...
These steps will configure Apache to load mod_shib
, supply it with proper host and scheme information, and start shibd
.
- Edit
httpd.conf
Apache configuration:Shibboleth includes sample Apache configuration
directivesfiles in
which must be addedetc/shibboleth
for each version of Apache. On newer OS X versions, one method is to copy the appropriate file to
:/private/etc/apache2/other/shib.conf
and make whatever adjustments you like. Alternatively, you can add anInclude
tohttpd.conf
itselfCode Block none none Include /opt/local/etc/shibboleth/apache.config, but this isn't advisable because that file will be overwritten on subsequent installs/upgrades. Use it as a sample to add the necessary commands to your own configuration.
- Ensure that the
ServerName
directive is properly set, and that Apache is being started with SSL enabled. - The Use of theĀ
<RequestMap>
feature is not recommended for use with Apache, but its use requires that theĀUseCanonicalName
directive should be set toOn
for secure operation.
- Restart Apache.
/opt/shibboleth-sp/sbin/shibd
must be independently started and run in order to handle access requests. The daemon should in the future be loaded and monitored along with all other major services. A launchd file is included inetc/shibboleth/shibd.osx.plist
Code Block none none /opt/shibboleth-sp/sbin/shibd &
By default, the Shibboleth module is configured to log information on behalf of Apache to
httpd/native.log, though this can be changed by modifying the/opt/shibboleth-sp/var/log/
native.logger
files pointed to by the configuration. For this log to be created, Apache must have permission to write to this file, which may require that the file be manually created and permissions assigned to whatever user Apache is configured to run under. If the file does not appear when Apache runs with the modules loaded, check for permission problems or change the location used.shibboleth-www/native.log
shibd
creates its own separate logs at in/opt/shibboleth-sp/var/log/shibboleth/shibd.log
and must have appropriate write permissions itself as well.
Anchor | ||||
---|---|---|---|---|
|
...
Personally I dislike this option because I don't like doing something that could get obliterated by an Apple system update. This may be someone else's preferred method though so I will put it here for the record. Note that I discovered this solution when trying to figure this out myself and came across the thread http://lists.apple.com/archives/macos-x-server/2008/Nov/msg00210msg00241.html.
Add the following XML snippet to /System/Library/LaunchDaemons/org.apache.httpd.plist
.
Code Block |
---|
<key>EnvironmentVariables</key>
<dict>
<key>DYLD_LIBRARY_PATH</key>
<string>/opt/shibboleth-sp/lib</string>
</dict>
|
...