Using Shibboleth - Revision history

Phil: idp.jh.edu → login.jh.edu

2024-06-11T20:39:48Z

idp.jh.edu → login.jh.edu

Phil: /* Option Two: Web Application Authorization */

2021-02-10T14:25:42Z

Option Two: Web Application Authorization

Phil: /* Option One: Webserver Authorization */

2021-02-10T14:25:19Z

Option One: Webserver Authorization

Phil at 15:56, 16 December 2020

2020-12-16T15:56:40Z

Phil: /* Logins */

2019-08-06T19:22:24Z

Logins

Phil: /* Using Only JHED IDs */

2019-08-06T19:21:13Z

Using Only JHED IDs

Phil.cs.jhu.edu: /* Option One: Webserver Authorization */

2018-12-13T16:04:11Z

Option One: Webserver Authorization

Phil.cs.jhu.edu: /* Using Only JHED IDs */

2018-12-13T16:03:52Z

Using Only JHED IDs

Phil.cs.jhu.edu at 17:50, 24 September 2018

2018-09-24T17:50:11Z

Steve410.cs.jhu.edu at 13:46, 29 August 2018

2018-08-29T13:46:44Z

@@ Line 105: / Line 105: @@
 <pre>
-ShibRequestSetting entityID https://idp.jh.edu/idp/shibboleth
+ShibRequestSetting entityID https://login.jh.edu/idp/shibboleth
 </pre>
@@ Line 142: / Line 142: @@
 There are a few URL parameters you can use in conjunction with this.  The <tt>target</tt> parameter gives the URL that the person should return to after logging in.  If you don't use this, they'll be returned to the main https://www.cs.jhu.edu page, which is almost certainly not what you want.
-The <tt>entityID</tt> parameter can be used to pick either JHED or CS as your authentication source (rather than allowing visitors to choose from between them, which is the default).  Set <tt>entityID</tt> to <tt><nowiki>https://idp.jh.edu/idp/shibboleth</nowiki></tt> for JHED IDs and <tt><nowiki>https://gidp.cs.jhu.edu/idp/shibboleth</nowiki></tt> for CS Grad Net accounts.
+The <tt>entityID</tt> parameter can be used to pick either JHED or CS as your authentication source (rather than allowing visitors to choose from between them, which is the default).  Set <tt>entityID</tt> to <tt><nowiki>https://login.jh.edu/idp/shibboleth</nowiki></tt> for JHED IDs and <tt><nowiki>https://gidp.cs.jhu.edu/idp/shibboleth</nowiki></tt> for CS Grad Net accounts.
 As an example, here's a link that would use only JHED IDs and would return people to <nowiki>https://www.cs.jhu.edu/~example/myapp</nowiki> after they've logged in:
-  <nowiki>https://www.cs.jhu.edu/Shibboleth.sso/Login?target=https://www.cs.jhu.edu/~example/myapp&entityID=https://idp.jh.edu/idp/shibboleth</nowiki>
+  <nowiki>https://www.cs.jhu.edu/Shibboleth.sso/Login?target=https://www.cs.jhu.edu/~example/myapp&entityID=https://login.jh.edu/idp/shibboleth</nowiki>
 ===== Logouts =====

@@ Line 123: / Line 123: @@
 <pre>
-AuthType Shibboleth
+AuthType shibboleth
 <IfVersion < 2.4>
    ShibCompatWith24 On

@@ Line 51: / Line 51: @@
 <pre>
-# This activates Shibboleth
+# This activates shibboleth
 AuthType Shibboleth
 <IfVersion < 2.4>

@@ Line 53: / Line 53: @@
 # This activates Shibboleth
 AuthType Shibboleth
-ShibCompatWith24 On
+<IfVersion < 2.4>
 # Shibboleth only works if the webpage is accessed via HTTPS (not HTTP).  The
@@ Line 122: / Line 124: @@
 <pre>
 AuthType Shibboleth
-ShibCompatWith24 On
+<IfVersion < 2.4>
-Require Shibboleth
+  ShibCompatWith24 On
 </pre>

