Hi Brad/Shaun,
I tried to do the setup the explained stuff in a separate jboss
instance (SPEP instance) but unfortunately not able to succeed.
I tried to install just spep war on a separate jboss instance. but not
able to do it because some spep startup error occurred.
Tried installing both esoemanager.war and spep.war on jboss instance
but esoemanager failed to start as it required esoemanager.config file
to be present.
Ended up running esoestartup in jboss and then deploy esoemanager.war
and spep.war
Then went to esoemanager to configure the spep with remote
esoeidentifier
but ended up having exception and not able to succeed even with a lot
of effort.
Here is my jboss side spep config
------------------------------------------------
spep.config in SPEP instance jboss
---------------------------------
#
#
# Enterprise Sign On Engine (ESOE), Java Service Provider Enforcement
Point (SPEP) global configuration file
#
# Changing values in this file WILL effect the way the ESOE Manager
operates in production, please change with
# care and in consultation with configuration documentation.
#
# Author: Shaun Mangelsdorf
# Date: 04/12/2006
#
########################################################################### ################################
#
# Deployment specific configuration
####
# KeyStore 1
keystorePath=${spep.data}/config/spepKeystore.ks
keystorePassword=54019a6fc983ebc01e55
spepKeyAlias=388408730a414003
spepKeyPassword=e5b42af6606c57366884
metadataKeyAlias=4cc9935073e1c606
# The unique identifier of the authenticating ESOE.
esoeIdentifier=http://blr20357.as.colt:8080
# The unique identifier of the service.
spepIdentifier=http://blr20357.as.colt:7060/aptGUI
# The URL to retrieve the metadata document from
metadataUrl=http://blr20357.as.colt:7060/esoemanager/metadata/
retrieve.htm
# string description of the service
serverInfo=ESOE Manager Web Application
# Unique identifier of this service node
nodeIdentifier=46357
# Indicies of this service node
attributeConsumingServiceIndex=46357
assertionConsumerServiceIndex=46357
authzCacheIndex=46357
# Address of the service host in use without any application path e.g.
https://myserver.company.com or https://myotherserver.company.com:8443
NOT https://myserver.company.com/myapp/
serviceHost=http://blr20357.as.colt:7060
# ip addresses of this host SPEP
ipAddresses=192.168.1.100
# the URL to redirect unauthenticated users to
loginRedirect=http://blr20357.as.colt:7060/spep/sso?redirectURL={0}
# Default URL of the service
defaultURL=http://blr20357.as.colt:7060/aptGUI
# specify cookies to clear when am authentication session is destroyed
# strings are of the format: cookie_name [space] cookie_domain
(optional) [space] cookie_path (optional)
logoutClearCookie.1=spepSession
########################################################################### ################################
#
# You should not need to edit anything below this line, advanced
changes only
####
# Is the SPEP configured in lazy initialization mode
lazyInit=false
# deny | permit - Lazy Init default mode, if a lazyinit-resource is
not matched what action should the filter take on access to the
resource (inverted when there is a match as specified by resources
below)
#lazyInitDefaultAction=deny
# Forced Initialization Queries. MUST start from lazyInit-resource-1
and MUST progress in numerical order upto a maximum value of 10000
(lazyInit-resource-10000)
