{"id":372,"date":"2018-08-19T16:34:28","date_gmt":"2018-08-19T14:34:28","guid":{"rendered":"http:\/\/remivernier.com\/?p=372"},"modified":"2018-11-21T11:05:59","modified_gmt":"2018-11-21T10:05:59","slug":"installer-shibboleth-sp-sous-iis-8","status":"publish","type":"post","link":"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/","title":{"rendered":"Installer Shibboleth SP 3.0 sous IIS 8 ou 10"},"content":{"rendered":"

Cette article d\u00e9taille l’installation et la configuration l’extension ISAPI Shibboleth fournisseur de services (Service Provider, SP) en environnent Microsoft IIS 8 (Windows 2012 R2). La m\u00e9thode appliqu\u00e9e fonctionne aussi parfaitement sous IIS 10 (Windows 2016). Nous proc\u00e9derons par \u00e9tapes pour aboutir \u00e0 un fournisseur de services Shibboleth op\u00e9rationnel. La premi\u00e8re \u00e9tape consistera \u00e0 installer les pr\u00e9-requis.<\/p>\n

Avant de commencer, je vous rappelle qu’il est tr\u00e8s important de maintenir un serveur \u00e0 l’heure une diff\u00e9rence de temps trop importante peut g\u00e9n\u00e9rer des erreurs de type: An invalid SAML Response was received: Assertion not yet valid<\/strong><\/em><\/p><\/blockquote>\n

Pr\u00e9requis<\/h2>\n

Le r\u00f4le IIS8 doit bien sur \u00eatre install\u00e9 sur la plateforme sur laquelle nous souhaitons utiliser\u00a0Shibboleth SP. Une installation par d\u00e9faut de IIS suffit mais il faudra bien faire attention que ISAPI Extention et Filters soient s\u00e9lectionn\u00e9s:<\/p>\n

\"\"<\/p>\n

Dans cet article le site et le pool d’application par d\u00e9faut seront utilis\u00e9s. Si un autre site doit \u00eatre utilis\u00e9, il faudra noter l’ID qui lui correspond. Cette information sera utile \u00e0 la configuration de Shibboleth.<\/p>\n

\"\"<\/p>\n

Les protocoles de f\u00e9d\u00e9ration comme SAML imposent le HTTPS comme protocole de transport. L’utilisation de HTTP n’est donc normalement \u00e0 envisager.<\/p>\n

Si le serveur h\u00e9berge plusieurs site sur le port 443, il faudra pr\u00e9voir d’utiliser SNI et pr\u00e9ciser le hostname dans le champ appropri\u00e9.<\/p>\n

\"\"<\/p>\n

<\/h2>\n

\u00a0Installation de l’extension ISAPI Shibboleth<\/h2>\n

Le msi d’installation de Shibboleth SP (shibboleth-sp-3.0.2.0-win64.msi) est disponible \u00e0 l’adresse suivante:\u00a0http:\/\/shibboleth.net\/downloads\/service-provider\/latest\/win64\/<\/p>\n

Une fois l’installation du MSI termin\u00e9e, il est conseill\u00e9 de red\u00e9marrer le serveur.<\/p>\n

Le service\u00a0Shibboleth\u00a0 Daemon ci dessous doit \u00eatre d\u00e9marr\u00e9:
\n\"\"<\/p>\n

Le r\u00e9pertoire d’installation d’installation des composants de Shibboleth est:\u00a0C:\\opt\\shibboleth-sp\\<\/p>\n

Nous allons \u00e0 pr\u00e9sent d\u00e9clarer un nouveau filtre ISAPI<\/strong> dans IIS. Nous allons le d\u00e9clarer uniquement sur le site par d\u00e9faut. Nous pourrions si besoin le faire sur la configuration globale IIS.<\/p>\n

En s\u00e9lectionnant Default Web Site<\/strong>, dans le panneau de droite vous devez trouver la partie IDAPI Filter. Cliquer sur \u00ab\u00a0Add\u00a0\u00bb puis saisir les informations ci dessous:<\/p>\n

Name:<\/strong> Shibboleth
\nExecutable:<\/strong>\u00a0C:\\opt\\shibboleth-sp\\lib64\\shibboleth\\isapi_shib.dll<\/p>\n

\"\"<\/p>\n

 <\/p>\n

Puis ajouter un module Mapping<\/strong> dans les Handler Mappings. <\/strong>En\u00a0s\u00e9lectionnant Default Web Site<\/strong>, dans le panneau de droite vous devez trouver la partie Handler Mappings<\/strong>. Cliquer sur \u00ab\u00a0Add Module Mapping\u00a0\u00bb puis saisir les informations ci dessous:<\/p>\n

