Papercut - Revision history

Jls at 10:25, 10 June 2021

2021-06-10T10:25:41Z

Dlim at 02:28, 20 August 2020

2020-08-20T02:28:50Z

Jrobertson: /* Cloudwork Configuration */

2020-05-13T00:12:15Z

Cloudwork Configuration

Jrobertson: /* Edit InProcess so we use the correct IIS site */

2020-01-16T02:14:16Z

Edit InProcess so we use the correct IIS site

Jrobertson: /* Add automatic metadata fetching */

2020-01-15T22:29:36Z

Add automatic metadata fetching

Jrobertson: /* Update SSO */

2020-01-15T22:28:43Z

Update SSO

Jrobertson: /* Setup */

2020-01-15T22:05:17Z

Setup

Jrobertson: /* Cloudwork Configuration */

2020-01-15T22:04:48Z

Cloudwork Configuration

Jrobertson: /* Setup */

2020-01-15T22:04:39Z

Setup

Dlim: /* Cloudwork Configuration */

2019-10-09T23:30:56Z

Cloudwork Configuration

@@ Line 39: / Line 39: @@
 We need to change the site name. This will be the Fully Qualified Domain Name (FQDN) that your users connect to.
-<code>  <InProcess logger="native.logger">
+  <InProcess logger="native.logger">
+    <ISAPI normalizeRequest="true" safeHeaderNames="true">
-<ISAPI normalizeRequest="true" safeHeaderNames="true">
+       <Site id="1" name="iis.domain.vm" scheme="https" port="443"/>
+    </ISAPI>
-<Site id="1" name="iis.domain.vm" scheme="https" port="443"/>
+  </InProcess>
 '''NOTE:''' If you are running Shibboleth V3 then an additional entry needs to be put into the code above. V3 requires the command useHeaders="true". Therefore, if you are implementing a Shibboleth V3 configuration, please use the code below instead, which has the useHeaders=“true” command added.
-<code>
+ <InProcess logger="native.logger">
-<InProcess logger="native.logger">
+    <ISAPI normalizeRequest="true" safeHeaderNames="true">
+       <Site id="1" name="iis.domain.vm" scheme="https" port="443" useHeaders="true" />
-<ISAPI normalizeRequest="true" safeHeaderNames="true">
+    </ISAPI>
+   </InProcess>
 === Update RequestMapper ===
@@ Line 65: / Line 58: @@
 The RequestMapper tells IIS which Paths for a certain host need to use Shibboleth for authentication. We are going to use “user” for ours so any user going to host/user will need to be logged in if not they will be taken to the login page. If you wanted to add /admin to this, you can just copy and paste the user line and replace user with admin.
-<RequestMap>
+ <RequestMapper type="Native">
-<Host name="iis.domain.vm">
+=== Update ApplicationDefaults ===
-<Path name="secure"authType="shibboleth"requireSession="true">
+The ApplicationDefaults will set the remote_user variable which will contain the headers we want to set we will want to make sure we include ppcuser here as that is what we will use in the PaperCut MF configuration for Web Auth.
-</Host> </RequestMap> </RequestMapper>
+ <ApplicationDefaults entityID="https://iis.domain.vm/shibboleth"
-=== Update ApplicationDefaults ===
+=== Add automatic metadata fetching ===
-The ApplicationDefaults will set the remote_user variable which will contain the headers we want to set we will want to make sure we include ppcuser here as that is what we will use in the PaperCut MF configuration for Web Auth.
+There are 2 ways you can load the metadata for your identity provider the first is from a local file which you would need to manually update if you ever make changes to it and the other is by using a URL which will automatically grab the metadata as needed and will make life easier later. This URL is going to be your Federation Service Name followed by /federationmetadata/2007–06/federationmetadata.xml
-=== Add automatic metadata fetching ===
+ <MetadataProvider type="XML" url="partnermetadata.xml"/>
 === Open attribute-map.xml ===
@@ Line 102: / Line 88: @@
 Now we need to tell Shibboleth where it can find the value we want to set to ppcuser, We used the Windows Account Name option in the claims issuance so that is what we will set here.
-<code>
-<Attribute name="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" id="ppcuser"/>
+ <Attribute name="User-Name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="ppcuser"/>
-</code>
 === Restart Shibboleth ===
@@ Line 110: / Line 96: @@
 You have 2 ways to do this, either load up Services Manager (services.msc) and find Shibboleth 2 Daemon and click restart or open a command prompt window and run:
-<code>
-net stop shibd_default
+ net stop shibd_default
-net start shibd_default
+ net start shibd_default
-</code>
 === IIS Configuration (Proxy) ===

@@ Line 88: / Line 88: @@
 REMOTE_USER="eppn persistent-id targeted-id ppcuser"
 cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2">
 </code>
@@ Line 161: / Line 150: @@
 Now select the pages you want to use SSO for. If you followed the steps above it will just be for the User login page but you can change it as needed. For the logout URL you can use '''https://[iis_fqdn_or_ip]/Shibboleth.sso/Logout?return=https://papercut.com''' with this option when the user logs out they will be redirected to the PaperCut website. You can change the return URL to anything you want.
 == Troubleshooting ==
@@ Line 174: / Line 159: @@
 * Shibboleth Metadata: '''https://localhost/Shibboleth.sso/Metadata'''
-* ADFS Metadata: '''https://[adfs_fqdn]/federationmetadata/2007-06/federationmetadata.xml'''
+* ADFS Metadata: '''https://<<domain_name>>/federationmetadata/2007-06/federationmetadata.xml'''
 You can also find the Shibboleth log files under C:\opt\shibboleth-sp\var\log\shibboleth. While working on this I found shibd.log to be the most useful. You can do a quick search for “ERROR” or “FATAL” and find out where it went wrong.

