The Shibboleth V2 IdP and SP software have reached End of Life and are no longer supported. This documentation is available for historical purposes only. See the IDP v4 and SP v3 wiki spaces for current documentation on the supported versions.

NativeSPLinuxRPMInstall

Owned by ndk@internet2.edu
Last updated: Dec 06, 2018 by Scott Cantor

Installing the Shibboleth SP from RPM

The Shibboleth project officially provides up-to-date RPMs for most of the supported Linux platforms. For a current list, you can refer to the NativeSPLinuxInstall topic. These packages are built and published out of the OpenSUSE project's Build Service, and include all of the supported Linux variants.

A special note applies to Red Hat 7 and probably all future versions: because of Red Hat's licensing restrictions, it's now impossible for the build service to target Red Hat 7 directly. However, CentOS is an identical system, and the packages for it work on the equivalent Red Hat versions, so Red Hat 7 deployments should rely on the CentOS 7 package repository.

For other RPM-supporting Linux versions, you can usually rebuild the SRPM packages.

Under no circumstances should you attempt to install a set of RPM packages built for/with a different OS or version from your own (apart from the CentOS/RedHat exception noted above). This will usually lead to unpredictable problems and support issues. Instead, you can rebuild the SRPM packages and then you can install them anytime you need them.

Incompatibility with RHEL / CentOS 7.0-7.3

Red Hat and CentOS 7.4 included a newer version of OpenSSL than 7.0-7.3, and the official packages don't support versions older than 7.4.

Installing via Yum

The recommended approach is to take advantage of the SUSE Build Service's ability to act as a yum repository alongside your existing OS-supplied repository. Ths allows you to manage the Shibboleth packages in a standard way and pick up updates using a single command.

For Red Hat Enterprise, the CentOS team provides some usual material on using yum.

To get a copy of the appropriate repository file for your system, see https://shibboleth.net/downloads/service-provider/latest/RPMS/ for a simple drop down form that will generate a copy for you. Per the note above, Red Hat 7 systems must use the CentOS 7 repository.

You should be aware that the repository links are magnet links to mirrors that may or may not include the necessary repositories. The Shibboleth Project has nothing to do with the mirroring process and no control over whether the packages are accessible or not. If you're getting a 404 back, that's the reason. You'll simply have to wait for it to reference a different mirror, or use the unofficial workaround noted in the generated files.

Installation varies by OS, but usually you just drop the definition file into a directory such as /etc/yum.repos.d. You can turn the repository on and off by adjusting the "enabled" property in the file, such as to prevent automated updates and maintain manual control. While enabled, the yum command will "see" the Shibboleth packages when you perform standard operations, and installing the SP should require only a single command:

(32-bit OS)

$ yum install shibboleth

(64-bit OS)

$ yum install shibboleth.x86_64

Be careful of accidentally installing both the 64-bit and 32-bit version on a 64-bit server. The yum repository contains both versions and the OS will think it can install both.

Installing Manually

If you prefer to do things by hand, you can download the packages individually from the repositories hosted on the Build Service at http://download.opensuse.org/repositories/security://shibboleth/

Installation requires every RPM that is not a devel or debuginfo/debugsource package.

After Installation

The RPM installation process will place various components of Shibboleth in appropriate default directories based on your operating system's file system layout. Typically:

  • Shibboleth configuration files will be placed at /etc/shibboleth/ and the necessary Apache configuration in /etc/httpd/conf.d/shib.conf
  • shibd will be installed to /usr/sbin and may be managed using service and chkconfig (on System V platforms) or with systemctl (on systemd platforms, some additional information available)

  • An appropriate version of mod_shib and other pluggable modules will be installed to /usr/lib/shibboleth/ on a 32-bit OS and /usr/lib64/shibboleth on a 64-bit OS

Basic Configuration

  1. In httpd.conf:
    • Use of the <RequestMap> feature is not recommended for use with Apache, but its use requires that the UseCanonicalName directive be set.
    • Ensure that the ServerName directive is properly set, and that Apache is being started with SSL enabled.
  2. Restart Apache.

  3. /usr/sbin/shibd must be independently started and run in order to handle requests. The daemon should be loaded and monitored along with all other major services.

    /sbin/service shibd start
  4. By default, the Shibboleth module is configured to log information on behalf of Apache to /var/log/shibboleth-www/native.log
  5. shibd creates its own separate logs at /var/log/shibboleth