You MUST NOT continue to installation until you’ve worked through the checklists below. Environmental preparation is critical to a successful outcome. 

These requirements apply to both new installations and upgrades from version 3 of Shibboleth

TABLE OF CONTENTS

• Required Checklist
• Upgrading
• Ansible Package
• Server connectivity
• Environmental data for your IdP
  • Mandatory
  • Logging configuration
  • LDAP connection information
  • Policy settings
  • Advances setting
• Next steps

Required Checklist

A dedicated CentOS Stream, Rocky or RedHAT version 8 or 9 or Ubuntu 20.04 or 22.04 (virtual or physical), with the following minimum specifications: 

• 2 CPU
• 4GB RAM
• 10GB+ partition for OS

The AAF recommends CentOS Stream only be used in the AAF Test environment, NOT as a production IdP.

Upgrading

If you are using the installer to upgrade from version 4 it is highly recommended that perform the installation on a new clean server and migrate required configuration as described in this documentation. This is necessary if your v4 server is running a version 7 CentOS, REDHat or similar that are no longer supported by the installer or the Shibboleth IdP software.

NOTE: If you choose to run the installer on the same server as your v4 IdP, the v4 IdP will not function after the install of v5. This may result in an outage for your users.

Upgrading to a new server allows you to run both new and old simultaneously allowing you to fully test the functionality of your new IdP with minimal disruption to your users.

Ansible Package

Access to additional software repositories are required to provide software such as Ansible. For CentOS the Extra Packages for Enterprise Linux (EPEL) are required. Please refer to the Fedora Wiki - EPEL for additional information. 

Server connectivity

• You MUST have SSH access to the server
• You MUST be able to execute commands as root on the system without limitation
• The server MUST be routable from the public internet with a static IP. Often this means configuring the IP on a local network interface directly but advanced environments may handle this differently.
• The static IP MUST have a publicly resolvable DNS entry. Typically of the form idp.example.edu

• The server MUST be able to communicate with the wider internet without blockage due to firewall rules. All publicly routable servers MUST be accessible for:

Each of the following commands MUST succeed when run on your server:

• curl http://example.edu
• curl https://example.edu

If direct access is not available, a web proxy will be required! This will allow the installer to access required content on the Internet.

If direct access is not available, then prior to running the Installer and deploy scripts you MUST set the following environment variable; Additional configuration within the IdP will also be required to use the web proxy.

export https_proxy=wwwcache.example.edu:80

The server MUST be accessible from the wider internet without blockage due to firewall rules for:

Please refer to the Advanced IdPv4 configuration section If you have is a load balancer or similar between your IdP and the Internet.

Environmental data for your IdP

The following information is required by the AAF IdP Installer and must be populated into the bootstrap-v5.ini file prior to running the installer. This applies to both new installations and migrations from V4.

Mandatory

Values required by the IdP to function.

Logging configuration

To enable your IdP to send anonymized logs to the AAF you will need to obtain the keys from the AAF Federation Manger tool under the Identity Providers / F-Ticks Credentials.

LDAP connection information

If your IdP connects to an LDAP directory or Active Directory server for authentication and attribute resolution you will need to gather the following information.  This information is provided using the bootstrap-v5.ini file in the [ldap] section.

The AAF IdP installer only supports connection to one LDAP server. Shibboleth can support multiple LDAP servers as well as other sources of authentication and attributes, including another SAML or OIDC IdP. You’ll need to undertake further customisation during the installation process when prompted. Each of these scenarios are currently outside of the installers scope.

If your LDAP connection is over LDAPS or startTLS you will need the root and intermediate certificates that make up the certificate chain to the LDAP certificate the protects the LDAP endpoint.

Policy settings

The following settings are used to configure the IdP based on conformance to each of the policies. Additional changes to your IdPs metadata will be required in the AAF Federation Manager to signal compliance to services in the federation and eduGAIN. 

Advances setting

The following settings are to support either advances features or features the are no longer supported by the AAF but are supported by the software.

Next steps

For all new installs and migrations from version 4, once you’ve finalised this checklists and completed editing bootstrap-v5.ini file please continue to the installation stage.