The Shibboleth V2 IdP and SP software have reached End of Life and are no longer supported. This documentation is available for historical purposes only. See the IDP v4 and SP v3 wiki spaces for current documentation on the supported versions.

NativeSPLinuxRH6

Owned by Scott Cantor
Last updated: Feb 22, 2017
2 min read

The SP is compatible with Red Hat and CentOS 6 and 7, but not if the OS-supplied version of libcurl is used. Red Hat has rebuilt many packages on top of the Netscape Security Services stack (NSS) instead of OpenSSL, including curl.

This is a breaking change because curl does not have the same feature set when used with NSS, and one of the features it loses is required by the SP for basic operation in some deployments, though this is growing more rare. Specifically, if your SP requires the use of back-channel SOAP communication with IdP (this describes most scenarios involving legacy SAML 1.1 IdPs and attribute queries, or use of the artifact profile/binding), it won't function without the workaround noted below or other alterations such as enabling message signing.

The Service Provider package set includes a curl-openssl package that installs to /opt/shibboleth and does not overwrite or interfere with the OS-supplied version. It is also based on a more recent version of libcurl and will be kept updated if relevant curl security updates are released.

On affected platforms (RH6+, CentOS 6+, etc.), the shibboleth packages now depend on this look-aside package and ensure its installation in the normal fashion. The /etc/sysconfig/shibd script in v6 and /etc/systemd/system/multi-user.target.wants/shibd.service in v7(due to the Linux distributions moving from init to systemd) installed for you will also include a LD_LIBRARY_PATH variable that directs the shibd process to load the alternative version of libcurl.so instead of the normal one.

The new package set should not require any special adjustments to your OS upgrade stream, and the lookaside package will not impact any other software unless you manually set the same LD_LIBRARY_PATH variable in your shell.

Note also that some of the utilities accompanying the SP, such as the resolvertest program, may not function properly without the same variable being set, but there is no shell script provided for you to set this; you'll have to do this by hand.