Request path:\u00a0<\/strong>*.sso
\nExecutable:<\/strong>\u00a0C:\\opt\\shibboleth-sp\\lib64\\shibboleth\\isapi_shib.dll
\nModule: <\/strong>IsapiModule
\nName:<\/strong> Shibboleth<\/p>\n

\"\"<\/p>\n

Cliquer sur Request Restrictions…et d\u00e9cocher la case \u00ab\u00a0Invoque handler only if request is mapped to\u00a0\u00bb<\/p>\n

\"\"<\/p>\n

A pr\u00e9sent il doit \u00eatre possible de lancer \u00e0 partir d’un navigateur l’URL\u00a0https:\/\/monsite.test.local\/Shibboleth.sso\/Metadata (monsite.test.local correspond \u00e0 ce qui a \u00e9t\u00e9 \u00ab\u00a0bind\u00e9\u00a0\u00bb dans la configuration du site IIS.<\/p>\n

Pour aller plus loin, vous pouvez consulter l’article ci apr\u00e8s qui utilise Shibboleth dans un sc\u00e9nario d’authentification SAML \/ Azure AD:\u00a0https:\/\/remivernier.com\/index.php\/2018\/08\/18\/saml-azuread\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Cette article d\u00e9taille l’installation et la configuration l’extension ISAPI Shibboleth fournisseur de services (Service Provider, SP) en environnent Microsoft IIS 8 (Windows 2012 R2). La m\u00e9thode appliqu\u00e9e fonctionne aussi parfaitement sous IIS 10 (Windows 2016). Nous proc\u00e9derons par \u00e9tapes pour aboutir \u00e0 un fournisseur de services Shibboleth op\u00e9rationnel. La premi\u00e8re \u00e9tape consistera \u00e0 installer les<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,36,47],"tags":[35,6,29,34],"class_list":["post-372","post","type-post","status-publish","format-standard","hentry","category-protocoles","category-saml","category-shibboleth-protocoles","tag-federation","tag-iis","tag-saml","tag-shibboleth"],"yoast_head":"\nInstaller Shibboleth SP 3.0 sous IIS 8 ou 10 - R\u00e9mi VERNIER<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Installer Shibboleth SP 3.0 sous IIS 8 ou 10 - R\u00e9mi VERNIER\" \/>\n<meta property=\"og:description\" content=\"Cette article d\u00e9taille l’installation et la configuration l’extension ISAPI Shibboleth fournisseur de services (Service Provider, SP) en environnent Microsoft IIS 8 (Windows 2012 R2). La m\u00e9thode appliqu\u00e9e fonctionne aussi parfaitement sous IIS 10 (Windows 2016). Nous proc\u00e9derons par \u00e9tapes pour aboutir \u00e0 un fournisseur de services Shibboleth op\u00e9rationnel. La premi\u00e8re \u00e9tape consistera \u00e0 installer les\" \/>\n<meta property=\"og:url\" content=\"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/\" \/>\n<meta property=\"og:site_name\" content=\"R\u00e9mi VERNIER\" \/>\n<meta property=\"article:published_time\" content=\"2018-08-19T14:34:28+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-11-21T10:05:59+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/remivernier.com\/wp-content\/uploads\/2018\/08\/installer-shibboleth-sp-sous-iis-8-img1.jpg\" \/>\n<meta name=\"author\" content=\"R\u00e9mi\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"R\u00e9mi\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/\",\"url\":\"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/\",\"name\":\"Installer Shibboleth SP 3.0 sous IIS 8 ou 10 - R\u00e9mi VERNIER\",\"isPartOf\":{\"@id\":\"https:\/\/remivernier.com\/#website\"},\"datePublished\":\"2018-08-19T14:34:28+00:00\",\"dateModified\":\"2018-11-21T10:05:59+00:00\",\"author\":{\"@id\":\"https:\/\/remivernier.com\/#\/schema\/person\/a4c76c63a5a3d94454484845e42fc906\"},\"breadcrumb\":{\"@id\":\"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/remivernier.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Installer Shibboleth SP 3.0 sous IIS 8 ou 10\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/remivernier.com\/#website\",\"url\":\"https:\/\/remivernier.com\/\",\"name\":\"R\u00e9mi VERNIER\",\"description\":\"Active Directory Services, Azure & co...\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/remivernier.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/remivernier.com\/#\/schema\/person\/a4c76c63a5a3d94454484845e42fc906\",\"name\":\"R\u00e9mi\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\/\/remivernier.