Skip to content

Latest commit

 

History

History
239 lines (152 loc) · 6.09 KB

HOWTO-Integrate-a-PrivacyIDEA-server-on-a-Shibboleth-IdP-with-fudiscr-plugin.rst

File metadata and controls

239 lines (152 loc) · 6.09 KB
Raw

HOWTO Integrate a PrivacyIDEA server on a Shibboleth IdP with fudiscr plugin

https://wiki.idem.garr.it/IDEM_Approved.png

Table of Contents

  1. Overview
  2. Requirements
  3. Configure PrivacyIDEA
    1. Create Administrator
    2. Create the idp-admin authorization token
    3. Create the idp-admin policies on the PrivacyIDEA server
      1. Setup Policy for idp-admin
      2. Enable application_tokentype policy
  4. Configure Shibboleth IdP
    1. Enable MFA module
    2. Install fudiscr plugin
    3. Configure fudiscr plugin
    4. Configure Shibboleth MFA flow
  5. Restart Jetty
  6. Authors

Overview

Requirements

  • PrivacyIDEA (tested with v3.8.1)
  • Shibboleth Identity Provider (tested with v4.3.1)
  • de.zedat.fudis.shibboleth.idp.plugin.authn.fudiscr (tested with v1.3.0)

Configure PrivacyIDEA

Create Administrator

The creation of the administrator user for Shibboleth in the PrivacyIDEA database is done throught a command line in the PrivacyIDEA Virtual Environment:

  • cd /opt/privacyidea

  • source bin/activate

  • pi-manage admin add idp-admin

TOC

Create the idp-admin authorization token

pi-manage api createtoken -r admin -u idp-admin -d 3650

Create the idp-admin policies on the PrivacyIDEA server

Setup Policy for idp-admin

  • Go to Config -> Policies
  • Open Create new Policy
  • Set the value of Policy Name to idp-admin
  • Set the value of Scope to admin
  • Set the value of Priority to last policy number + 1
  • Move on the Condition tab
  • Leave the value of Admin-Realm to None Selected to enable policy for all admins' realms.
  • Set the value of Admin to idp-admin
  • Move on the Action tab
  • Search tokenlist on the Filter action... box and check it.
  • Search triggerchallenge on the Filter action... box and check it.
  • Save Policy

Enable application_tokentype policy

DOC: application_tokentype

By enabling application_tokentype policy, an application can determine via type parameter which tokens of a user check.

  • Go to Config -> Policies
  • Open Create new Policy
  • Set the value of Policy Name to idp-application-tokentype
  • Set the value of Scope to authorization
  • Set the value of Priority to last policy number + 1
  • Move on the Action tab
  • Search application_tokentype on the Filter action... box and check it.
  • Save Policy

Configure Shibboleth IdP

Enable MFA module

  • sudo su -

  • /opt/shibboleth-idp/bin/module.sh -e idp.authn.MFA

  • /opt/shibboleth-idp/bin/module.sh -l

Install fudiscr plugin

/opt/shibboleth-idp/bin/plugin.sh -i https://identity.fu-berlin.de/downloads/shibboleth/idp/plugins/authn/fudiscr/current/fudis-shibboleth-idp-plugin-authn-fudiscr-current.tar.gz

If you need to install a specific version:

/opt/shibboleth-idp/bin/plugin.sh -i https://identity.fu-berlin.de/downloads/shibboleth/idp/plugins/authn/fudiscr/1.3.0/fudis-shibboleth-idp-plugin-authn-fudiscr-1.3.0.tar.gz

If you need to check the plugins installed into Shibboleth IdP

/opt/shibboleth-idp/bin/plugin.sh -l

If you need to update fudiscr plugin:

/opt/shibboleth-idp/bin/plugin.sh -u de.zedat.fudis.shibboleth.idp.plugin.authn.fudiscr

Configure fudiscr plugin

vim /opt/shibboleth-idp/conf/authn/fudiscr.properties

and set the following lines with the right value:

#...other things...

#####
# PrivacyIDEA
#####
fudiscr.privacyidea.base_uri=<PRIVACYIDEA-URI>
fudiscr.privacyidea.authorization_token=<IDP-ADMIN-AUTHORIZATION-TOKEN>

Replace <PRIVACYIDEA-URI> with an uri likes https://privacyidea.server.url and <IDP-ADMIN-AUTHORIZATION-TOKEN> with the authorization token created in the section Create the idp-admin authorization token

Configure Shibboleth MFA flow

  1. Edit authn.properties:

    vim /opt/shibboleth-idp/conf/authn/authn.properties

    and enable the MFA Flow by setting the idp.authn.flows property:

    idp.authn.flows = MFA

    and add the missing supportPrincipals as follow:

    #### MFA ####

idp.authn.MFA.supportedPrincipals = \
   saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol, \
   saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, \
   saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \
   saml1/urn:oasis:names:tc:SAML:1.0:am:password, \
   saml2/urn:de:zedat:fudis:SAML:2.0:ac:classes:CR, \
   saml2/https://refeds.org/profile/mfa

#### FUDISCR plugin ####

idp.authn.fudiscr.supportedPrincipals = \
   saml2/urn:de:zedat:fudis:SAML:2.0:ac:classes:CR, \
   saml2/https://refeds.org/profile/mfa

  2. Edit mfa-authn-config.xml:

    • cd /opt/shibboleth-idp/conf/authn

    • sed -i 's|authn/Password|authn/fudiscr|g' mfa-authn-config.xml

    • sed -i 's|authn/IPAddress|authn/Password|g' mfa-authn-config.xml

TOC

Restart Jetty

systemctl restart jetty.service

Authors

  • Marco Pirovano
  • Marco Malavolti