/
IdP512: 安装IdP5.1.2（第3/11步）

IdP512: 安装IdP5.1.2（第3/11步）

Owned by carsi_pku_team
Last updated: Dec 11, 2024

1.下载安装脚本和相应的软件

登录mgmt.carsi.edu.cn自服务系统，“我的CARSI”-“我的IdP”下载安装脚本：idp_install_script.zip。解压后为：idp512-openeuler-anolisos-jetty11-install.sh，如下图所示：

使用carsi用户登录IdP服务器并下载以下脚本和软件，存放在同一个目录下。

[carsi@www ~]$ curl -O  https://ds.carsi.edu.cn/5.0inst/v1/shibboleth-identity-provider-5.1.2.tar.gz
[carsi@www ~]$ curl -O  https://ds.carsi.edu.cn/5.0inst/v1/jetty-home-11.0.20.tar.gz

#核对所下载文件的md5值是否和下述md5值一致，如果不一致可能是下载异常，请重新下载
[carsi@www ~]$ md5sum shibboleth-identity-provider-5.1.2.tar.gz jetty-home-11.0.20.tar.gz
06929aa04589e31d48e3aac684788f74  shibboleth-identity-provider-5.1.2.tar.gz
04a7d1d97c5f7324314018089111c3c9  jetty-home-11.0.20.tar.gz

#赋予脚本可执行权限
[carsi@www ~]$ chmod 755 idp512-openeuler-anolisos-jetty11-install.sh


2.安装IdP

运行idp5.1.2-openeuler-jetty-installl.sh并开始安装IdP，整个安装过程分为五个部分：运行环境检测、安装java、nginx、Jetty基础软件、安装IdP软件、选择认证对接方式和重新编译war文件，详细描述如下：

注：安装过程中会在脚本同目录下的install.log中保存日志，但因技术限制，安装脚本的输出内容不能被全部自动收集，建议手工保存日志输出（将屏幕输出复制保存到文件），出现问题时可用于分析问题。不同操作系统，下面的内容也会有差异。

2.1 运行环境检测

[carsi@www ~]$ sudo sh ./idp512-openeuler-anolisos-jetty11-install.sh
Install shibboleth idp at 2024.04.22 15:18:24
Shibboleth IdP 5.1.2 is installing.
Script Version v5.1.2
Checking Internet access...
Check Internet access success!
Setting timezone...
Install tar ...
Install zip and unzip...
Testing installing envirenment...
Check shibboleth idp installation file success!
Check Jetty installation file success!

如果机器从IdP v3版本升级到新版本，可能会提示另外准备安装环境并退出。请根据IdP512: 将IdP 从v3.4.3/v3.4.7/v4.1.7/v4.3.x升级到v5.1.2，进行新版本安装。

You are upgrading IdP from 3.4.7 to 5.1.1 . We suggest to setup suitable environment to install IdP 5.1.1 but don't upgrade from the old system.
If you still insist to upgrade the old system to IdP 5.1.1, please make sure you have made a backup of data. You will take some risks for the installation.

注意：如果IdP已经上线，需要升级，强烈建议在新环境重新安装。新系统安装成功后拷贝老系统credentials和metadata目录下文件，完成配置和调试，以减少新老系统切换对IdP服务的影响。重装后如何恢复IdP请参考IdP511: IdP备份恢复及高可用方案。

2.2 安装java、nginx、Jetty基础软件

Installing java...   # 安装过程需从欧拉官网下载OpenJDK安装包，下载速度和网速相关，可能需要等十几分钟。另外，因为openEuler/openAnolis系统的版本不同，下面的安装文件名称会有差异。

Installed:
  alsa-lib-1.2.5.1-1.oe2203.x86_64              copy-jdk-configs-4.0-1.oe2203.noarch giflib-5.2.1-4.oe2203.x86_64        java-11-openjdk-1:11.0.17.8-1.oe2203.x86_64 java-11-openjdk-devel-1:11.0.17.8-1.oe2203.x86_64 java-11-openjdk-headless-1:11.0.17.8-1.oe2203.x86_64
  javapackages-filesystem-5.3.0-6.oe2203.noarch libfontenc-1.1.4-2.oe2203.x86_64     lksctp-tools-1.0.19-1.oe2203.x86_64 lua-posix-35.0-1.oe2203.x86_64              tzdata-java-2022a-7.oe2203.noarch                 xorg-x11-font-utils-1:7.5-43.oe2203.x86_64          
  xorg-x11-fonts-others-7.5-24.oe2203.noarch   

download fileforjava1 success!
Installing nginx...