# This is only populated when SPEP is acting in a lazy mode, regex
patterns may be applied here
# Extreme caution to carefully validate your web application access
requirements is recommended with the system is in lazyInit mode
# Name/Value parameters from the query string make up part of the
matching, /secure.jsp.* should be used to match for example /
secure.jsp?custID=1234
#
# Values here should only contain the path and query string of your
application, eg for https://myspep.company.org/myapp you would enter /
secure.jsp.* to match any request for resources
# located at https://myspep.company.org/myapp/secure.jsp
#lazyInit-resource-1=
#lazyInit-resource-2=
# SSO web application redirect (relative)
ssoRedirect=/spep/sso?redirectURL={0}
# authentication token names
spepTokenName=spepSession
# Identifier name for site wide identifier indicating ESOE knows about
this users session
commonDomainTokenName=_saml_idp
# interval in seconds between polling the metadata URL for the
metadata document
metadataInterval=120
# allowed time in seconds that a document will remain valid from the
time of creation
allowedTimeSkew=60
# time in seconds between polling the identifier cache for expired
identifiers
identifierCacheInterval=3600
# time in seconds that an identifier will remain active
identifierCacheTimeout=36000
# Time that sessions which have yet to complete an authentication
event are considered valid
sessionCacheTimeout=120
# Time in seconds that session cache cleanup will run looking for
expired unauthenticated sessions
# and sessions which have expired as dictated by the ESOE
sessionCacheInterval=120
# Default authorization policy to apply when due to problems with PDP
or other unusal situations occurs access control result can't be
computed
defaultPolicyDecision=deny
esoe at ESOE instance tomcat
------------------------------------
#
#
# Enterprise Sign On Engine (ESOE) global configuration file
#
# Changing values in this file WILL effect the way the ESOE operates
in production, please change with
# care and in consultation with configuration documentation.
#
# VALUES IN THIS FILE WERE AUTOMATICALLY POPULATED BY ESOESTARTUP.
#
# Author: Bradley Beddoes
# Date: 22/11/2006
#
########################################################################### ################################
#
# Deployment specific configuration
####
## Database Server 1 Connection
databaseDriver-1=com.mysql.jdbc.Driver
databaseURL-1=jdbc:mysql://blr20357.as.colt/esoedb6?useUnicode=true
databaseUsername-1=root
databasePassword-1=admin
databaseRemoveAbandoned-1=true
databaseRemoveAbandonedTimeout-1=300
databaseLogAbandoned-1=true
databaseMaxIdle-1=5
databaseMaxActive-1=25
## LDAP Server 1 Connection
ldapURL-1=ldap://blr20357:10389
ldapServer-1=blr20357:10389
ldapServerPort-1=10389
baseDN-1=o=sevenSeas
identifier-1=uid
recursive-1=true
disableSSL-1=true
adminUser-1=uid=admin,ou=system
adminPassword-1=secret
## Keystore 1
keystorePath-1=${esoe.data}/config/esoeKeystore.ks
keystorePassword-1=cb0f8bfecced87244a39
keyAlias-1=5b84d473581f0567
keyPassword-1=9f1e34af75720229f4ad
keyAlias-2=9c00070268bbb847
## Active Directory SSO
# Identifier name for browsers integrated into Active Directory
#activeDirectoryBrowserId=
# Identifier for server principal in Active Directory
#serverPrincipal=
# Keytab for communication with Active Directory
#keyTab=
## ESOE trusted identifier for this deployment
esoeIdentifier=http://blr20357.as.colt:8080
## Trusted URL to recieve metadata files from
metadataURL=http://blr20357.as.colt:8080/esoemanager/metadata/
retrieve.htm
# Domain in which esoe cookie should be available - should NEVER be
set institution wide
sessionDomain=blr20357.as.colt
# Domain in which discovery cookie should be available - MUST be set
institution wide
commonDomain=as.colt
## URL to redirect unauthenticated principal to
authenticationURL=http://blr20357.as.colt:8080/signin
## URL for SAML SSO endpoint supported by this instance
ssoURL=http://blr20357.as.colt:8080/sso
## Authentication Identifiers
# URL to redirect authenticated principal to logout
logoutURL=http://blr20357.as.colt:8080/web/logout.htm
# URL to redirect principal to for manual authentication processes
usernamePasswordURL=http://blr20357.as.colt:8080/web/login.htm
# Value to append to usernamePasswordURL when authentication fails
authenticationFailedNameValue=rc=authnfail
# URLS to redirect client to when authn has completed successfully and
there is no dynamic URL
successURL=http://blr20357.as.colt:8080/web/loginsuccess.htm
# URLS to redirect client to when logout has completed successfully
and there is no dynamic URL
logoutSuccessURL=http://blr20357.as.colt:8080/web/logoutsuccess.htm
# URL to redirect client to for a critical failure
criticalfailureURL=http://blr20357.as.colt:8080/web/failure.htm
##
# Identifier Attribute Mappings
identifier.unspecified.value=unmapped
identifier.emailAddress.value=mail
identifier.X509SubjectName.value=unmapped
identifier.windowsDomainQualName.value=umapped
identifier.kerberos.value=unmapped
identifier.persistent.value=unmapped
########################################################################### ################################
#
# You should not need to edit anything below this line, advanced
changes only
####
# Should ESOE try to process non signed AuthnRequests
acceptUnsignedAuthnRequests=false
# Identifier name for esoe session identifier
sessionTokenName=esoeSession
# Identifier name for site wide identifier indicating ESOE knows about
this users session
commonDomainTokenName=_saml_idp
## Authorization Identifiers
# Seconds between attempting to send cache updates to SPEPs
cacheupdatefailuremonitor.retryInterval=20
# Seconds that an authz cache update failure can remain in the
repository before being removed
cacheupdatefailuremonitor.maxFailureAge=3600
# Time in seconds to attempt to refresh updated policies from data
repository
authorizationPollInterval=120
# Time between retrying to send logout failures in seconds
sso.failedlogoutmonitor.retryInterval=60
# Seconds that a Logout failure can remain in repository in seconds
sso.failedlogoutmonitor.maxFailureAge=600
## SAML Identifiers
# Time in seconds to
...
|
