[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[upki-fed:281] Re: [upki-fed:280] Re: [upki-fed:279] Re: SSL$B%"%/%;%i%l!<%?4D6-(B

Subject: [upki-fed:281] Re: [upki-fed:280] Re: [upki-fed:279] Re: SSL$B%"%/%;%i%l!<%?4D6-(B
Date: Fri, 19 Nov 2010 19:35:02 +0900
From: Takeshi NISHIMURA <xxxxxxx@xxxxxxxxx>

NII$B$N@>B<$H?=$7$^$9!#(B
$B$h$m$7$/$*4j$$$7$^$9!#(B

$BDL>o(BShibboleth 2.x(SAML2)$B$r;H$C$F$$$k>e$G(BSSL$B%"%/%;%i%l!<%?$K(B
$B%"%/%;%9$9$k$N$OMxMQZ$5(B
$B$l$?!W$H$$$&>pJs$r2~$6$s$5$l$k$3$H$J$/$d$j$H$j$7$J$1$l$P$J$j(B
$B$^$;$s$N$G!"$=$N$h$&$J>lLL$G$3$=(BIdP/SP$B$N>ZL@=q$*$h$SHkL)80$N(B
$B@_Dj$,IT2D7g$K$J$j$^$9!#(B

> 3-1.SP$B$N@_Dj(B
>     shibboleth2.xml
>     <CredentialResolver type="File" key="sp-key.pem"
> certificate="sp-cert.pem" />
>         $B"-(B
>     <CredentialResolver type="File"
>                         key="/opt/shibboleth-idp/credentials/idp.key"
>                         certificate="/opt/shibboleth-idp/credentials/idp.crt" />

SP$B$N@_Dj$K(BIdP$B$NHkL)80(B(idp.key)$B$,I,MW$K$J$k$3$H$O$"$j$($^$;$s!#(B
$B!D$H;W$C$?$N$G$9$,!"$3$N%F%9%H$OF1$8%[%9%H$G(BIdP$B$H(BSP$B$rN)$A>e$2$F(B
$B9T$C$F$$$k$N$G$9$M!#$D$^$j!V(BSP$B$N>ZL@=q!W$H!V(BIdP$B$N>ZL@=q!W$,(B
$BF1$8$b$N$G$"$k$H$$$&FCu67$HM}2r$7$^$7$?!#(B

> $B$H$/$K!"(B3$B$N@_Dj$G!"(BSP$B$N80!"(BIdP$B$N80!"%a%?%G!<%?Fb$N>ZL@=q$,!"(B
> $B$$$D!"2?$N$?$a$K;H$o$l$F$$$k$N$+5$$K$J$j$^$9!#(B

# SP$B$H(BIdP$B$,F10l%[%9%H$H$$$&>u67$G$OM}2r$,Fq$7$/$J$C$F$7$^$&(B
# $B$+$H;W$$$^$9$N$G!"0lHLE*$J>u67$r2>Dj$7$^$9!#(B

SAML2$B$N%W%m%H%3%k$NK\ZMW5a$r9T$&(B
2. IdP$B$,$=$NG'>ZMW5a$KBP$7$FG'>Z1~Ez$rJV$9(B
$B$HC1=c2=$G$-$^$9!#G'>Z1~Ez$K$O!V3N$+$KG'>Z$5$l$?!W$H$$$&>pJs$dB0@-(B
$B>pJs$J$I(B($B%"%5!<%7%g%s(B)$B$,4^$^$l$^$9$,!">\:Y$O>J$-$^$9!#(B
$B$3$l$i$O!"DL?.O)>e$G$NEpD0!&2~$6$s$rKI$0$?$a!"E,@Z$K0E9f2=!&=pL>(B
$B$5$l$J$1$l$P$J$j$^$;$s!#(B