Installed:
  gd-2.3.2-2.oe2203.x86_64                           gperftools-libs-2.9.1-4.oe2203.x86_64                     libXpm-3.5.13-4.oe2203.x86_64                    libunwind-2:1.5.0-2.oe2203.x86_64               libwebp-1.2.1-1.oe2203.x86_64                             
  libxslt-1.1.34-8.oe2203.x86_64                     nginx-1:1.21.5-3.oe2203.x86_64                            nginx-all-modules-1:1.21.5-3.oe2203.noarch       nginx-filesystem-1:1.21.5-3.oe2203.noarch       nginx-mod-http-image-filter-1:1.21.5-3.oe2203.x86_64      
  nginx-mod-http-perl-1:1.21.5-3.oe2203.x86_64       nginx-mod-http-xslt-filter-1:1.21.5-3.oe2203.x86_64       nginx-mod-mail-1:1.21.5-3.oe2203.x86_64          nginx-mod-stream-1:1.21.5-3.oe2203.x86_64      

Configure nginx certificate authentication ...
download filefornginx1 success!
download filefornginx2 success!
download filefornginx3 success!
download filefornginx4 success!
download filefornginx5 success!
Created symlink /etc/systemd/system/multi-user.target.wants/nginx.service → /usr/lib/systemd/system/nginx.service.
Job for nginx.service failed because the control process exited with error code.
See "systemctl status nginx.service" and "journalctl -xeu nginx.service" for details.
download filefornginx4 success!
Closing seclinux...
setenforce: SELinux is disabled
Installing Jetty...
download fileforjetty01 success!
download fileforjetty02 success!
download fileforjetty03 success!
INFO  : ext             initialized in ${jetty.base}/start.ini
INFO  : webapp          transitively enabled, ini template available with --add-to-start=webapp
INFO  : server          initialized in ${jetty.base}/start.ini
INFO  : mail            transitively enabled
INFO  : servlet         transitively enabled
INFO  : jsp             initialized in ${jetty.base}/start.ini
INFO  : http-forwarded  initialized in ${jetty.base}/start.ini
INFO  : annotations     transitively enabled
INFO  : transactions    transitively enabled
INFO  : threadpool      transitively enabled, ini template available with --add-to-start=threadpool
INFO  : plus            transitively enabled
INFO  : deploy          initialized in ${jetty.base}/start.ini
INFO  : security        transitively enabled
INFO  : apache-jsp      transitively enabled
INFO  : console-capture initialized in ${jetty.base}/start.ini
INFO  : jndi            transitively enabled
INFO  : http            initialized in ${jetty.base}/start.ini
INFO  : bytebufferpool  transitively enabled, ini template available with --add-to-start=bytebufferpool
MKDIR : ${jetty.base}/lib
MKDIR : ${jetty.base}/lib/ext
MKDIR : ${jetty.base}/logs
INFO  : Base directory was modified
Synchronizing state of jetty.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable jetty
Created symlink /etc/systemd/system/multi-user.target.wants/jetty.service → /usr/lib/systemd/system/jetty.service.