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f750448bc07f5d1d9c1189344283777ec0d33275c184599b199fb6b305bc6fba?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f750448bc07f5d1d9c1189344283777ec0d33275c184599b199fb6b305bc6fba?s=96&d=mm&r=g\",\"caption\":\"R\u00e9mi\"},\"sameAs\":[\"http:\/\/www.linkedin.com\/in\/remi-vernier\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Installer Shibboleth SP 3.0 sous IIS 8 ou 10 - R\u00e9mi VERNIER","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/","og_locale":"fr_FR","og_type":"article","og_title":"Installer Shibboleth SP 3.0 sous IIS 8 ou 10 - R\u00e9mi VERNIER","og_description":"Cette article d\u00e9taille l’installation et la configuration l’extension ISAPI Shibboleth fournisseur de services (Service Provider, SP) en environnent Microsoft IIS 8 (Windows 2012 R2). La m\u00e9thode appliqu\u00e9e fonctionne aussi parfaitement sous IIS 10 (Windows 2016). Nous proc\u00e9derons par \u00e9tapes pour aboutir \u00e0 un fournisseur de services Shibboleth op\u00e9rationnel. La premi\u00e8re \u00e9tape consistera \u00e0 installer les","og_url":"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/","og_site_name":"R\u00e9mi VERNIER","article_published_time":"2018-08-19T14:34:28+00:00","article_modified_time":"2018-11-21T10:05:59+00:00","og_image":[{"url":"http:\/\/remivernier.com\/wp-content\/uploads\/2018\/08\/installer-shibboleth-sp-sous-iis-8-img1.jpg"}],"author":"R\u00e9mi","twitter_card":"summary_large_image","twitter_misc":{"\u00c9crit par":"R\u00e9mi","Dur\u00e9e de lecture estim\u00e9e":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/","url":"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/","name":"Installer Shibboleth SP 3.0 sous IIS 8 ou 10 - R\u00e9mi VERNIER","isPartOf":{"@id":"https:\/\/remivernier.com\/#website"},"datePublished":"2018-08-19T14:34:28+00:00","dateModified":"2018-11-21T10:05:59+00:00","author":{"@id":"https:\/\/remivernier.com\/#\/schema\/person\/a4c76c63a5a3d94454484845e42fc906"},"breadcrumb":{"@id":"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/remivernier.com\/index.php\/2018\/08\/19\/installer-shibboleth-sp-sous-iis-8\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/remivernier.com\/"},{"@type":"ListItem","position":2,"name":"Installer Shibboleth SP 3.0 sous IIS 8 ou 10"}]},{"@type":"WebSite","@id":"https:\/\/remivernier.com\/#website","url":"https:\/\/remivernier.com\/","name":"R\u00e9mi VERNIER","description":"Active Directory Services, Azure & co...","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/remivernier.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"fr-FR"},{"@type":"Person","@id":"https:\/\/remivernier.com\/#\/schema\/person\/a4c76c63a5a3d94454484845e42fc906","name":"R\u00e9mi","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/remivernier.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/f750448bc07f5d1d9c1189344283777ec0d33275c184599b199fb6b305bc6fba?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f750448bc07f5d1d9c1189344283777ec0d33275c184599b199fb6b305bc6fba?s=96&d=mm&r=g","caption":"R\u00e9mi"},"sameAs":["http:\/\/www.linkedin.com\/in\/remi-vernier"]}]}},"_links":{"self":[{"href":"https:\/\/remivernier.com\/index.php\/wp-json\/wp\/v2\/posts\/372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/remivernier.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/remivernier.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/remivernier.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/remivernier.com\/index.php\/wp-json\/wp\/v2\/comments?post=372"}],"version-history":[{"count":16,"href":"https:\/\/remivernier.com\/index.php\/wp-json\/wp\/v2\/posts\/372\/revisions"}],"predecessor-version":[{"id":786,"href":"https:\/\/remivernier.com\/index.php\/wp-json\/wp\/v2\/posts\/372\/revisions\/786"}],"wp:attachment":[{"href":"https:\/\/remivernier.com\/index.php\/wp-json\/wp\/v2\/media?parent=372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/remivernier.com\/index.php\/wp-json\/wp\/v2\/categories?post=372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/remivernier.com\/index.php\/wp-json\/wp\/v2\/tags?post=372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}