@@ Line 138: / Line 138: @@
 There are a few URL parameters you can use in conjunction with this.  The <tt>target</tt> parameter gives the URL that the person should return to after logging in.  If you don't use this, they'll be returned to the main https://www.cs.jhu.edu page, which is almost certainly not what you want.
-The <tt>entityID</tt> parameter can be used to pick either JHED or CS as your authentication source (rather than allowing visitors to choose from between them, which is the default).  Set <tt>entityID</tt> to <tt><nowiki>https://shibboleth.jh.edu/idp/shibboleth</nowiki></tt> for JHED IDs and <tt><nowiki>https://gidp.cs.jhu.edu/idp/shibboleth</nowiki></tt> for CS Grad Net accounts.
+The <tt>entityID</tt> parameter can be used to pick either JHED or CS as your authentication source (rather than allowing visitors to choose from between them, which is the default).  Set <tt>entityID</tt> to <tt><nowiki>https://idp.jh.edu/idp/shibboleth</nowiki></tt> for JHED IDs and <tt><nowiki>https://gidp.cs.jhu.edu/idp/shibboleth</nowiki></tt> for CS Grad Net accounts.
 As an example, here's a link that would use only JHED IDs and would return people to <nowiki>https://www.cs.jhu.edu/~example/myapp</nowiki> after they've logged in:
-  <nowiki>https://www.cs.jhu.edu/Shibboleth.sso/Login?target=https://www.cs.jhu.edu/~example/myapp&entityID=https://shibboleth.jh.edu/idp/shibboleth</nowiki>
+  <nowiki>https://www.cs.jhu.edu/Shibboleth.sso/Login?target=https://www.cs.jhu.edu/~example/myapp&entityID=https://idp.jh.edu/idp/shibboleth</nowiki>
 ===== Logouts =====

@@ Line 103: / Line 103: @@
 <pre>
-ShibRequestSetting entityID https://shibboleth.jh.edu/idp/shibboleth
+ShibRequestSetting entityID https://idp.jh.edu/idp/shibboleth
 </pre>

@@ Line 91: / Line 91: @@
 allowed: jdoe1@johnshopkins.edu fbar3@johnshopkins.edu mumble@cs.jhu.edu
 </pre>
 The format of the file is described in the Apache [http://httpd.apache.org/docs/2.2/mod/mod_authz_groupfile.html#authgroupfile AuthGroupFile] directive.

← Older revision		Revision as of 17:50, 24 September 2018
Line 26:		Line 26:

	If a person logs in via a CS Grad Net account, their <tt>REMOTE_USER</tt> username will be their CS Grad Net account name followed by "@cs.jhu.edu". Thus, a person with a CS Grad Net account name of "janedoe" would be identified as "janedoe@cs.jhu.edu".		If a person logs in via a CS Grad Net account, their <tt>REMOTE_USER</tt> username will be their CS Grad Net account name followed by "@cs.jhu.edu". Thus, a person with a CS Grad Net account name of "janedoe" would be identified as "janedoe@cs.jhu.edu".
		+
		+	== Session Length ==
		+
		+	Once someone logs into a CS-hosted webpage via Shibboleth, the CS webserver establishes a session to remember the login. So long as the session exists, the person will be able to continue accessing Shibboleth-protected pages without having to log in again.
		+
		+	Sessions are removed after one of two things occurs:
		+
		+	* Two hours pass without any activity from the logged-in person (i.e. the person didn't access any pages for two hours)
		+	* Eight hours pass since the person's most recent login

	== How to Use the www.cs.jhu.edu ''SP'' ==		== How to Use the www.cs.jhu.edu ''SP'' ==

@@ Line 82: / Line 82: @@
 allowed: jdoe1@johnshopkins.edu fbar3@johnshopkins.edu mumble@cs.jhu.edu
 </pre>
 The format of the file is described in the Apache [http://httpd.apache.org/docs/2.2/mod/mod_authz_groupfile.html#authgroupfile AuthGroupFile] directive.
@@ Line 95: / Line 96: @@
 <pre>
 ShibRequestSetting entityID https://shibboleth.jh.edu/idp/shibboleth
-</pre>
+</pre>[steve410@ugrad4 bin]$ ls -ld bash
 ==== Using Only CS Accounts ====
@@ Line 146: / Line 148: @@
 [[Category:Webpages and Webservices]]