RetainedRole>md:SPSSODescriptor</RetainedRole>
 +
  </MetadataFilter>
 +
</MetadataProvider>
 +
</syntaxhighlight>
 +
 
 +
====Shibboleth Identity Provider 4.1+:====
 +
 
 +
*scaricare il certificato da <nowiki>https://md.idem.garr.it/certs/idem-signer-legacy.pem</nowiki>
 
*salvarlo in una directory accessibile a Shibboleth, ad es. <code>/opt/shibboleth-idp/credentials</code>.
 
*salvarlo in una directory accessibile a Shibboleth, ad es. <code>/opt/shibboleth-idp/credentials</code>.
 
*configurare certificato e flusso di metadata desiderato in <code>/opt/shibboleth-idp/conf/metadata-providers.xml,</code> ad es. per il flusso '''IDEM Test''':
 
*configurare certificato e flusso di metadata desiderato in <code>/opt/shibboleth-idp/conf/metadata-providers.xml,</code> ad es. per il flusso '''IDEM Test''':
Riga 28: Riga 55:
 
                   xsi:type="FileBackedHTTPMetadataProvider"
 
                   xsi:type="FileBackedHTTPMetadataProvider"
 
                   backingFile="%{idp.home}/metadata/idem-test-metadata-sha256.xml"  
 
                   backingFile="%{idp.home}/metadata/idem-test-metadata-sha256.xml"  
                   metadataURL="http://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml">  
+
                   metadataURL="https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml">  
 
   <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"  
 
   <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"  
                   certificateFile="${idp.home}/credentials/idem-signer-20220121.pem"/>
+
                   certificateFile="%{idp.home}/credentials/idem-signer-legacy.pem"/>
 
   <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P10D"/>
 
   <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P10D"/>
   <MetadataFilter xsi:type="EntityRoleWhiteList">  
+
   <MetadataFilter xsi:type="EntityRole">  
 
       <RetainedRole>md:SPSSODescriptor</RetainedRole>
 
       <RetainedRole>md:SPSSODescriptor</RetainedRole>
 
   </MetadataFilter>
 
   </MetadataFilter>
Riga 40: Riga 67:
 
====Shibboleth Service Provider 2.5+====
 
====Shibboleth Service Provider 2.5+====
  
*scaricare il certificato da https://md.idem.garr.it/certs/idem-signer-20220121.pem
+
*Spostare il certificato in <code>/etc/shibboleth</code>.
*salvarlo in una directory accessibile a <code>shibd</code>, ad es. <code>/etc/shibboleth</code>.
 
 
*configurare certificato e flusso di metadata desiderato in <code>shibboleth2.xml</code>, ad es. per il flusso '''IDEM Produzione''':
 
*configurare certificato e flusso di metadata desiderato in <code>shibboleth2.xml</code>, ad es. per il flusso '''IDEM Produzione''':
 
<syntaxhighlight lang="xml">
 
<syntaxhighlight lang="xml">
 
<MetadataProvider type="XML"  
 
<MetadataProvider type="XML"  
                   uri="http://md.idem.garr.it/metadata/idem-metadata-sha256.xml"  
+
                   uri="https://md.idem.garr.it/metadata/idem-metadata-sha256.xml"  
 
                   backingFilePath="idem-metadata-sha256.xml" reloadInterval="7200">
 
                   backingFilePath="idem-metadata-sha256.xml" reloadInterval="7200">
 
   <MetadataFilter type="RequireValidUntil" maxValidityInterval="864000" />
 
   <MetadataFilter type="RequireValidUntil" maxValidityInterval="864000" />
   <MetadataFilter type="Signature" certificate="/etc/shibboleth/idem-signer-20220121.pem"/>
+
   <MetadataFilter type="Signature" certificate="/etc/shibboleth/idem-signer-legacy.pem"/>
 
</MetadataProvider>
 
</MetadataProvider>
 
</syntaxhighlight>
 
</syntaxhighlight>
Riga 54: Riga 80:
 
====Shibboleth Service Provider 3.x+====
 
====Shibboleth Service Provider 3.x+====
  
*scaricare il certificato da https://md.idem.garr.it/certs/idem-signer-20220121.pem
+
*Spostare il certificato in <code>/etc/shibboleth</code>.
*salvarlo in una directory accessibile a <code>shibd</code>, ad es. <code>/etc/shibboleth</code>.
 