2.3 安装IdP软件

Installing shibbolet idp...
INFO  - Skipping non-existent resource: class path resource [-Didp.src.dir=../shibboleth-identity-provider-5.1.2]
Installation Directory: [/opt/shibboleth-idp] ?   #确认安装路径，直接回车
install:
INFO  - New Install.  Version: 5.1.2
Host Name: [idp.xxx.edu.cn] ?          #确认是服务器hostname是否正确，一般会设置hostname和IdP域名一致，此处可能显示IP地址，如果出现IP地址，请手动输入IdP服务器域名

INFO  - Creating idp-signing, CN = idp.xxx.edu.cn URI = https:/idp.xxx.edu.cn/idp/shibboleth, keySize=3072
INFO  - Creating idp-encryption, CN = idp.xxx.edu.cn URI = https://idp.xxx.edu.cn/idp/shibboleth, keySize=3072
INFO  - Creating backchannel keystore, CN = idp.xxx.edu.cn URI = https://idp.xxx.edu.cn/idp/shibboleth, keySize=3072
INFO  - Creating Sealer KeyStore
INFO  - No existing versioning property, initializing...
SAML EntityID: [https://idp.xxx.edu.cn/idp/shibboleth] ?    #确认是正确的EntityID，主要检查域名是否正确，无误后回车(不需要输入Y），如果不是，请手动输入EntityID，注意中间不要有空格
 
Attribute Scope: [xxx.edu.cn] ?      #确认是正确的学校域名，无误后回车，如果不是，请手动设置学校域名，比如：pku.edu.cn

INFO  - Initializing OpenSAML using the Java Services API
INFO  - Algorithm failed runtime support check, will not be usable: http://www.w3.org/2001/04/xmlenc#ripemd160
INFO  - Algorithm failed runtime support check, will not be usable: http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160
INFO  - Algorithm failed runtime support check, will not be usable: http://www.w3.org/2001/04/xmldsig-more#rsa-ripemd160
INFO  - Including auto-located properties in /opt/shibboleth-idp/conf/admin/admin.properties
INFO  - Including auto-located properties in /opt/shibboleth-idp/conf/authn/authn.properties
INFO  - Including auto-located properties in /opt/shibboleth-idp/conf/c14n/subject-c14n.properties
INFO  - Including auto-located properties in /opt/shibboleth-idp/conf/ldap.properties
INFO  - Including auto-located properties in /opt/shibboleth-idp/conf/saml-nameid.properties
INFO  - Including auto-located properties in /opt/shibboleth-idp/conf/services.properties
INFO  - Creating Metadata to /opt/shibboleth-idp/metadata/idp-metadata.xml
INFO  - Rebuilding /opt/shibboleth-idp/war/idp.war, Version 5.1.2
INFO  - Initial populate from /opt/shibboleth-idp/dist/webapp to /opt/shibboleth-idp/webpapp.tmp
INFO  - Overlay from /opt/shibboleth-idp/edit-webapp to /opt/shibboleth-idp/webpapp.tmp
INFO  - Creating war file /opt/shibboleth-idp/war/idp.war
INFO  - Including auto-located properties in /opt/shibboleth-idp/bin/../conf/admin/admin.properties
INFO  - Including auto-located properties in /opt/shibboleth-idp/bin/../conf/authn/authn.properties
INFO  - Including auto-located properties in /opt/shibboleth-idp/bin/../conf/c14n/subject-c14n.properties
INFO  - Including auto-located properties in /opt/shibboleth-idp/bin/../conf/ldap.properties
INFO  - Including auto-located properties in /opt/shibboleth-idp/bin/../conf/saml-nameid.properties
INFO  - Including auto-located properties in /opt/shibboleth-idp/bin/../conf/services.properties
Enabling idp.intercept.Consent...
	conf/intercept/consent-intercept-config.xml created
	views/intercept/attribute-release.vm created
	views/intercept/terms-of-use.vm created
[OK]

2.4 选择认证对接方式（根据学校认证系统实际情况进行选择）：

Please chosing your idp authentication type...
1.LDAP(easiest way)
2.CAS
3.Oauth2
4.Tencent WeChat Work（企业微信）
5.exit
Please enter your choice:#选择认证对接的方式
download fileforldap1 success!
download fileforldap2 success!
download fileforldap3 success!
download fileforldap4 success!
download fileforall1 success!
download fileforall2 success!
download fileforall3 success!
download fileforall4 success!
download fileforall5 success!
download fileforall6 success!
download fileforall7 success!
download fileforall8 success!
download fileforall9 success!
download fileforall10 success!

