Installation
If you encounter errors during the install or upgrade process that indicate the system can't start the shibd daemon/service process, it's likely that the installer is failing to install the Visual C++ runtime libraries for some reason, and you may have to pre-install those manually. At some point Microsoft is planning to make it impractical for us to redistribute these files with the installer, at which point this workaround is probably going to be universal. These links may break at some point, but for now the 32-bit and 64-bit runtimes can be found at: The top-level link to find them is https://visualstudio.microsoft.com/downloads/ via Other Tools. |
The SP is available for Windows with modules for all the supported web servers. There is an installer available for the supported Windows Server versions, 2008 and above.
Earlier Windows and Service Pack versions are not usable as of V3.
Desktop versions of Windows that are of subsequent vintage will generally work but are not formally supported.
The Windows installer contains a fourth version field that indicates the patch level within a particular SP release. Initially 0, it will be incremented if patches to software included with but not part of the SP need to be updated (e.g., OpenSSL). Subsequent patch level installers will safely upgrade older versions and the ReleaseNotes will always document exactly what library versions are included in each release.
Upgrading to new releases is handled automatically when the MSI installer is used. The system prevents configuration files from being overwritten and skips "initial install" tasks like generating keys. The Shibboleth daemon is restarted by the package but you will need to restart the web server you're using yourself.
New Installations place a restrictive file security ACL on the configuration directory. If you run your web server under a different user account (not a member of the |
The plugin modules in support of IIS are always installed. If IIS itself is installed you will be prompted "Configure IIS7 module?". Check this box to actually configure Shibboleth to run with IIS, in practice this can be done with two command.
See this topic for details.
In contrast to older versions, no older IIS6 compatibility tools are needed.
Existing installations configured to work with IIS will continue to do so, with the older ISAPI plugin updated. See this topic for more details, particularly to migrating to the newer plugin.
The versions of Apache available from the http://www.apachelounge.com/ web site are known to work with the modules that come with the SP package with no known restrictions.
Other versions might work, but they also might not work. Versions with significantly altered header files, such as IBM's or Oracle's will definitely not work unless you build the Shibboleth module from source.
Only Apache 2.2 and 2.4 are supported.
For more details on Apache see this topic.
An NSAPI module continues to be included as a transition tool for anybody still using it, but it is deprecated and we suggest moving off it as soon as possible.
As of V3, we no longer provide modules for FastCGI on Windows due to lack of formal support for the underlying FastCGI library.
The installer is run in the usual way and can be run without a UI.
The following properties can be set
| Property | Description | |
|---|---|---|
KEYGEN_EXTRAS | Allows extra parameters to be passed to the keygen command used during installation. For instance,
allows the addition of a subjectAltName in the generated certificate. | |
ALWAYS_START_SERVICE | Set this to FALSE to prevent the installer from starting the shibd service. This can be useful to debug installations (see below). |
Once installation is complete, you'll need to run the Shibboleth daemon, shibd, at all times that the SP is in use. shibd is a console application that is usually installed as a Windows service.
-console parameter when running it.shibd won't start, use the -check option from the command line to echo most logging information to the console for debugging.Other parameters can be used to install (or remove) shibd from the service database and subsequent control is generally via the Service Control Manager applet.
Newer versions of Windows support automatic restart of failed services. We suggest using this feature to restart shibd when it fails. Although stability is good, maximum reliability will be achieved by monitoring the process. |
The most common reason for the installation failing is that the Shibboleth service (above) does not start correctly. First, refer to the note at the top of this page and rule that out. If that doesn't bear fruit, in order to debug this you can instruct the installer to not try to start the service by specifying that the ALWAYS_START_SERVICE property contain the value FALSE. Do this from the command line:
c:\> msiexec /i Installer.msi ALWAYS_START_SERVICE=FALSE |
You can then use the -check option described above to debug why the service will not start. Usually the problem tends to be a DLL conflict with some existing copy of one of the libraries we ship, but we have generally worked around this risk by renaming all our libraries in ways that tend not to cause conflicts.
Once this is completed you can start the service manually.
c:\> sc start shibd_default |
We do not recommend this option, but we have a description of the process.