 
*configurare certificato e flusso di metadata desiderato in <code>shibboleth2.xml</code>, ad es. per il flusso '''eduGAIN e IDEM Produzione''':
 
*configurare certificato e flusso di metadata desiderato in <code>shibboleth2.xml</code>, ad es. per il flusso '''eduGAIN e IDEM Produzione''':
 
<syntaxhighlight lang="xml">
 
<syntaxhighlight lang="xml">
 
<MetadataProvider type="XML"  
 
<MetadataProvider type="XML"  
                   url="http://md.idem.garr.it/metadata/edugain2idem-metadata-sha256.xml"  
+
                   url="https://md.idem.garr.it/metadata/edugain2idem-metadata-sha256.xml"  
 
                   backingFilePath="edugain2idem-metadata-sha256.xml"
 
                   backingFilePath="edugain2idem-metadata-sha256.xml"
 
                   maxRefreshDelay="7200">
 
                   maxRefreshDelay="7200">
 
     <MetadataFilter type="RequireValidUntil" maxValidityInterval="864000" />
 
     <MetadataFilter type="RequireValidUntil" maxValidityInterval="864000" />
     <MetadataFilter type="Signature" certificate="/etc/shibboleth/idem-signer-20220121.pem"/>
+
     <MetadataFilter type="Signature" certificate="/etc/shibboleth/idem-signer-legacy.pem"/>
 
</MetadataProvider>
 
</MetadataProvider>
 
</syntaxhighlight>
 
</syntaxhighlight>
  
====simpleSAMLphp Identity Provider 1.4+====
+
====simpleSAMLphp Identity Provider 1.14+====
  
*scaricare il certificato da https://md.idem.garr.it/certs/idem-signer-20220121.pem
+
*Spostare il certificato in <code>/var/simplesamlphp/cert/</code>
*salvarlo in <code>/var/simplesamlphp/cert/federation-cert.pem</code>
 
 
*configurare certificato e flusso di metadata desiderato in <code>/var/simplesamlphp/config/config-metarefresh.php</code>, ad es. per il flusso '''IDEM Test''':
 
*configurare certificato e flusso di metadata desiderato in <code>/var/simplesamlphp/config/config-metarefresh.php</code>, ad es. per il flusso '''IDEM Test''':
 
<syntaxhighlight lang="php">
 
<syntaxhighlight lang="php">
Riga 81: Riga 105:
 
         'sources' => [
 
         'sources' => [
 
                       [
 
                       [
                         'src' => 'http://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml',
+
                         'src' => 'https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml',
 
                         'certificates' => [
 
                         'certificates' => [
                           '/var/simplesamlphp/cert/federation-cert.pem',
+
                           '/var/simplesamlphp/cert/idem-signer-legacy.pem',
 
                         ],
 
                         ],
 
                         'template' => [
 
                         'template' => [
Riga 104: Riga 128:
 
</syntaxhighlight>
 
</syntaxhighlight>
  
====simpleSAMLphp Service Provider 1.4+====
+
====simpleSAMLphp Service Provider 1.14+====
  
*scaricare il certificato da https://md.idem.garr.it/certs/idem-signer-20220121.pem
+
*Spostare il certificato in <code>/var/simplesamlphp/cert/</code>
*salvarlo in <code>/var/simplesamlphp/cert/federation-cert.pem</code>
 
 
*configurare certificato e flusso di metadata desiderato in <code>/var/simplesamlphp/config/config-metarefresh.php</code>, ad es. per il flusso '''IDEM Produzione''':
 
*configurare certificato e flusso di metadata desiderato in <code>/var/simplesamlphp/config/config-metarefresh.php</code>, ad es. per il flusso '''IDEM Produzione''':
 
