IdP433: 安装IdP4.3.3（第3/11步）
1.下载安装脚本和相应的软件
登录mgmt.carsi.edu.cn自服务系统，“我的CARSI”-“我的IdP”下载安装脚本：idp_install_script.zip。解压后为：idp4.3.3-openeuler-anolisos-jetty-install.sh（如需4.1.7安装脚本，请发邮件到carsi@pku.edu.cn），如下图所示：
使用carsi用户登录IdP服务器并下载以下脚本和软件，存放在同一个目录下。
[carsi@www ~]$ curl -O https://ds.carsi.edu.cn/4.3inst/v1/shibboleth-identity-provider-4.3.3.tar.gz [carsi@www ~]$ curl -O https://ds.carsi.edu.cn/4.3inst/v1/jetty-home-10.0.20.zip #核对所下载文件的md5值是否和下述md5值一致，如果不一致可能是下载异常，请重新下载 [carsi@www ~]$ md5sum shibboleth-identity-provider-4.3.3.tar.gz jetty-home-10.0.20.zip c27d42fa488c8853019e1cb0c4fced14 shibboleth-identity-provider-4.3.3.tar.gz fde76dba0c0a12e4e7492515014be5cc jetty-home-10.0.20.zip #赋予脚本可执行权限 [carsi@www ~]$ chmod 755 idp4.3.3-openeuler-anolisos-jetty-install.sh
2.安装IdP
运行idp4.3.3-openeuler-jetty-installl.sh并开始安装IdP，整个安装过程分为五个部分：运行环境检测、安装java、nginx、Jetty基础软件、安装IdP软件、选择认证对接方式和重新编译war文件，详细描述如下：
注：安装过程中会在脚本同目录下的install.log中保存日志，但因技术限制，安装脚本的输出内容不能被全部自动收集，建议手工保存日志输出（将屏幕输出复制保存到文件），出现问题时可用于分析问题。
2.1 运行环境检测
[carsi@www ~]$ sudo sh ./idp4.3.3-openeuler-anolisos-jetty-install.sh Install shibboleth idp at 2024.04.16 15:18:24 Shibboleth IdP 4.3.3 is installing. Script Version v4.3.3 Checking Internet access... Check Internet access success! Setting timezone... Install tar ... Install zip and unzip... Testing installing envirenment... Check shibboleth idp installation file success! Check Jetty installation file success!
如果机器从IdP v3版本升级到新版本，可能会提示另外准备安装环境并退出。请根据IdP432: 将IdP 从v3.4.3/v3.4.7/v4.1.7升级到v4.3.3，进行新版本安装。
You are upgrading IdP from 3.4.7 to 4.3.3 . We suggest to setup suitable environment to install IdP 4.3.3 but don't upgrade from the old system. If you still insist to upgrade the old system to IdP 4.3.3, please make sure you have made a backup of data. You will take some risks for the installation.
注意：如果IdP已经上线，需要升级，强烈建议在新环境重新安装。新系统安装成功后拷贝老系统credentials和metadata目录下文件，完成配置和调试，以减少新老系统切换对IdP服务的影响。重装后如何恢复IdP请参考IdP433: IdP备份恢复及高可用方案。
2.2 安装java、nginx、Jetty基础软件
Installing java... # 安装过程需从欧拉官网下载OpenJDK安装包，下载速度和网速相关，可能需要等十几分钟。另外，因为openEuler/openAnolis系统的版本不同，下面的安装文件名称会有差异。
Installed:
alsa-lib-1.2.5.1-1.oe2203.x86_64 copy-jdk-configs-4.0-1.oe2203.noarch giflib-5.2.1-4.oe2203.x86_64 java-11-openjdk-1:11.0.17.8-1.oe2203.x86_64 java-11-openjdk-devel-1:11.0.17.8-1.oe2203.x86_64 java-11-openjdk-headless-1:11.0.17.8-1.oe2203.x86_64
javapackages-filesystem-5.3.0-6.oe2203.noarch libfontenc-1.1.4-2.oe2203.x86_64 lksctp-tools-1.0.19-1.oe2203.x86_64 lua-posix-35.0-1.oe2203.x86_64 tzdata-java-2022a-7.oe2203.noarch xorg-x11-font-utils-1:7.5-43.oe2203.x86_64
xorg-x11-fonts-others-7.5-24.oe2203.noarch
download fileforjava1 success!
Installing nginx...
Installed:
gd-2.3.2-2.oe2203.x86_64 gperftools-libs-2.9.1-4.oe2203.x86_64 libXpm-3.5.13-4.oe2203.x86_64 libunwind-2:1.5.0-2.oe2203.x86_64 libwebp-1.2.1-1.oe2203.x86_64
libxslt-1.1.34-8.oe2203.x86_64 nginx-1:1.21.5-3.oe2203.x86_64 nginx-all-modules-1:1.21.5-3.oe2203.noarch nginx-filesystem-1:1.21.5-3.oe2203.noarch nginx-mod-http-image-filter-1:1.21.5-3.oe2203.x86_64
nginx-mod-http-perl-1:1.21.5-3.oe2203.x86_64 nginx-mod-http-xslt-filter-1:1.21.5-3.oe2203.x86_64 nginx-mod-mail-1:1.21.5-3.oe2203.x86_64 nginx-mod-stream-1:1.21.5-3.oe2203.x86_64
Configure nginx certificate authentication ...
download filefornginx1 success!
download filefornginx2 success!
download filefornginx3 success!
download filefornginx4 success!
download filefornginx5 success!
Created symlink /etc/systemd/system/multi-user.target.wants/nginx.service → /usr/lib/systemd/system/nginx.service.