2.5 重新编译war，重启nginx和jetty。

Installing nashorn plugin and rebuilding /opt/shibboleth-idp/war/idp.war
INFO - Including auto-located properties in /opt/shibboleth-idp/bin/../conf/admin/admin.properties
INFO - Including auto-located properties in /opt/shibboleth-idp/bin/../conf/authn/authn.properties
INFO - Including auto-located properties in /opt/shibboleth-idp/bin/../conf/c14n/subject-c14n.properties
INFO - Including auto-located properties in /opt/shibboleth-idp/bin/../conf/ldap.properties
INFO - Including auto-located properties in /opt/shibboleth-idp/bin/../conf/saml-nameid.properties
INFO - Including auto-located properties in /opt/shibboleth-idp/bin/../conf/services.properties
INFO - Downloading from HTTPResource [http://shibboleth.net/downloads/identity-provider/plugins/scripting/2.0.0/idp-plugin-nashorn-jdk-dist-2.0.0.tar.gz]
....................................
INFO - Downloading from HTTPResource [http://shibboleth.net/downloads/identity-provider/plugins/scripting/2.0.0/idp-plugin-nashorn-jdk-dist-2.0.0.tar.gz.asc]
INFO - Plugin net.shibboleth.idp.plugin.nashorn: Trust store folder does not exist, creating
INFO - Plugin net.shibboleth.idp.plugin.nashorn: Trust store does not exist, creating
INFO - TrustStore does not contain signature 0x1483F262A4B3FF0
Accept this key:
Signature: 0x1483F262A4B3FF0
FingerPrint: 4AF4D83EEDDF43DA3C06CB3101483F262A4B3FF0
Username: Rod Widdowson <rdw@steadingsoftware.com>
[yN] y   #接受插件的安装，输入y
INFO - Installing Plugin 'net.shibboleth.idp.plugin.nashorn' version 2.0.0
INFO - Rebuilding /opt/shibboleth-idp/war/idp.war, Version 5.1.2
INFO - Initial populate from /opt/shibboleth-idp/dist/webapp to /opt/shibboleth-idp/webpapp.tmp
INFO - Overlay from /opt/shibboleth-idp/dist/plugin-webapp to /opt/shibboleth-idp/webpapp.tmp
INFO - Overlay from /opt/shibboleth-idp/edit-webapp to /opt/shibboleth-idp/webpapp.tmp
INFO - Creating war file /opt/shibboleth-idp/war/idp.war
restarting Jetty...
Jetty restarted
download filefornginx2 success!
Generating RSA private key, 2048 bit long modulus (2 primes)
....+++++
...............................+++++
e is 65537 (0x010001)
Signature ok
subject=C = CN, ST = BeiJing, L = BeiJing, O = xxx, OU = xxx, CN = idp.xxx.edu.cn
Getting CA Private Key
restarting nginx...
nginx restarted...
shibboleth idp installed success!

Related content

IdP512: 配置服务器，准备安装环境（第2/11步）
IdP512: 配置服务器，准备安装环境（第2/11步）
CARSI WIKI
Read with this
IdP433: 安装IdP4.3.3（第3/11步）
IdP433: 安装IdP4.3.3（第3/11步）
CARSI WIKI
More like this
IdP512: 2. 用CAS接口对接
IdP512: 2. 用CAS接口对接
CARSI WIKI
Read with this
IdP4：安装IdP4.1.7（第3/11步）
IdP4：安装IdP4.1.7（第3/11步）
CARSI WIKI
More like this
IdP512: 将IdP 从v3.4.3/v3.4.7/v4.1.7/v4.3.x升级到v5.1.2
IdP512: 将IdP 从v3.4.3/v3.4.7/v4.1.7/v4.3.x升级到v5.1.2
CARSI WIKI
Read with this
安装IdP3.4.7（脚本安装第3/11步）
安装IdP3.4.7（脚本安装第3/11步）
CARSI WIKI
More like this

版权所有©北京大学计算中心