<syntaxhighlight lang="php">
 
<syntaxhighlight lang="php">
Riga 118: Riga 141:
 
         'sources' => [
 
         'sources' => [
 
                       [
 
                       [
                         'src' => 'http://md.idem.garr.it/metadata/idem-metadata-sha256.xml',
+
                         'src' => 'https://md.idem.garr.it/metadata/idem-metadata-sha256.xml',
 
                         'certificates' => [
 
                         'certificates' => [
                           '/var/simplesamlphp/cert/federation-cert.pem',
+
                           '/var/simplesamlphp/cert/idem-signer-legacy.pem',
 
                         ],
 
                         ],
 
                         'template' => [
 
                         'template' => [
Riga 140: Riga 163:
 
];
 
];
 
</syntaxhighlight>
 
</syntaxhighlight>
 +
====Altri software (ADFS Toolkit, SaToSa, ecc.)====
 +
Scaricare e verificare il certificato come indicato nelle istruzioni generali. Per la configurazione dei flussi di metadata, riferirsi alle istruzioni di configurazione proprie del software utilizzato.
 +
 +
<br />
 +
 +
==English version==
 +
<blockquote>{{Deprecated|The IDEM Service has implemented a new metadata distribution system based on the MDQ protocol that drastically reduces memory consumption and loading times. Check https://mdx.idem.garr.it for the configuration instructions.}}</blockquote>
 +
 +
===Metadata aggregates===
 +
<blockquote>WARNING: Metadata aggregates are depreacted and to be used only for systems that do not support MDQ (check <nowiki>https://mdx.idem.garr.it</nowiki>).</blockquote>'''IDEM Production''':
 +
<nowiki>https://md.idem.garr.it/metadata/idem-metadata-sha256.xml</nowiki>
 +
'''eduGAIN and IDEM Production:'''
 +
<nowiki>https://md.idem.garr.it/metadata/edugain2idem-metadata-sha256.xml</nowiki>
 +
'''IDEM Test''':
 +
<nowiki>https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml</nowiki>
 +
 +
===Certificate===
 +
All the IDEM Federation metadata flows are signed with the following certificate:
 +
<nowiki>https://md.idem.garr.it/certs/idem-signer-legacy.pem</nowiki>
 +
1. Download the Federation certificate:
 +
 +
*<code>wget <nowiki>https://md.idem.garr.it/certs/idem-signer-legacy.pem</nowiki> -O /tmp/idem-signer-legacy.pem</code>
 +
 +
2. Verifiy the certificate:
 +
 +
*Run the command: <code>openssl x509 -in /tmp/idem-signer-legacy.pem -fingerprint -sha1 -noout</code>  expected value: <code>SHA1 Fingerprint=7F:62:60:A1:CE:2B:11:B8:D9:35:CF:7F:04:37:3E:81:5F:B4:DE:86</code>
 +
 +
===Configuration instruction===
 +
<blockquote>WARNING: Metadata aggregates are depreacted and to be used only for systems that do not support MDQ (check <nowiki>https://mdx.idem.garr.it</nowiki>).</blockquote>For full installation guide see [[Guide]].
 +
 +
====Shibboleth Identity Provider 3.x+ & 4.0:====
 +
 +
*Move the certificate to <code>/opt/shibboleth-idp/credentials</code>.
 +
*Configure the certificate and the desired metadata flow in <code>/opt/shibboleth-idp/conf/metadata-providers.xml,</code> for '''IDEM Test''' flow:
 +
 +
<MetadataProvider id="URLMD-IDEM-Federation"
 +
                  xsi:type="FileBackedHTTPMetadataProvider"
 +
                  backingFile="%{idp.home}/metadata/idem-test-metadata-sha256.xml"
 +
                  metadataURL="<nowiki>https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml</nowiki>">
 +
    <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
 +
                    certificateFile="%{idp.home}/credentials/idem-signer-legacy.pem"/>
 +
    <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P10D"/>
 +
    <MetadataFilter xsi:type="EntityRoleWhiteList">
 +
      <RetainedRole>md:SPSSODescriptor</RetainedRole>
 +
    </MetadataFilter>
 +
</MetadataProvider>
 +
 +
====Shibboleth Identity Provider 4.1+:====
 +
 +
*Move the certificate to <code>/opt/shibboleth-idp/credentials</code>.
 +
*Configure the certificate and the desired metadata flow in <code>/opt/shibboleth-idp/conf/metadata-providers.xml,</code> for '''IDEM Test''' flow::
 +
 +
<MetadataProvider id="URLMD-IDEM-Federation"
 +
                  xsi:type="FileBackedHTTPMetadataProvider"
 +
                  backingFile="%{idp.home}/metadata/idem-test-metadata-sha256.xml"
 +
                  metadataURL="<nowiki>https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml</nowiki>">
 +
    <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
 +
                    certificateFile="%{idp.home}/credentials/idem-signer-legacy.pem"/>
 +
    <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P10D"/>
