The QuickInstaller installs Tomcat version 6.0.18 into the CaptiveTomcat 6.0 subdirectory of the installation directory. It is then configured as follows:
Much of this configuration is as described in IdPApacheTomcatPrepare
The IdP is installed using a variant of the standard installation ant script. The variant is solely to allow the parameters captured above to be incorporated into the configuration files.
The configuration file templates which are used as input to the installation process have been changed as described below.
The configuration file relying-party.xml is set up to collect the metadata for the TestShib test SP only. This information must be removed before the IdP is added to any other federation. Failure to do thi would allow arbitrary SPs to impersonate testshib and thus steal user information.
The IdP is configured to get authentication via the LDAP directory associated with the Active Directory domain. The LDAP configuration contains the extra parameterization to allow use against a Global Catalog if required (See http://technet.microsoft.com/en-us/library/cc728188%28WS.10%29.aspx).
With the exception of eduPersonScopedAffiliation (which is statically generated), the attributes are populated from the LDAP directory associated with the Active Directory domain. The LDAP configuration contains the extra parameterization to allow use against a Global Catalog if required (See previous reference).
The IdP is configured to create three attributes:
The value member@scope
(where scope was specified by the user) is generated.
This is released to all SPs.
The value name@scope
. The scope was specified by the user and the name is populated from the sAMAccountName
attribute in the directory.
This value is only released to the TestShib SP.
This is generated using the ComputedId connector, using the ObjectSid
attribute which has the correct uniqueness properties as input. In the SAML1 case, this attribute is encoded as both in both the old (deprecated) and new formats (see here and here).
This value is released to all SPs.