Install and Configure the Shibboleth Identity Provider (IdP) for Cisco Identity Service (IdS) to enable SSO

Allow requests from all clients

To ensure that requests from all clients reach, changes are required in  "$shibboleth_home/conf/access-control.xml" 

<entry key="AccessByIPAddress">
<bean id="AccessByIPAddress" parent="shibboleth.IPRangeAccessControl"
p:allowedRanges="#{ {'127.0.0.1/32','0.0.0.0/0', '::1/128', '10.78.93.103/32'} }" />
</entry>

Add '0.0.0.0/0' to the allowed ranges. This allows requests from any ip range.

Configure Shibboleth to integrate with IdS

Secure Hash Algorithm (SHA1) and encryption configuration in IdS

To configure IdS to default to SHA1,  open "$shibboleth_home/conf/idp.properties" and set:

idp.signing.config = shibboleth.SigningConfiguration.SHA1 

This configuration can also be changed:

idp.encryption.optional = true

If you set it to true, failure to locate an encryption key to use, when enabled, won't result in request failure. This helps to do encryption "opportunistically", that is, to encrypt whenever possible (a compatible key is found in the peer's metadata to encrypt with) but to skip encryption otherwise. 

Configure uid and user_principal to the SAML Response

The AttributeDefinition is added in "$shibboleth_home/conf/attribute-resolver.xml" to map sAMAccountName and userPrincipalName to the to uid and user_principal in the SAML response.

In addition, add the ldap connector settings with the tag <DataConnector>.

Note: ReturnAttributes needs to be specified with value "sAMAccountName userPrincipalName".

Note: LDAPProperty is mandatory in case if there is an integration with a Active Directory (AD).

<AttributeDefinition xsi:type="Simple" id="ciscoUPN" sourceAttributeID="userPrincipalName">
 <Dependency ref="LDAP" />
 <AttributeEncoder xsi:type="SAML1String" name="user_principal" />
 <AttributeEncoder xsi:type="SAML2String" name="user_principal" friendlyName="user_principal" />
</AttributeDefinition>
 
<AttributeDefinition xsi:type="Simple" id="ciscoUID" sourceAttributeID="sAMAccountName">
 <Dependency ref="LDAP" />
 <AttributeEncoder xsi:type="SAML1String" name="uid" />
 <AttributeEncoder xsi:type="SAML2String" name="uid" friendlyName="uid" />
</AttributeDefinition>
 
    <DataConnector id="LDAP" xsi:type="LDAPDirectory"
     ldapURL="ldap://adfsserver.cisco.com"
     baseDN="CN=users,DC=cisco,DC=com"
     principal="administrator@cisco.com"
     principalCredential="<cred>">
        <FilterTemplate>
            <![CDATA[
                %{idp.attribute.resolver.LDAP.searchFilter}
            ]]>
        </FilterTemplate>
      <ReturnAttributes>sAMAccountName userPrincipalName</ReturnAttributes>
      <LDAPProperty name="java.naming.referral" value="follow"/>
    </DataConnector>

Incorporate the changes in "$shibboleth_home/conf/attribute-filter.xml"

<PolicyRequirementRule xsi:type="ANY" />
 
 
        <AttributeRule attributeID="ciscoUID">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
 
        <AttributeRule attributeID="ciscoUPN">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
        p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"   
        p:attributeSourceIds="#{ {'ciscoUPN'} }" />
<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
        p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"   
        p:attributeSourceIds="#{ {'ciscoUID'} }" />

IdP metadata

IdP metadata is available in the folder  "$shibboleth_home/metadata" . The idp-metadata.xml file can be uploaded to IdS via the Application Programming Interface (API)

PUT https://<idshost>:<idsport>/ids/v1/config/idpmetadata

where idsport is not a configurable entity and the value is "8553"

Warning: Shibboleth metadata can contain 2 signing certificates, the general signing certificate and the backchannel. Navigate to the file idp-backchannel.crt in  "$shibboleth_home/credentials" to identify the backchannel certificate. If the back channel certificate is available in the metadata, You should remove the back channel certificate from the metadata xml before upload to IdS. This is because fedlet 12.0 library that IdS uses supports only one certifcate in the metadata. If more than one signing certificate is available, fedlet uses the first available certificate. 

Configure metadata providers

We need to configure the metadata providers with the entry  in $shibboleth_home/metadata-providers.xml.

<MetadataProvider id="smart-86"  xsi:type="FilesystemMetadataProvider" metadataFile="/opt/shibboleth-idp/SP/sp.xml"/>

where"id"attribute can be any unique name.

This entry indicates that a metadata provider is registered with the given id and the metadata is available in the specified file /opt/shibboleth-idp/SP/sp.xml.

Service Provider (SP) metadata of IdS must be copied to the metadataFile specified in the entry.

Note: SP metadata of IdS can be retrieved via GET https://<idshost>:<idsport>/ids/v1/config/spmetadata, where idsport is not a configurable entity and the value is "8553".