You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 7 Next »

ONGOING WORK

Installation using the installation script

The installation script is available at https://github.com/geteduroam/letswifi-portal/blob/main/contrib/install/install-letswifi-portal.sh . The script sets up a portal at the web address (DNS entry) that you provide, with which you obtain certificates from one CA and for a specific realm, which you specify. Additionally, the script copies the metadata from the link but if automatic refresh is needed, you need to set this up later. At the end of the installation process, you get a link to find the SAML SP metadata to register with your federation. In the firewall you need to open the ports TCP/80 and TCP/443 . In order to check that everything is OK at this point, please use the command

curl -sSk --resolve DOMAIN:443:127.0.0.1 https://DOMAIN; echo

You should see an output like {"href":"./","http://letswifi.app/api#2": if the webserver is running OK internally. You should also be able to reach your server with a browser. Next, try to check the metadata with https://YOUR-ADDRESS/simplesamlphp/module.php/saml/sp/metadata.php/default-sp?output=xhtml. At this point, please obtain and install a server certificate for your web server. The configuration file is named letswifi-portal.conf.

At this point you may find out that the SimpleSAMLphp version that your OS comes with is too old. Please download a new one and install it.  Copy the apache.conf of the newly installed SimpleSAMLphp to the /config - directory and take it into use at /etc/apache2/conf-available with

ln -sf /NEW-SIMPLESAMLPHP/config/apache.conf /etc/apache2/conf-available/simplesamlphp.conf

In config.php you may need to change 'baseurlpath' from 'simplesaml/' to 'simplesamlphp/'. In /usr/share/letswifi-portal/etc/letswifi.conf.php the 'autoloadInclude' needs to be changed to point to the correct SimpleSAMLphp version. Do a web server restart.

Next, connect your SimpleSAMLphp to your federation. More extensive guidelines can be found here and here. In case you need certificates for signing and encryption, you can generate them with:

openssl req -newkey rsa:3072 -new -x509 -days 3652 -nodes -out saml-geteduroam.crt -keyout saml-geteduroam.key

In /etc/simplesamlphp/authsources.php, under ’default-sp’, please insert the following


'certificate' => '/PATH/TO/saml-geteduroam.crt',
'privatekey' => '/PATH/TO/saml-geteduroam.key',
'redirect.sign' => true,
'redirect.validate' => true,


You should see the changes in https://YOUR-ADDRESS/simplesamlphp/module.php/saml/sp/metadata.php/default-sp?output=xhtml. If needed, enable automatic metadata refresh, extensive guidelines can be found here. In the module section of /SIMPLESAMLPHP/config/config.php you need


'module.enable' => [
         'cron' => true,
         'metarefresh' => true,
         'core' => true,
         'saml' => true
 ],


instead of 'exampleauth'.

Please copy the necessary templates with


cp modules/cron/config-templates/*.php /etc/simplesamlphp/
cp modules/metarefresh/config-templates/*.php /etc/simplesamlphp/

From /modules/metarefresh/bin you can test with 

./metarefresh.php -s https://PATH/TO/your-metadata.xml



   

  • No labels