 +
    <MetadataFilter xsi:type="EntityRole">
 +
      <RetainedRole>md:SPSSODescriptor</RetainedRole>
 +
    </MetadataFilter>
 +
</MetadataProvider>
 +
 +
====Shibboleth Service Provider 2.5+====
 +
 +
*Move the certificate to <code>/etc/shibboleth</code>.
 +
*Configure the certificate and the desired metadata flow in <code>shibboleth2.xml</code>''',''' for example for '''IDEM Production''' flow
 +
 +
<MetadataProvider type="XML"
 +
                  uri="<nowiki>https://md.idem.garr.it/metadata/idem-metadata-sha256.xml</nowiki>"
 +
                  backingFilePath="idem-metadata-sha256.xml" reloadInterval="7200">
 +
    <MetadataFilter type="RequireValidUntil" maxValidityInterval="864000" />
 +
    <MetadataFilter type="Signature" certificate="/etc/shibboleth/idem-signer-legacy.pem"/>
 +
</MetadataProvider>
 +
 +
====Shibboleth Service Provider 3.x+====
 +
 +
*Move the certificate to <code>/etc/shibboleth</code>.
 +
*Configure the certificate and the desired metadata flow in <code>shibboleth2.xml</code>''',''' for example for '''eduGAIN and''' '''IDEM Production''' flow
 +
 +
<MetadataProvider type="XML"
 +
                  url="<nowiki>https://md.idem.garr.it/metadata/edugain2idem-metadata-sha256.xml</nowiki>"
 +
                  backingFilePath="edugain2idem-metadata-sha256.xml"
 +
                  maxRefreshDelay="7200">
 +
    <MetadataFilter type="RequireValidUntil" maxValidityInterval="864000" />
 +
    <MetadataFilter type="Signature" certificate="/etc/shibboleth/idem-signer-legacy.pem"/>
 +
</MetadataProvider>
 +
 +
====simpleSAMLphp Identity Provider 1.14+====
 +
 +
*Move the certificate to <code>/var/simplesamlphp/cert/</code>
 +
*Configure the certificate and the desired metadata flow in  <code>/var/simplesamlphp/config/config-metarefresh.php</code>, for example for the '''IDEM Test''' flow:
 +
 +
<?php
 +
 +
$config = [
 +
    'sets' => [
 +
      'idem' => [
 +
          'cron'    => ['hourly'],
 +
          'sources' => [
 +
                        [
 +
                        'src' => '<nowiki>https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml'</nowiki>,
 +
                        'certificates' => [
 +
                            '/var/simplesamlphp/cert/idem-signer-legacy.pem',
 +
                        ],
 +
                        'template' => [
 +
                            'tags'  => ['idem'],
 +
                            'authproc' => [
 +
                              51 => ['class' => 'core:AttributeMap', 'oid2name'],
 +
                            ],
 +
                        ],
 +
 +
                        'types' => ['saml20-sp-remote'],  // Load only SAML v2.0 SP from metadata
 +
                        ],
 +
                      ],
 +
          'expireAfter' => 864000, // Maximum 10 days cache time (3600*24*10)
 +
          'outputDir'  => 'metadata/',
 +
 +
          'outputFormat' => 'flatfile',
 +
      ],
 +
    ],
 +
];
 +
 +
====simpleSAMLphp Service Provider 1.14+====
 +
 +
*Move the certificate to <code>/var/simplesamlphp/cert/</code>
 +
*Configure the certificate and the desired metadata flow in  <code>/var/simplesamlphp/config/config-metarefresh.php</code>, for example for the '''IDEM Production''' flow:
 +
 +
<?php
 +
 +
$config = [
 +
    'sets' => [
 +
      'idem' => [
 +
          'cron'    => ['hourly'],
 +
          'sources' => [
 +
                        [
 +
                        'src' => '<nowiki>https://md.idem.garr.it/metadata/idem-metadata-sha256.xml'</nowiki>,
 +
                        'certificates' => [
 +
                            '/var/simplesamlphp/cert/idem-signer-legacy.pem',
 +
                        ],
 +
                        'template' => [
 +
                            'tags'  => ['idem'],
 +
                            'authproc' => [
 +
                              51 => ['class' => 'core:AttributeMap', 'oid2name'],
 +
                            ],
 +
                        ],
 +
 +
                        'types' => ['saml20-idp-remote'],  // Load only SAML v2.0 IDP from metadata
 +
                        ],
 +
                      ],
 +
          'expireAfter' => 864000, // Maximum 10 days cache time (3600*24*10)
 +
          'outputDir'  => 'metadata/',
 +
 +
          'outputFormat' => 'flatfile',
 +
      ],
 +
    ],
 +
];
 +
 +
====Other softwares (ADFS Toolkit, SaToSa, ecc.)====
 +
Download and verify the certificate following the general instructions. For the detailed configuration of the metadata flows, please refer to the configuration instructions of your software.

