TABLE OF CONTENTS

• Ensuring your Shibboleth IdP is functioning
• How the Shibboleth IdP installer manages your configuration
• Customisations recommended by the AAF for operating a production Shibboleth IdP
• Updating the Shibboleth IdP with customisations
  • Deploy
  • Actions undertaken during an deployment
  • Upgrade
  • Actions undertaken during an upgrade
• Next Step

Ensuring your Shibboleth IdP is functioning

Before undertaking any customisation of your Shibboleth IdP and after each change you make to customise your Shibboleth IdP we recommend testing to ensure everything is functioning correctly. 

To facilitate this the AAF provides a useful tool, called AAF Attribute Validator. This tool will ensure that your IdP is working correctly with backend security processes and that it is capable of providing the attributes your users may be asked to present when accessing federated services.

A ‘private’ browser session as the best tool for working with AAF Attribute Validator. Different browsers will have different names for ‘private’ mode, e.g. Incognito Mode.

To access AAF Attribute Validator:

• Test: https://validator.test.aaf.edu.au/
• Production: https://validator.aaf.edu.au/

Follow the flow to login, ensuring you choose your new Shibboleth IdP when promoted at the Discovery Service.

How the Shibboleth IdP installer manages your configuration

IMPORTANT: All modifiable configuration is housed in the directory: 

/<INSTALL_BASE>/shibboleth-idp4-installer/repository/assets/<HOST_NAME>

By default <INSTALL_BASE> = /opt

The structure of your configuration directory will look similar to the following:

If you make configuration changes directly within /opt/shibboleth/shibboleth-idp, /opt/jetty or elsewhere your installation will become unsupported and you may have difficulties when upgrading. 

Customisations recommended by the AAF for operating a production Shibboleth IdP

Here are some of the areas you should customise when preparing a Shibboleth IdP for a production environment:

• The Shibboleth IdP MUST use valid certificates, verified by a widely trusted CA, for the client facing areas of the IdP application

     
• Ensure all AAF CORE attributeson the AAF Attribute Validator are shown with green ticks to indicate successful release
  • A Not supplied for eduPersonEntitlement is acceptable as this attribute is currently rarely used. 

• Branding should be consistent with your organisations corporate branding, images, logos, colour schemes, etc

• Corporate links, eg Accessibility, Copyright, Disclaimers, Privacy, etc should be consistent with the corporate site

• The name known by your users for their username / password should be consistently used on the IdP login page

• Links to a corporate terms of use or similar page

• Link provided to recover lost password, manage passwords or other credentials, et

• Guidance for users about effectively logging out, particularly when using publicly accessible computer

• Minimise and preferably eliminate the use of technical jargon

• Showing the name of the service the user is logging into, possibly the logo as well if it is available

Updating the Shibboleth IdP with customisations

Deploy

To deploy the changes you have made to the IdP run the deploy script.

/opt/shibboleth-idp4-installer/repository/deploy

Changes to your assets area will be deployed to the operational IdP and the IdP will be restated. There will be a short outage of the IdP as it is restarted, usually less than 2 minutes.

Actions undertaken during an deployment

The deploy process will perform the following:

1. Update underlying operating system packages to ensure any security issues are addressed

2. Apply any configuration changes made within the assets directory for: 

• Shibboleth IdP
• Jetty

3. RESTART all dependant processes.

You MUST have a tested rollback plan in place before running an deployment to ensure any unanticipated changes can be reversed.

Upgrade

To upgrade to a later version of the IdP or supporting software run the upgrade script.

/opt/shibboleth-idp4-installer/repository/upgrade

This action only upgrades the Ansilbe configuration, tasks and templates used to deploy the IdP. It will NOT deploy the changes. You MUST deploy the IdP as a separate step for the changes to the Ansible files to be effected.

Actions undertaken during an upgrade

The Ansible configuration is synced with the contents of the AAF IdP v4 installer Git Hub repository. Changes made by the AAF will be reflected in your repository ready for the next deployment. Changes could include

• Minor bug fixes and improvements to the installer
• Changes to versions of software to be installer, generally Shibboleth or Jetty
• Additional functionally being added to the IdP

Next Step

Once you’ve finalised customisations please continue to the operation stage.