采用CAS提供CARSI身份认证功能,CARSI IdP通过CAS接口与学校身份认证系统对接。IdP自动安装脚本已经完成基本配置,与学校部署情况相关、需要修改的部分如下。
1.修改CAS对接参数
Code Block | ||||
---|---|---|---|---|
| ||||
[carsi@www ~]$ sudo vi /opt/shibboleth-idp/conf/authn/authn.properties #修改第102行配置,修改external.jsp为/Authn/External idp.authn.External.externalAuthnPath = contextRelative:/Authn/External #新增 idp.authn.flows = External #CAS服务器访问地址 shibcas.casServerUrlPrefix = https://xxx.xxx.xxx.xxx/cas shibcas.casServerLoginUrl = ${shibcas.casServerUrlPrefix}/login #设置IdP的域名 ,例如https://idp.pku.edu.cn shibcas.serverName = https://xxx.xxx.xxx.xxx # CAS的协议默认为3.0,如果贵校CAS协议为2.0(请咨询CAS负责人),则增加以下配置: shibcas.ticketValidatorName = cas20 |
2.配置属性定义
eduPersonScopedAffiliation属性,取值为用户在学校的身份,其中的“userType”为CAS中确定用户身份的属性名称,请替换成实际使用的属性名。关于身份属性取值,需要将CAS用户身份的取值,对应到CARSI联盟标准取值,包括:faculty(教师),student(学生),staff(教工),employee(雇员),member(各类人员,包括faculty、student、staff、employee),alum(校友),affiliate(附属人员或临聘,常用),other(CARSI补充,不建议优先使用)。下文样例,将所有的本地用户区分为“staff”、“student”、“member”三种身份。学校可根据实际部署情况选取其中的一部分值。不同SP对用户身份的要求不同,建议配置时尽可能细化用户身份分类,避免后期修改配置。
...
Code Block | ||
---|---|---|
| ||
[carsi@www ~]$ sudo cat attribute-resolver.xml <?xml version="1.0" encoding="UTF-8"?> <AttributeResolver xmlns="urn:mace:shibboleth:2.0:resolver" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd"> <AttributeDefinition xsi:type="ScriptedAttribute" id="eduPersonScopedAffiliation"> <InputAttributeDefinition ref="employeeType" /> <Script><![CDATA[ scopedValueType = Java.type("net.shibboleth.idp.attribute.ScopedStringAttributeValue"); var localPart = ""; if(typeof(employeeType)=="undefined"){ localPart = "member"; }else{ if(employeeType.getValues().get(0)=="faculty") localPart = "faculty"; else if(employeeType.getValues().get(0)=="std") localPart = "student"; else localPart = "member"; } eduPersonScopedAffiliation.addValue(new scopedValueType(localPart, "%{idp.scope}")); ]]></Script> </AttributeDefinition> <AttributeDefinition xsi:type="SubjectDerivedAttribute" id="employeeType" principalAttributeName="userType"></AttributeDefinition> <AttributeDefinition xsi:type="Scoped" id="eduPersonPrincipalName" scope="%{idp.scope}"> <InputAttributeDefinition ref="uid"/> </AttributeDefinition> <AttributeDefinition id="uid" xsi:type="PrincipalName" /> <AttributeDefinition id="eduPersonPrincipalName" xsi:type="Scoped" scope="%{idp.scope}"> <InputAttributeDefinition ref="uid"/> </AttributeDefinition> <AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID" nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"> <InputDataConnector ref="myStoredID" attributeNames="persistentID"/> <AttributeEncoder xsi:type="SAML1XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" encodeType="false"/> <AttributeEncoder xsi:type="SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" encodeType="false"/> </AttributeDefinition> <AttributeDefinition id="samlPairwiseID" xsi:type="Scoped" scope="%{idp.scope}"> <InputDataConnector ref="myStoredID" attributeNames="persistentID"/> </AttributeDefinition> <DataConnector id="myStoredID" xsi:type="StoredId" generatedAttributeID="persistentID" salt="%{idp.persistentId.salt}" queryTimeout="0"> <InputAttributeDefinition ref="eduPersonPrincipalName"/> <BeanManagedConnection>MyDataSource</BeanManagedConnection> </DataConnector> <AttributeDefinition id="eduPersonEntitlement" xsi:type="Simple"> <InputDataConnector ref="staticAttributes" attributeNames="eduPersonEntitlement"/> </AttributeDefinition> <DataConnector id="staticAttributes" xsi:type="Static"> <Attribute id="eduPersonEntitlement"> <Value>urn:mace:dir:entitlement:common-lib-terms</Value> </Attribute> </DataConnector> </AttributeResolver> |
3. 配置属性释放
IdP安装脚本已经完成属性释放配置,可不修改。
4. 检查并导入CAS Server证书
为了保证IdP和CAS的通信安全,CARSI项目组建议采用https对接CAS服务端。
...