Using the MacPort of the Shibboleth Native SP

The following installation procedure will build the SP and all its dependencies. Completion of the instructions will result in a functional and loaded but unconfigured SP installed under the /opt/local file system tree maintained by the MacPorts system.

At the present time, the port install on OS X 10.9 (Mavericks) is apparently broken and shibd produces a segfault. It is suggested that you upgrade to Yosemite.

Apache Versions

At this time, only Apache installations in detectable locations that the configure script can locate automatically are usable. In practice this means that the "right" Apache apxs script needs to be in the system path when the port is configured.

Installing MacPorts

You can find disk images with an installer at http://www.macports.org/ or you can download and build the port software manually from their tarball. After installing it, particularly if you do so from source, you may need to add /opt/local/bin to your shell path.

Once installed, the port software is self updating using the port selfupdate command.

Getting the Shibboleth Portfiles

The Portfiles are available in the default port repository, so you should be able to install them directly.

Installing Shibboleth

Normally, it's possible to just install the primary port (shibboleth in this case) and let it automatically handle dependencies. This won't work in this case because one of the dependencies (curl) has to be installed with a port "variant" to enable SSL support. Ports cannot indicate that a variant of a dependency is required, so you have to install curl yourself first.

All port installations MUST be done as root.

sudo -s
port install curl +ssl
port install shibboleth

You should see a number of packages downloaded and installed for you. Other port commands and options include -v for a verbose trace of the process, the upgrade command to grab the latest versions, and uninstall to remove things.

If you want to build universal binaries (typically meaning both i386 and x86_64 architecture), you can add +universal to the port installation command.

64-bit architecture on 10.5

On MacOS X 10.5, the default list of architectures when building with +universal would be i386 and ppc. To build i386 and x86_64, edit /opt/local/etc/macports/macports.conf and change the universal_archs line to

universal_archs              i386 x86_64

If you want to use the ODBC storage plugin, you can add +odbc to the command line and it will ensure that the unixODBC port is installed and build the plugin for you.

You may notice that packages are installed that you already have (e.g. perl or openssl). This is unavoidable. Packaging systems that are added to an OS by somebody other than the vendor typically use build conventions that require that all non-OS dependencies be managed and built by the packaging system itself.

Basic Configuration

These steps will configure Apache to load mod_shib, supply it with proper host and scheme information, and start shibd.

Edit Apache configuration:
- Shibboleth includes sample Apache configuration files in etc/shibboleth for each version of Apache. On newer OS X versions, one method is to copy the appropriate file to /private/etc/apache2/other/shib.conf and make whatever adjustments you like. Alternatively, you can add an Include to httpd.conf itself, but this isn't advisable because that file will be overwritten on subsequent installs/upgrades. Use it as a sample to add the necessary commands to your own configuration.
- Ensure that the ServerName directive is properly set, and that Apache is being started with SSL enabled.
- Use of the <RequestMap> feature is not recommended for use with Apache, but its use requires that the UseCanonicalName directive be set.
Restart Apache.
The port install process generates and installs a launchd descriptor to use in starting and monitoring shibd. You can manually start and stop it yourself, or you can use launchctl like so:
```
launchctl load -F /Library/LaunchDaemons/org.macports.shibd.plist
launchctl unload -F /Library/LaunchDaemons/org.macports.shibd.plist
```
If you want shibd to start upon boot, run:
```
launchctl load -Fw /Library/LaunchDaemons/org.macports.shibd.plist
```
If you get this error:
httpd: Syntax error on line 484 of /etc/apache2/httpd.conf: Syntax error on line 2 of /private/etc/apache2/other/shibboleth.conf: Syntax error on line 13 of /opt/local/etc/shibboleth/apache22.config: Cannot load /opt/local/lib/shibboleth/mod_shib_22.so into server: dlopen(/opt/local/lib/shibboleth/mod_shib_22.so, 10): no suitable image found. Did find:\n\t/opt/local/lib/shibboleth/mod_shib_22.so: mach-o, but wrong architecture
Then refer to the NativeSPMacApache32 topic for information on Apple's questionable Apache choice.
By default, the Shibboleth module is configured to log information on behalf of Apache to /opt/local/var/log/shibboleth-www/native.log
shibd creates its own separate logs in /opt/local/var/log/shibboleth

Upgrading Shibboleth

In order to upgrade the installation, run the commands below.

sudo -s
port sync
port upgrade shibboleth

Browser not supported