$B0lJ}!">ZL@=q!J@53N$K8@$&$H8x3+800E9f!K$r;H$C$F0E9f2=$r9T$&$K$O!"(B
$BDL?.AjZL@=q$rCN$C$F$$$J$1$l$P$J$j$^$;$s!#$3$l$rEAC#$9$ke$K(B
$B$OA4$F$N(BIdP/SP$B$,:\$C$F$*$j!"$=$N>ZL@=q$b4^$^$l$F$$$k$?$a!"Nc$($P(BSP$B$,(B
IdP$B$KBP$7$FG'>ZMW5a!J$H$$$&L>$N%G!<%?!K$rAw$k$H$-$KAjZL@=q(B
$B$rC5$7=P$9$3$H$,$G$-$^$9!#(B
$B=pL>8!>Z$N>l9g$bF1MM$G$9!#(B

$B0J>e$+$i!"$=$l$>$l$N80$*$h$S>ZL@=q$NLr3d$O0J2<$N$h$&$K$J$j$^$9!#(B
[$BA0Ds(B]$B!V%a%?%G!<%?Fb$N>ZL@=q!W$O!"DL?.AjZL@=q$rEAC#$9$kLr3d(B
- SP$B$K$FG'>ZMW5a$K=pL>$r9T$&$N$O!"!V(BSP$B$NHkL)80!W$NLr3d(B
- IdP$B$K$F!"G'>ZMW5a$K;\$5$l$?=pL>$N8!>Z$r9T$&$N$O!"!V(BSP$B$N>ZL@=q!W$NLr3d(B
  $B!J%a%?%G!<%?$K$h$C$F(BIdP$B$O(BSP$B$N>ZL@=q$rCN$k$3$H$,$G$-$k!K(B
* IdP$B$K$FG'>Z1~Ez$K0E9f2=$r9T$&$N$O!"!V(BSP$B$N>ZL@=q!W$NLr3d(B
  $B!J%a%?%G!<%?$K$h$C$F(BIdP$B$O(BSP$B$N>ZL@=q$rCN$k$3$H$,$G$-$k!K(B
* IdP$B$K$FG'>Z1~Ez$K=pL>$r9T$&$N$O!"!V(BIdP$B$NHkL)80!W$NLr3d(B
* SP$B$K$F!"G'>Z1~Ez$K;\$5$l$?=pL>$N8!>Z$r9T$&$N$O!"!V(BIdP$B$N>ZL@=q!W$NLr3d(B
  $B!J%a%?%G!<%?$K$h$C$F(BSP$B$O(BIdP$B$N>ZL@=q$rCN$k$3$H$,$G$-$k!K(B
* SP$B$K$FG'>Z1~Ez$rI|9f$9$k$N$O!"!V(BSP$B$NHkL)80!W$NLr3d(B

$B!VC/$,!W!V2?$r$9$k$H$-$K!W!V2?$rMQ$$$k!W$rL@3N$K$7$F$$$1$P!"$=$l$[$I(B
$BFq$7$$$b$N$G$O$J$$$H;W$$$^$9!#(B

$B$A$J$_$K!">e5-$G(B"*"$B$G=q$$$F$$$k$b$N$O(BShibboleth 2.x$B$N%G%U%)%k%HF0:n!"(B
"-"$B$G=q$$$F$$$k$b$N$O%*%W%7%g%s$G;XDj$G$-$k$b$N$G$9!#(B
$BBP>N$G$J$/$F%"%l$J$N$G$9$,!"!VG'>ZMW5a$r0E9f2=$9$k!W$H$$$&%*%W%7%g%s$O(B
$BB8:_$7$J$$$h$&$G$9!D(B


