Creating a Shibboleth Environment

1) Download and install shibboleth 1.3. Shibboleth can be downloaded here: http://shibboleth.internet2.edu/v1.3.html. The best instructions I found are here: https://spaces.internet2.edu/display/SHIB/JKIdPInstall. There is a README that will guide you through the install process. Be sure that tomcat and shibboleth have the same write privileges. There doesn't appear to be a way to test the installation. Going to /shibboleth-ip returned a 404 to me. However, I was able to go to any jsp in the webapp (/shibboleth-ip/sample.jsp).

Please note that if you are running this on a linux system then it is easiest to install all components (shibboleth-idp,tomcat, etc) as the same user. I found some permissions problems when having apache run as root and tomcat as a different user.

2) Download the tomcat apache connector (mod_jk). CD to native. Type ./configure --with-apxs=/usr/local/apache/bin/apxs --with-java-home=/usr/java/jdk1.5.0_14/ --enable-EAPI. Then type make. mod_jk.so should be in tomcat-connectors-1.2.27-src/apache-1.3/.

Create an ajp13 workers.properties file:
# Define 1 real worker using ajp13
worker.list=ajp13
# Set properties for the ajp13 worker
worker.ajp13.type=ajp13
worker.ajp13.host=localhost
worker.ajp13.port=8009

Add the following to httpd.conf:
LoadModule jk_module libexec/mod_jk.so

JkWorkersFile /usr/local/tomcat/conf/jk/workers.properties
JkLogFile /usr/local/tomcat/logs/mod_jk.log
JkLogLevel debug

JkMount /shibboleth-idp/* ajp13
JkMount /jsp-examples/* ajp13

3) At this point apache and tomcat should be able to communicate to each other.
4) Go to shibboleth web application. For example, http://sorcerer.internal.emeta.com/shibboleth-idp/SSO.
5) You'll receive a Shibboleth error page (Shibboleth Identity Error Page to be specific). This is an expected sign. It means that shibboleth is now ready to be configured for the federation.
6) The next step is to use openssl to generate a key and a certificate:

1. openssl genrsa -out idp.key 2048
2. openssl req -new -key idp.key -x509 -days 365 -out idp.crt

7) Repeat the same steps on the erights server.
8) In the IDP server directory copy etc/example-metadata.xml to etc/partner-metadata.xml.