Versione attuale delle 10:26, 31 ott 2024

Il Servizio IDEM ha implementato un nuovo sistema di distribuzione dei metadata basato su MDQ che riduce drasticamente l'occupazione di memoria e i tempi di caricamento. Vedi https://mdx.idem.garr.it per le istruzioni di configurazione.

Aggregati di metadata

NOTA BENE: Gli aggregati di metadata sono da considerare deprecati e da utilizzare solo per sistemi che non supportano MDQ (vedi https://mdx.idem.garr.it).

IDEM Produzione:

https://md.idem.garr.it/metadata/idem-metadata-sha256.xml

eduGAIN e IDEM Produzione:

https://md.idem.garr.it/metadata/edugain2idem-metadata-sha256.xml

IDEM Test:

https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml

Certificato

Tutti i flussi di metadata della Federazione IDEM sono firmati con il seguente certificato:

https://md.idem.garr.it/certs/idem-signer-legacy.pem

1. Recuperare il certificato della Federazione:

2. Controllare la validità del certificato:

  • Eseguire il comando: openssl x509 -in /tmp/idem-signer-legacy.pem -fingerprint -sha1 -noout
    deve restituire: SHA1 Fingerprint=7F:62:60:A1:CE:2B:11:B8:D9:35:CF:7F:04:37:3E:81:5F:B4:DE:86

Istruzioni di configurazione

NOTA BENE: Gli aggregati di metadata sono da considerare deprecati e da utilizzare solo per sistemi che non supportano MDQ (vedi https://mdx.idem.garr.it).

Le istruzioni sono relative alla sola configurazione dei metadata, per guide complete sull'installazione e la configurazione di IdP e SP andare alla sezione Guide.