Job for nginx.service failed because the control process exited with error code.
See "systemctl status nginx.service" and "journalctl -xeu nginx.service" for details.
download filefornginx4 success!
Closing seclinux...
setenforce: SELinux is disabled
Installing Jetty...
download fileforjetty01 success!
download fileforjetty02 success!
download fileforjetty03 success!
INFO : ext initialized in ${jetty.base}/start.ini
INFO : webapp transitively enabled, ini template available with --add-to-start=webapp
INFO : server initialized in ${jetty.base}/start.ini
INFO : mail transitively enabled
INFO : servlet transitively enabled
INFO : jsp initialized in ${jetty.base}/start.ini
INFO : http-forwarded initialized in ${jetty.base}/start.ini
INFO : annotations transitively enabled
INFO : transactions transitively enabled
INFO : threadpool transitively enabled, ini template available with --add-to-start=threadpool
INFO : plus transitively enabled
INFO : deploy initialized in ${jetty.base}/start.ini
INFO : security transitively enabled
INFO : apache-jsp transitively enabled
INFO : console-capture initialized in ${jetty.base}/start.ini
INFO : jndi transitively enabled
INFO : http initialized in ${jetty.base}/start.ini
INFO : bytebufferpool transitively enabled, ini template available with --add-to-start=bytebufferpool
MKDIR : ${jetty.base}/lib
MKDIR : ${jetty.base}/lib/ext
MKDIR : ${jetty.base}/logs
INFO : Base directory was modified
Synchronizing state of jetty.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable jetty
Created symlink /etc/systemd/system/multi-user.target.wants/jetty.service → /usr/lib/systemd/system/jetty.service.
2.3 安装IdP软件
Installing shibbolet idp... Buildfile: /home/carsi/shibboleth-identity-provider-4.3.1/bin/build.xml install: New Install. Version: 4.3.3 Host Name: [idp.xxx.edu.cn] ? #确认是服务器hostname是否正确，一般会设置hostname和IdP域名一致，此处可能显示IP地址，如果出现IP地址，请手动输入IdP服务器域名 Creating idp-signing, CN = idp.xxx.edu.cn URI = https://idp.xxx.edu.cn/idp/shibboleth, keySize=3072 Creating idp-encryption, CN = idp.xxx.edu.cn URI = https://idp.xxx.edu.cn/idp/shibboleth, keySize=3072 Backchannel PKCS12 Password: #设置并输入一个密码，用于创建后台证书 Re-enter password: #再输入一遍 Creating backchannel keystore, CN = idp.xxx.edu.cn URI = https://idp.xxx.edu.cn/idp/shibboleth, keySize=3072 Cookie Encryption Key Password: #设置并输入一个密码，用于创建Cookie加密密码 Re-enter password: #再输入一遍 Creating Sealer KeyStore INFO - No existing versioning property, initializing... SAML EntityID: [https://idp.xxx.edu.cn/idp/shibboleth] ? #确认是正确的EntityID，主要检查域名是否正确，无误后回车(不需要输入Y），如果不是，请手动输入EntityID，注意中间不要有空格 Attribute Scope: [xxx.edu.cn] ? #确认是正确的学校域名，无误后回车，如果不是，请手动设置学校域名，比如：pku.edu.cn Creating Metadata to /opt/shibboleth-idp/metadata/idp-metadata.xml Rebuilding /opt/shibboleth-idp/war/idp.war, Version 4.3.3 Initial populate from /opt/shibboleth-idp/dist/webapp to /opt/shibboleth-idp/webpapp.tmp Overlay from /opt/shibboleth-idp/edit-webapp to /opt/shibboleth-idp/webpapp.tmp Creating war file /opt/shibboleth-idp/war/idp.war BUILD SUCCESSFUL Total time: 2 minutes 16 seconds Enabling idp.intercept.Consent... conf/intercept/consent-intercept-config.xml created views/intercept/attribute-release.vm created views/intercept/terms-of-use.vm created [OK]
2.4 选择认证对接方式（根据学校认证系统实际情况进行选择）：
Please chosing your idp authentication type... 1.LDAP(easiest way) 2.CAS 3.Oauth2 4.Tencent WeChat Work（企业微信） 5.exit Please enter your choice:#选择认证对接的方式 download fileforldap1 success! download fileforldap2 success! download fileforldap3 success! download fileforldap4 success! download fileforall1 success! download fileforall2 success! download fileforall3 success! download fileforall4 success! download fileforall5 success! download fileforall6 success! download fileforall7 success! download fileforall8 success! download fileforall9 success! download fileforall10 success!
2.5 重新编译war，重启nginx和jetty。
Rebuilding /opt/shibboleth-idp/war/idp.war Buildfile: /opt/shibboleth-idp/bin/build.xml build-war: Installation Directory: [/opt/shibboleth-idp] ? #直接回车 INFO [net.shibboleth.idp.installer.BuildWar:103] - Rebuilding /opt/shibboleth-idp/war/idp.war, Version 4.3.3 INFO [net.shibboleth.idp.installer.BuildWar:113] - Initial populate from /opt/shibboleth-idp/dist/webapp to /opt/shibboleth-idp/webpapp.tmp INFO [net.shibboleth.idp.installer.BuildWar:92] - Overlay from /opt/shibboleth-idp/edit-webapp to /opt/shibboleth-idp/webpapp.tmp INFO [net.shibboleth.idp.installer.BuildWar:125] - Creating war file /opt/shibboleth-idp/war/idp.war BUILD SUCCESSFUL Total time: 4 seconds restarting Jetty... Jetty restarted restarting nginx... nginx restarted... shibboleth idp installed success!
版权所有©北京大学计算中心