Mzigaran: Página creada con «= Service Provider = == Instalación == Instalación de mellon apt-get updatte apt-get install libapache2-mod-auth-mellon === Configuración === Habilito el modulo y configuro apache a2enmod mellon Editamos Apache MellonEnable "auth" MellonUser "uid" MellonCond "accessTo" "test.riu.edu.ar" MellonSPPrivateKeyFile /etc/apache2/mellon-stats/https_test.riu.edu.ar.key MellonSPCertFile /etc/…»

2023-06-28T18:11:42Z

Página creada con «= Service Provider = == Instalación == Instalación de mellon apt-get updatte apt-get install libapache2-mod-auth-mellon === Configuración === Habilito el modulo y configuro apache a2enmod mellon Editamos Apache <Location /> MellonEnable "auth" MellonUser "uid" MellonCond "accessTo" "test.riu.edu.ar" MellonSPPrivateKeyFile /etc/apache2/mellon-stats/https_test.riu.edu.ar.key MellonSPCertFile /etc/…»

Página nueva

= Service Provider =

== Instalación ==
Instalación de mellon
apt-get updatte
apt-get install libapache2-mod-auth-mellon

=== Configuración ===
Habilito el modulo y configuro apache
a2enmod mellon
Editamos Apache
<Location />
MellonEnable "auth"
MellonUser "uid"
MellonCond "accessTo" "test.riu.edu.ar"
MellonSPPrivateKeyFile /etc/apache2/mellon-stats/https_test.riu.edu.ar.key
MellonSPCertFile /etc/apache2/mellon-stats/https_test.riu.edu.ar.cert
MellonSPMetadataFile /etc/apache2/mellon-stats/https_test.riu.edu.ar.xml
MellonIdPMetadataFile /etc/apache2/mellon-stats/idp-metadata.xml
MellonEndpointPath /mellon
</Location>
Creamos el script mellon_create_metadata.sh que nos servira para crear los metadatos de nuestro SP
#!/usr/bin/env bash
set -e

PROG="$(basename "$0")"

printUsage() {
echo "Usage: $PROG ENTITY-ID ENDPOINT-URL"
echo ""
echo "Example:"
echo " $PROG <nowiki>urn:someservice</nowiki> <nowiki>https://sp.example.org/mellon</nowiki>"
echo ""
}

if [ "$#" -lt 2 ]; then
printUsage
exit 1
fi

ENTITYID="$1"
if [ -z "$ENTITYID" ]; then
echo "$PROG: An entity ID is required." >&2
exit 1
fi

BASEURL="$2"
if [ -z "$BASEURL" ]; then
echo "$PROG: The URL to the MellonEndpointPath is required." >&2
exit 1
fi

if ! echo "$BASEURL" | grep -q '^https\?://'; then
echo "$PROG: The URL must start with \"http://\" or \"https://\"." >&2
exit 1
fi

HOST="$(echo "$BASEURL" | sed 's#^[a-z]*://$[^:/]*$.*#\1#')"
BASEURL="$(echo "$BASEURL" | sed 's#/$##')"

OUTFILE="$(echo "$ENTITYID" | sed 's/[^0-9A-Za-z.]/_/g' | sed 's/__*/_/g')"
echo "Output files:"
echo "Private key: $OUTFILE.key"
echo "Certificate: $OUTFILE.cert"
echo "Metadata: $OUTFILE.xml"
echo "Host: $HOST"
echo
echo "Endpoints:"
echo "SingleLogoutService: $BASEURL/logout"
echo "AssertionConsumerService: $BASEURL/postResponse"
echo

# No files should not be readable by the rest of the world.
umask 0077

TEMPLATEFILE="$(mktemp -t mellon_create_sp.XXXXXXXXXX)"

cat >"$TEMPLATEFILE" <<EOF
RANDFILE = /dev/urandom
[req]
default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
prompt = no
policy = policy_anything
[req_distinguished_name]
commonName = $HOST
EOF

openssl req -utf8 -batch -config "$TEMPLATEFILE" -new -x509 -days 3652 -nodes -out "$OUTFILE.cert" -keyout "$OUTFILE.key" 2>/dev/null

rm -f "$TEMPLATEFILE"

CERT="$(grep -v '^-----' "$OUTFILE.cert")"

cat >"$OUTFILE.xml" <<EOF
<EntityDescriptor entityID="$ENTITYID" xmlns="<nowiki>urn:oasis:names:tc:SAML:2.0:metadata</nowiki>" xmlns:ds="<nowiki>http://www.w3.org/2000/09/xmldsig#</nowiki>">
<SPSSODescriptor protocolSupportEnumeration="<nowiki>urn:oasis:names:tc:SAML:2.0:protocol</nowiki>">
<KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="<nowiki>http://www.w3.org/2000/09/xmldsig#</nowiki>">
<ds:X509Data>
<ds:X509Certificate>$CERT</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<SingleLogoutService Binding="<nowiki>urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect</nowiki>" Location="$BASEURL/logout"/>
<AssertionConsumerService Binding="<nowiki>urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST</nowiki>" Location="$BASEURL/postResponse" index="0"/>
</SPSSODescriptor>
</EntityDescriptor>
EOF

umask 0777
chmod go+r "$OUTFILE.xml"
chmod go+r "$OUTFILE.cert"
Creo los metadatos:
/opt/mellon_create_metadata.sh <nowiki>https://test.riu.edu.ar</nowiki> <nowiki>https://test.riu.edu.ar/mellon</nowiki>
El archivo idp-metadata.xml contiene los datos sacados desde idp.riu.edu.ar

Mellon como SP - Historial de revisiones