Shibboleth Identity Provider 3.x+ & 4.0:

  • Spostare il certificato in/opt/shibboleth-idp/credentials.
  • configurare certificato e flusso di metadata desiderato in /opt/shibboleth-idp/conf/metadata-providers.xml, ad es. per il flusso IDEM Test:
<MetadataProvider id="URLMD-IDEM-Federation" 
                  xsi:type="FileBackedHTTPMetadataProvider"
                  backingFile="%{idp.home}/metadata/idem-test-metadata-sha256.xml" 
                  metadataURL="https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml"> 
   <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true" 
                   certificateFile="%{idp.home}/credentials/idem-signer-legacy.pem"/>
   <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P10D"/>
   <MetadataFilter xsi:type="EntityRoleWhiteList"> 
      <RetainedRole>md:SPSSODescriptor</RetainedRole>
   </MetadataFilter>
</MetadataProvider>

Shibboleth Identity Provider 4.1+:

  • scaricare il certificato da https://md.idem.garr.it/certs/idem-signer-legacy.pem
  • salvarlo in una directory accessibile a Shibboleth, ad es. /opt/shibboleth-idp/credentials.
  • configurare certificato e flusso di metadata desiderato in /opt/shibboleth-idp/conf/metadata-providers.xml, ad es. per il flusso IDEM Test:
<MetadataProvider id="URLMD-IDEM-Federation" 
                  xsi:type="FileBackedHTTPMetadataProvider"
                  backingFile="%{idp.home}/metadata/idem-test-metadata-sha256.xml" 
                  metadataURL="https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml"> 
   <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true" 
                   certificateFile="%{idp.home}/credentials/idem-signer-legacy.pem"/>
   <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P10D"/>
   <MetadataFilter xsi:type="EntityRole"> 
      <RetainedRole>md:SPSSODescriptor</RetainedRole>
   </MetadataFilter>
</MetadataProvider>

Shibboleth Service Provider 2.5+

  • Spostare il certificato in /etc/shibboleth.
  • configurare certificato e flusso di metadata desiderato in shibboleth2.xml, ad es. per il flusso IDEM Produzione:
<MetadataProvider type="XML" 
                  uri="https://md.idem.garr.it/metadata/idem-metadata-sha256.xml" 
                  backingFilePath="idem-metadata-sha256.xml" reloadInterval="7200">
   <MetadataFilter type="RequireValidUntil" maxValidityInterval="864000" />
   <MetadataFilter type="Signature" certificate="/etc/shibboleth/idem-signer-legacy.pem"/>
</MetadataProvider>

Shibboleth Service Provider 3.x+

  • Spostare il certificato in /etc/shibboleth.
  • configurare certificato e flusso di metadata desiderato in shibboleth2.xml, ad es. per il flusso eduGAIN e IDEM Produzione:
<MetadataProvider type="XML" 
                  url="https://md.idem.garr.it/metadata/edugain2idem-metadata-sha256.xml" 
                  backingFilePath="edugain2idem-metadata-sha256.xml"
                  maxRefreshDelay="7200">
    <MetadataFilter type="RequireValidUntil" maxValidityInterval="864000" />
    <MetadataFilter type="Signature" certificate="/etc/shibboleth/idem-signer-legacy.pem"/>
</MetadataProvider>

simpleSAMLphp Identity Provider 1.14+

  • Spostare il certificato in /var/simplesamlphp/cert/
  • configurare certificato e flusso di metadata desiderato in /var/simplesamlphp/config/config-metarefresh.php, ad es. per il flusso IDEM Test:
<?php

$config = [
   'sets' => [
      'idem' => [
         'cron'    => ['hourly'],
         'sources' => [
                       [
                        'src' => 'https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml',
                        'certificates' => [
                           '/var/simplesamlphp/cert/idem-signer-legacy.pem',
                        ],
                        'template' => [
                           'tags'  => ['idem'],
                           'authproc' => [
                              51 => ['class' => 'core:AttributeMap', 'oid2name'],
                           ],
                        ],

                        'types' => ['saml20-sp-remote'],   // Load only SAML v2.0 SP from metadata
                       ],
                      ],
         'expireAfter' => 864000, // Maximum 10 days cache time (3600*24*10)
         'outputDir'   => 'metadata/',