(2010/11/18 17:28), kohei teraguchi wrote:
> $B$*@$OC$K$J$C$F$*$j$^$9!#(B
> $B;{8}$G$9!#(B
> 
> SSL$B%"%/%;%i%l!<%?4D6-$G$N@_Dj$K$D$$$FJs9p$$$?$7$^$9!#(B
> 
> 1.$BF0:n3NG'4D6-(B
>     OS$B!'(BRed Hat Enterprise Linux Server release 5.2 (Tikanga)
>     Web$B%5!<%P!'(BApache/2.2.3
>     shibbolethSP$B!'(Bshibboleth-2.3.1-1.3
>     shibbolethIdP$B!'(Bshibboleth-identityprovider-2.2.0
>     $B%I%a%$%s!'(Btest.researchmap.jp
> 
> 
> 2.$B%m%0%$%s2hLL$NI=<((B
> 2-1.apache$B$N@_DjJQ99(B
>     ServerName test.researchmap.jp
>         $B"-(B
>     ServerName https://test.researchmap.jp
> 
>     https://spaces.internet2.edu/display/SHIB/SPNoSSL
>     $B$G$O!"%]!<%HHV9f$N;XDj$H(BUseCanonicalName$B$r(BOn$B$K@_Dj$7$F$$$^$9$,!"(B
>     $BL5$/$F$bF0:n$$$?$7$^$7$?!#(B
> 
> 2-2.apache$B!](Btomcat$BO"7H$N@_DjJQ99(B
>     <Connector port="8009" protocol="AJP/1.3"  redirectPort="8443"
>                enableLookups="false"
>                request.tomcatAuthentication="false"
>                address="127.0.0.1" />
>         $B"-(B
>     <Connector port="8009" protocol="AJP/1.3" redirectPort="8443"
>                enableLookups="false"
>                proxyPort="443" scheme="https"
>                request.tomcatAuthentication="false"
>                address="127.0.0.1" />
> 
>     $B;29M!'(B
>     http://groups.google.com/group/shibboleth-users/browse_thread/thread/3247848f1087777c/a2bc1ce79fb1f428?lnk=gst&q=SAML+message+intended+destination+endpoint#a2bc1ce79fb1f428
> 
> 
> 3.$BG'>Z=hM}(B
> 3-1.$BGX7J!"8=>](B
>     SSL$B%"%/%;%i%l!<%?$rDL$7$?(BWEB$B%5!<%P$X$N%j%/%(%9%H$OA4$F(Bhttp$B$K$J$k$?$a!"(B
>     SP$B!J(Bshibboleth2.xml$B!K!"5Z$S!"(BIdP$B!J(Brelying-party.xml$B!K$K@_Dj$5$l$F$$$k(B
>     $BHkL)80$H>ZL@=q$OI,MW$J$$$HH=CG$7@_Dj$r9T$C$F$$$J$+$C$?$,!"(B
>     $B@_Dj$r9T$o$J$$$H!"%m%0%$%s;~$K%(%i!<$,H/@8$9$k!#(B
> 
> 3-1.SP$B$N@_Dj(B
>     shibboleth2.xml
>     <CredentialResolver type="File" key="sp-key.pem"
> certificate="sp-cert.pem" />
>         $B"-(B
>     <CredentialResolver type="File"
>                         key="/opt/shibboleth-idp/credentials/idp.key"
>                         certificate="/opt/shibboleth-idp/credentials/idp.crt" />
> 
> 3-2.IdP$B$N@_Dj(B
>     relying-party.xml
>     <security:Credential id="IdPCredential" xsi:type="security:X509Filesystem">
>         <security:PrivateKey>/opt/shibboleth-idp/credentials/idp.key</security:PrivateKey>
>         <security:Certificate>/opt/shibboleth-idp/credentials/idp.crt</security:Certificate>
>     </security:Credential>
> 
>     $B%G%U%)%k%H$N$^$^$GJQ99$J$7!#(B
> 
> 3-3.$B80@_Dj(B
>     /opt/shibboleth-idp/credentials/idp.key$B$K(Btest.researchmap.jp$B$NHkL)80$r@_Dj(B
>     /opt/shibboleth-idp/credentials/idp.crt$B$K(Btest.researchmap.jp$B$N>ZL@=q$r@_Dj(B
> 
> 
> $B0J>e$N@_Dj$G!"(Btomcat$B:F5/F0!"(Bapache$B:FFI9~$_$r9T$C$?$H$3$mF0:n$$$?$7$^$7$?!#(B
> 
> 
> 2-1$B$N@_Dj$K$D$$$F$O!"(BServerName$B$rJQ99$7$F$$$k$?$a!"(B
> WEB$B%"%W%j%1!<%7%g%sB&$K1F6A$,=P$k2DG=@-$,$"$k$+$H;W$$$^$9$N$G!"(B
> $B:#8e!"D4::$7$?$$$H;W$$$^$9!#(B
> 
> $B$^$?!"(B2$B!"(B3$B$N@_Dj$,$I$N$h$&$K1F6A$7$FF0:n$9$k$h$&$K$J$C$?$N$+!"(B
> $B$$$^$$$AM}2r$7$F$*$j$^$;$s!#!#!#!#(B
> 
> $B$H$/$K!"(B3$B$N@_Dj$G!"(BSP$B$N80!"(BIdP$B$N80!"%a%?%G!<%?Fb$N>ZL@=q$,!"(B
> $B$$$D!"2?$N$?$a$K;H$o$l$F$$$k$N$+5$$K$J$j$^$9!#(B
> $BA[Dj$G$O!"(B
> $B!&(BSP$B$NHkL)80$O(BSAML$B$N>pJs$r0E9f2=$9$k:]$K;HMQ$7$F$$$k!#(B
> $B!&(BSP$B$N>ZL@=q$O(BSP$BK\?M3NG'$N$?$a$N%G%8%?%k=pL>$K;HMQ$7$F$$$k!#(B
> $B!&(BIdP$B$NHkL)80$O(BSAML$B$N>pJs$r0E9f2=$9$k:]$K;HMQ$7$F$$$k!#(B
> $B!&(BIdP$B$N>ZL@=q$O(BIdP$BK\?M3NG'$N$?$a$N%G%8%?%k=pL>$K;HMQ$7$F$$$k!#(B
> $B!&%a%?%G!<%?Fb$N>ZL@=q$O(BSAML$B$N>pJs$rJ#9g$9$k:]$K;HMQ$7$F$$$k!#(B
> $B$NMM$J46$8$+$H;W$C$F$*$j$^$9!#(B
> 
> $B$=$NJU$j$N>pJsEy!">\$7$$J}$,$$$i$C$7$c$$$^$7$?$i$465B<7r(B
$B9qN)>pJs3X8&5f=j(B TEL:03-4212-2720

