By jmm42 on

Overview:

I am trying to implement Shibboleth 2.x with Drupal 6 / 7. The Shibboleth module (https://drupal.org/project/shib_auth) has a documentation page that states:

  • You understand how Shibboleth works
  • You have successfully installed and configured Shibboleth SP on your host running Drupal.

- https://wiki.aai.niif.hu/index.php/DrupalShibbolethReadmeDev#Installatio...

Question(s):

  1. Do I need to install Shibboleth IdP?
    • If I don't need to install this component, is it because Drupal acts on behalf of the traditional Shibboleth IdP?

Comments

Amrendra’s picture

Amrendra commented

Hi,
I am getting issue of configuration in shibboleth authentication drupal module , I am not getting login page and i am facing issue how we will configure and how we can manage to shibboleth authentication module Please help me ....

chuck_theobald’s picture

chuck_theobald commented

Drupal does not act as an identity Provider (IdP). You need an IdP that someone provides, our University Central IS has a production and test IdP we can use.

Then your Drupal host needs to have the Service Provider (SP) software installed and configured to talk to the IdP. The files I needed to change were shibboleth2.xml and attribute-map.xml, both in the shibboleth etc/shibboleth directory. You will need to coordinate with your IdP admins so that your SP is recognized by the IdP.

With this done, your web server needs to intercept calls to [site url]/Shibboleth.sso and pass it to Drupal unchanged so that shib_auth can process appropriately. In IIS this is done with a URL rewrite. By default, all requests are rewritten to the form index.php?q={R:1} so Drupal can handle it. This rewrite needs to be avoided for shib_auth to work.

Note that, on Windows with IIS, the Shibboleth SP software writes an incorrect URL rule. The incorrect URL (incorrect regular expression) works with IIS 7, but not with IIS 10. You will need to change ^/Shibboleth.sso$ to ^/Shibboleth.sso/.*$

Finally, shib_auth needs to be configured to match your SP configuration. For our sites, we use /Shibboleth.sso/Login, which, I think, is a default for the SP software. shib_auth defaults to /Shibboleth.sso/DS, I believe.