         'outputFormat' => 'flatfile',
      ],
   ],
];

simpleSAMLphp Service Provider 1.14+

  • Spostare il certificato in /var/simplesamlphp/cert/
  • configurare certificato e flusso di metadata desiderato in /var/simplesamlphp/config/config-metarefresh.php, ad es. per il flusso IDEM Produzione:
<?php

$config = [
   'sets' => [
      'idem' => [
         'cron'    => ['hourly'],
         'sources' => [
                       [
                        'src' => 'https://md.idem.garr.it/metadata/idem-metadata-sha256.xml',
                        'certificates' => [
                           '/var/simplesamlphp/cert/idem-signer-legacy.pem',
                        ],
                        'template' => [
                           'tags'  => ['idem'],
                           'authproc' => [
                              51 => ['class' => 'core:AttributeMap', 'oid2name'],
                           ],
                        ],

                        'types' => ['saml20-idp-remote'],   // Load only SAML v2.0 IDP from metadata
                       ],
                      ],
         'expireAfter' => 864000, // Maximum 10 days cache time (3600*24*10)
         'outputDir'   => 'metadata/',

         'outputFormat' => 'flatfile',
      ],
   ],
];

Altri software (ADFS Toolkit, SaToSa, ecc.)

Scaricare e verificare il certificato come indicato nelle istruzioni generali. Per la configurazione dei flussi di metadata, riferirsi alle istruzioni di configurazione proprie del software utilizzato.


English version

The IDEM Service has implemented a new metadata distribution system based on the MDQ protocol that drastically reduces memory consumption and loading times. Check https://mdx.idem.garr.it for the configuration instructions.

Metadata aggregates

WARNING: Metadata aggregates are depreacted and to be used only for systems that do not support MDQ (check https://mdx.idem.garr.it).

IDEM Production:

https://md.idem.garr.it/metadata/idem-metadata-sha256.xml

eduGAIN and IDEM Production:

https://md.idem.garr.it/metadata/edugain2idem-metadata-sha256.xml

IDEM Test:

https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml

Certificate

All the IDEM Federation metadata flows are signed with the following certificate:

https://md.idem.garr.it/certs/idem-signer-legacy.pem

1. Download the Federation certificate:

  • wget https://md.idem.garr.it/certs/idem-signer-legacy.pem -O /tmp/idem-signer-legacy.pem

2. Verifiy the certificate:

  • Run the command: openssl x509 -in /tmp/idem-signer-legacy.pem -fingerprint -sha1 -noout expected value: SHA1 Fingerprint=7F:62:60:A1:CE:2B:11:B8:D9:35:CF:7F:04:37:3E:81:5F:B4:DE:86

Configuration instruction

WARNING: Metadata aggregates are depreacted and to be used only for systems that do not support MDQ (check https://mdx.idem.garr.it).

For full installation guide see Guide.

Shibboleth Identity Provider 3.x+ & 4.0:

  • Move the certificate to /opt/shibboleth-idp/credentials.
  • Configure the certificate and the desired metadata flow in /opt/shibboleth-idp/conf/metadata-providers.xml, for IDEM Test flow:
<MetadataProvider id="URLMD-IDEM-Federation" 
                  xsi:type="FileBackedHTTPMetadataProvider"
                  backingFile="%{idp.home}/metadata/idem-test-metadata-sha256.xml" 
                  metadataURL="https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml"> 
   <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true" 
                   certificateFile="%{idp.home}/credentials/idem-signer-legacy.pem"/>
   <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P10D"/>
   <MetadataFilter xsi:type="EntityRoleWhiteList"> 
      <RetainedRole>md:SPSSODescriptor</RetainedRole>
   </MetadataFilter>
</MetadataProvider>

Shibboleth Identity Provider 4.1+:

  • Move the certificate to /opt/shibboleth-idp/credentials.
  • Configure the certificate and the desired metadata flow in /opt/shibboleth-idp/conf/metadata-providers.xml, for IDEM Test flow::
<MetadataProvider id="URLMD-IDEM-Federation" 
                  xsi:type="FileBackedHTTPMetadataProvider"
                  backingFile="%{idp.home}/metadata/idem-test-metadata-sha256.xml" 
                  metadataURL="https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml"> 
   <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true" 
                   certificateFile="%{idp.home}/credentials/idem-signer-legacy.pem"/>
   <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P10D"/>
   <MetadataFilter xsi:type="EntityRole"> 
      <RetainedRole>md:SPSSODescriptor</RetainedRole>
   </MetadataFilter>
</MetadataProvider>

