<commit_before>---
date: 2021-07-30 12:30:00+02:00
slug: configuring-shibboleth-service-provider-for-safire
tags:
  - configuration
  - metadata
  - shibboleth
  - technical
title: Configuring Shibboleth Service Provider for SAFIRE
url: /technical/resources/configuring-shibboleth-service-provider-for-safire/
---

The [Shibboleth Service Provider](http://shibboleth.net/products/) has [good documentation](https://shibboleth.atlassian.net/wiki/spaces/SP3/overview), and so this is not a complete/worked example of how to configure it. Instead, this provides the SAFIRE-specific snippets you may need when working through that documentation.

# Installing Shibboleth Service Provider

Note that some package repositories ship out-of-date and [vulnerable](https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2067399654/SecurityAdvisories) versions of the Shibboleth SP. However, the Swiss federation operator (SWITCHaai) maintains [up-to-date packages for Debian and Ubuntu](http://pkg.switch.ch/switchaai/).

# Choose an entityID

Perhaps the single most important thing you can do is choose an entityID, which you'll find in the `<ApplicationDefaults>` stanza in `shibboleth2.xml`. The entityID uniquely identifies your service and *should never change*, so needs to be [chosen carefully](https://shibboleth.atlassian.net/wiki/spaces/CONCEPT/pages/928645134/EntityNaming). SAFIRE [requires]({{< ref "/technical/saml2/sp-requirements/_index.md" >}}) it be a URL rooted in DNS space you own.

# Configuring a metadata provider to fetch SAFIRE metadata

Shibboleth Service Provider provides a [reloadable XML metadata provider](https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2063696005/XMLMetadataProvider) that allows you to periodically fetch metadata. You should use this to keep SAFIRE's metadata up-to-date, checking for new metadata at least once a day (the example below checks every four hours).

## Configure Shibboleth

Edit your `shibboleth2.xml` configuration file. In the default file, you will find some example `<MetadataProvider>`s. At about that point in the file, you should add a new metadata provider to consume [SAFIRE's metadata for service providers]({{< ref "/technical/metadata.md#metadata-for-service-providers" >}}).

If you are only interested in South African institutions, your entry be similar to the following:

```xml
<MetadataProvider type="XML" validate="true"
    url="https://metadata.safire.ac.za/safire-idp-proxy-metadata.xml"
    backingFilePath="safire-idp-proxy-metadata.xml"
    maxRefreshDelay="14400">
  <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
  <MetadataFilter type="Signature" certificate="safire-metadata.crt"/>
</MetadataProvider>
```

If your service provider is going to participate in eduGAIN (internationally), you additionally need to include the [eduGAIN IdP metadata]({{< ref "/technical/metadata.md#safire-service-providers-consuming-edugain-idps" >}}):

```xml
<MetadataProvider type="XML" validate="true"
    url="https://metadata.safire.ac.za/edugain-consuming.xml"
    backingFilePath="safire-edugain-consuming.xml"
    maxRefreshDelay="14400">
  <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
  <MetadataFilter type="Signature" certificate="safire-metadata.crt" verifyBackup="false"/><commit_msg>Document HfD for Shib<commit_after>---
date: 2022-02-01 19:20:00+02:00
slug: configuring-shibboleth-service-provider-for-safire
tags:
  - configuration
  - metadata
  - shibboleth
  - technical
title: Configuring Shibboleth Service Provider for SAFIRE
url: /technical/resources/configuring-shibboleth-service-provider-for-safire/
---

The [Shibboleth Service Provider](http://shibboleth.net/products/) has [good documentation](https://shibboleth.atlassian.net/wiki/spaces/SP3/overview), and so this is not a complete/worked example of how to configure it. Instead, this provides the SAFIRE-specific snippets you may need when working through that documentation.

# Installing Shibboleth Service Provider

Note that some package repositories ship out-of-date and [vulnerable](https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2067399654/SecurityAdvisories) versions of the Shibboleth SP. However, the Swiss federation operator (SWITCHaai) maintains [up-to-date packages for Debian and Ubuntu](http://pkg.switch.ch/switchaai/).

# Choose an entityID

Perhaps the single most important thing you can do is choose an entityID, which you'll find in the `<ApplicationDefaults>` stanza in `shibboleth2.xml`. The entityID uniquely identifies your service and *should never change*, so needs to be [chosen carefully](https://shibboleth.atlassian.net/wiki/spaces/CONCEPT/pages/928645134/EntityNaming). SAFIRE [requires]({{< ref "/technical/saml2/sp-requirements/_index.md" >}}) it be a URL rooted in DNS space you own.

# Configuring a metadata provider to fetch SAFIRE metadata

Shibboleth Service Provider provides a [reloadable XML metadata provider](https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2063696005/XMLMetadataProvider) that allows you to periodically fetch metadata. You should use this to keep SAFIRE's metadata up-to-date, checking for new metadata at least once a day (the example below checks every four hours).

## Configure Shibboleth

Edit your `shibboleth2.xml` configuration file. In the default file, you will find some example `<MetadataProvider>`s. At about that point in the file, you should add a new metadata provider to consume [SAFIRE's metadata for service providers]({{< ref "/technical/metadata.md#metadata-for-service-providers" >}}).

If you are only interested in South African institutions, your entry be similar to the following:

```xml
<MetadataProvider type="XML" validate="true"
    url="https://metadata.safire.ac.za/safire-idp-proxy-metadata.xml"
    backingFilePath="safire-idp-proxy-metadata.xml"
    maxRefreshDelay="14400">
  <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
  <MetadataFilter type="Signature" certificate="safire-metadata.crt"/>
  <DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true"
    attributeName="http://macedir.org/entity-category"
    attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
    attributeValue="http://refeds.org/category/hide-from-discovery" />
</MetadataProvider>
```

If your service provider is going to participate in eduGAIN (internationally), you additionally need to include the [eduGAIN IdP metadata]({{< ref "/technical/metadata.md#safire-service-providers-consuming-edugain-idps" >}}):

```xml
<MetadataProvider type="XML" validate="true"
    url="https://metadata.safire.ac.za/edugain-consuming.xml"
    backingFilePath="safire-edugain-consuming.xml"
    maxRefreshDelay="14400">
  <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
  <MetadataFilter type="Signature" certificate="safire-metadata.crt" verifyBackup="false"/>
  <DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true"
    attributeName="http://macedir.org/entity-category"
    attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
    attributeValue="http://refeds.org/category/hide-from-discovery" />
{'fraction_non_alphanumeric': 0.11000277085065115, 'fraction_numerical': 0.021889720144084236, 'mean_word_length': 5.5627272727272725, 'pattern_counts': {'":': 0, '<': 29, '<?xml version=': 0, '>': 29, 'https://': 12, 'lorem ipsum': 0, 'www.': 0, 'xml': 16}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1092587', 'n_tokens_mistral': 2311, 'n_tokens_neox': 2137, 'n_words': 606}