You MUST NOT continue to installation until you’ve worked through the checklists below. Environmental preparation is critical to a successful outcome. 

These requirements apply to both new installations and upgrades from version 3 of Shibboleth

TABLE OF CONTENTS

• Required Checklist
  • Ansible Package
  • Server connectivity
  • Environmental data for your IdP
  • LDAP connection information
  • Next steps

Required Checklist

A dedicated CentOS 7, 8 or Stream or RedHAT 7 or 8 or Ubuntu 20.04 (virtual or physical), with the following minimum specifications: 

• 2 CPU
• 4GB RAM
• 10GB+ partition for OS

The AAF recommends CentOS Stream only be used in the AAF Test environment, NOT as a production.

Ansible Package

Access to additional software repositories are required to provide software such as Ansible. For CentOS the Extra Packages for Enterprise Linux (EPEL) are required. Please refer to the Fedora Wiki - EPEL for additional information. 

The following repositories will be required for RedHAT servers

Server connectivity

• You MUST have SSH access to the server
• You MUST be able to execute commands as root on the system without limitation
• The server MUST be routable from the public internet with a static IP. Often this means configuring the IP on a local network interface directly but advanced environments may handle this differently.
• The static IP MUST have a publicly resolvable DNS entry. Typically of the form idp.example.edu

• The server MUST be able to communicate with the wider internet without blockage due to firewall rules. All publicly routable servers MUST be accessible for:

Each of the following commands MUST succeed when run on your server:

• curl http://example.edu
• curl https://example.edu

If direct access is not available, a web proxy will be required! This will allow the installer to access required content on the Internet.

If direct access is not available, then prior to running the Installer and deploy scripts you MUST set the following environment variable; Additional configuration within the IdP will also be required to use the web proxy.

export https_proxy=wwwcache.example.edu:80

The server MUST be accessible from the wider internet without blockage due to firewall rules for:

Please refer to the Advanced IdPv4 configuration section If you have is a load balancer or similar between your IdP and the Internet.

Environmental data for your IdP

The following information is required by the AAF IdP Installer and must be populated into the bootstrap-v4.ini file prior to running the installer. For migrations from version 3 a script has been provided to create and populate a bootstrap-v4.ini file that can be used in the migration process.  See using the IdPv3 export-config script for more details.

LDAP connection information

If your IdP connects to an LDAP directory or Active Directory server for authentication and attribute resolution you will need to gather the following information.  This information is provided using the bootstrap-v4.ini file in the [ldap] section.

The AAF IdP installer only supports connection to one LDAP server. Shibboleth can support multiple LDAP servers as well as other sources of authentication and attributes, including another SAML or OIDC IdP. You’ll need to undertake further customisation during the installation process when prompted. Each of these scenarios are currently outside of the installers scope.

If your LDAP connection is over LDAPS or startTLS you will need the root and intermediate certificates that make up the certificate chain to the LDAP certificate the protects the LDAP endpoint.

Next steps

For all new installs and migrations from version 3, once you’ve finalised these checklists please continue to the installation stage.