Shibboleth Service Provider 2.5+

  • Move the certificate to /etc/shibboleth.
  • Configure the certificate and the desired metadata flow in shibboleth2.xml, for example for IDEM Production flow
<MetadataProvider type="XML" 
                  uri="https://md.idem.garr.it/metadata/idem-metadata-sha256.xml" 
                  backingFilePath="idem-metadata-sha256.xml" reloadInterval="7200">
   <MetadataFilter type="RequireValidUntil" maxValidityInterval="864000" />
   <MetadataFilter type="Signature" certificate="/etc/shibboleth/idem-signer-legacy.pem"/>
</MetadataProvider>

Shibboleth Service Provider 3.x+

  • Move the certificate to /etc/shibboleth.
  • Configure the certificate and the desired metadata flow in shibboleth2.xml, for example for eduGAIN and IDEM Production flow
<MetadataProvider type="XML" 
                  url="https://md.idem.garr.it/metadata/edugain2idem-metadata-sha256.xml" 
                  backingFilePath="edugain2idem-metadata-sha256.xml"
                  maxRefreshDelay="7200">
    <MetadataFilter type="RequireValidUntil" maxValidityInterval="864000" />
    <MetadataFilter type="Signature" certificate="/etc/shibboleth/idem-signer-legacy.pem"/>
</MetadataProvider>

simpleSAMLphp Identity Provider 1.14+

  • Move the certificate to /var/simplesamlphp/cert/
  • Configure the certificate and the desired metadata flow in /var/simplesamlphp/config/config-metarefresh.php, for example for the IDEM Test flow:
<?php

$config = [
   'sets' => [
      'idem' => [
         'cron'    => ['hourly'],
         'sources' => [
                       [
                        'src' => 'https://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml',
                        'certificates' => [
                           '/var/simplesamlphp/cert/idem-signer-legacy.pem',
                        ],
                        'template' => [
                           'tags'  => ['idem'],
                           'authproc' => [
                              51 => ['class' => 'core:AttributeMap', 'oid2name'],
                           ],
                        ],

                        'types' => ['saml20-sp-remote'],   // Load only SAML v2.0 SP from metadata
                       ],
                      ],
         'expireAfter' => 864000, // Maximum 10 days cache time (3600*24*10)
         'outputDir'   => 'metadata/',

         'outputFormat' => 'flatfile',
      ],
   ],
];

simpleSAMLphp Service Provider 1.14+

  • Move the certificate to /var/simplesamlphp/cert/
  • Configure the certificate and the desired metadata flow in /var/simplesamlphp/config/config-metarefresh.php, for example for the IDEM Production flow:
<?php

$config = [
   'sets' => [
      'idem' => [
         'cron'    => ['hourly'],
         'sources' => [
                       [
                        'src' => 'https://md.idem.garr.it/metadata/idem-metadata-sha256.xml',
                        'certificates' => [
                           '/var/simplesamlphp/cert/idem-signer-legacy.pem',
                        ],
                        'template' => [
                           'tags'  => ['idem'],
                           'authproc' => [
                              51 => ['class' => 'core:AttributeMap', 'oid2name'],
                           ],
                        ],

                        'types' => ['saml20-idp-remote'],   // Load only SAML v2.0 IDP from metadata
                       ],
                      ],
         'expireAfter' => 864000, // Maximum 10 days cache time (3600*24*10)
         'outputDir'   => 'metadata/',

         'outputFormat' => 'flatfile',
      ],
   ],
];

Other softwares (ADFS Toolkit, SaToSa, ecc.)

Download and verify the certificate following the general instructions. For the detailed configuration of the metadata flows, please refer to the configuration instructions of your software.