Follow-Ups:
- [upki-fed:282] Re: [upki-fed:280] Re: [upki-fed:279] Re: SSL$B%"%/(B$B%;%i%l!<%?4D6-(B
  - From: kohei teraguchi

References:
- [upki-fed:276] SSL$B%"%/%;%i%l!<%?4D6-(B
  - From: kohei teraguchi
- [upki-fed:277] Re: [upki-fed:276] SSL$B%"%/%;%i(B$B%l!<%?4D6-(B
  - From: yamaji
- [upki-fed:278] Re: [upki-fed:277] Re: [upki-fed:276] SSL$B%"%/%;(B$B%i%l!<%?4D6-(B
  - From: kohei teraguchi
- [upki-fed:279] Re: SSL$B%"%/%;%i%l!<%?4D6-(B
  - From: yamaji
- [upki-fed:280] Re: [upki-fed:279] Re: SSL$B%"%/%;%i%l!<%?4D(B$B6-(B
  - From: kohei teraguchi

Prev by Date: [upki-fed:280] Re: [upki-fed:279] Re: SSL$B%"%/%;%i%l!<%?4D(B$B6-(B
Next by Date: [upki-fed:282] Re: [upki-fed:280] Re: [upki-fed:279] Re: SSL$B%"%/(B$B%;%i%l!<%?4D6-(B
Previous by thread: [upki-fed:280] Re: [upki-fed:279] Re: SSL$B%"%/%;%i%l!<%?4D(B$B6-(B
Next by thread: [upki-fed:282] Re: [upki-fed:280] Re: [upki-fed:279] Re: SSL$B%"%/(B$B%;%i%l!<%?4D6-(B
Index(es):
- Date
- Thread

[upki-fed:281] Re: [upki-fed:280] Re: [upki-fed:279] Re: SSL$B%"%/%;%i%l!<%?4D6-(B

[upki-fed:281] Re: [upki-fed:280] Re: [upki-fed:279] Re: SSL$B%"%/%;%i%l!<%?4D6-(B