@@ Line 33: / Line 33: @@
 === Cloudwork Configuration ===
-Download the metadata from here enter the FQDN for your IIS Server followed by /Shibboleth.sso/Metadata (For iis.domain.vm the URL would be iis.domain.vm/Shibboleth.sso/Metadata) and then [https://wiki.studentnet.net/index.php?title=XML_file_upload upload the XML file]
+Download the metadata and from here enter the FQDN for your IIS Server followed by /Shibboleth.sso/Metadata (For iis.domain.vm the URL would be iis.domain.vm/Shibboleth.sso/Metadata) and then [https://wiki.studentnet.net/index.php?title=XML_file_upload upload the XML file]
 === Edit InProcess so we use the correct IIS site ===

← Older revision		Revision as of 02:14, 16 January 2020
Line 60:		Line 60:

	</code>		</code>
−

	=== Update RequestMapper ===		=== Update RequestMapper ===

@@ Line 107: / Line 107: @@
 <code>
-<MetadataProvider type="XML" url="https://fs.domain.vm/federationmetadata/2007-06/federationmetadata.xml"/>
+<MetadataProvider type="XML" url="partnermetadata.xml"/>
 </code>

@@ Line 96: / Line 96: @@
 <code>
-<SSO entityID="http://fs.domain.vm/adfs/services/trust"
+<SSO entityID="http://schoollogin.cloudworkengine.net/saml2/idp/metadata"
 discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
 SAML2 SAML1

@@ Line 18: / Line 18: @@
 Optionally apply a watermark / digital signature to all pages, which adds an encrypted HMAC signature to the page which can be traced back to the user who printed the document.
 When authenticating users, PaperCut interfaces directly with directory services like Active Directory or LDAP. Additionally, you can also configure single sign-on on the admin web interface and user web interface, where PaperCut will rely on an external SAML service for authentication.
 === IIS Configuration (Shibboleth) ===
@@ Line 28: / Line 34: @@
 Download the metadata from here enter the FQDN for your IIS Server followed by /Shibboleth.sso/Metadata (For iis.domain.vm the URL would be iis.domain.vm/Shibboleth.sso/Metadata) and then [https://wiki.studentnet.net/index.php?title=XML_file_upload upload the XML file]
 === Edit InProcess so we use the correct IIS site ===

← Older revision		Revision as of 22:04, 15 January 2020
Line 28:		Line 28:

	Download the metadata from here enter the FQDN for your IIS Server followed by /Shibboleth.sso/Metadata (For iis.domain.vm the URL would be iis.domain.vm/Shibboleth.sso/Metadata) and then [https://wiki.studentnet.net/index.php?title=XML_file_upload upload the XML file]		Download the metadata from here enter the FQDN for your IIS Server followed by /Shibboleth.sso/Metadata (For iis.domain.vm the URL would be iis.domain.vm/Shibboleth.sso/Metadata) and then [https://wiki.studentnet.net/index.php?title=XML_file_upload upload the XML file]
−

	=== Shibboleth Installation & Configuration ===		=== Shibboleth Installation & Configuration ===

← Older revision		Revision as of 22:04, 15 January 2020
Line 29:		Line 29:
	Download the metadata from here enter the FQDN for your IIS Server followed by /Shibboleth.sso/Metadata (For iis.domain.vm the URL would be iis.domain.vm/Shibboleth.sso/Metadata) and then [https://wiki.studentnet.net/index.php?title=XML_file_upload upload the XML file]		Download the metadata from here enter the FQDN for your IIS Server followed by /Shibboleth.sso/Metadata (For iis.domain.vm the URL would be iis.domain.vm/Shibboleth.sso/Metadata) and then [https://wiki.studentnet.net/index.php?title=XML_file_upload upload the XML file]

−	~~=== Edit Claim Issuance Policy ===~~
−
−	~~Right click the '''Party Trust''' and select '''Edit Claim Insurance Policy''' and choose the best suiting rule template.~~
−
−	Select the AD attribute to send back and what type of outgoing claim type to set this to. Give the claim a name and select '''Active Directory''' from the Attribute store. Under LDAP Attribute select SAM-Account-Name and set the Outgoing type to Windows Account Name.
−
−	~~Finish~~

	=== Shibboleth Installation & Configuration ===		=== Shibboleth Installation & Configuration ===

@@ Line 27: / Line 27: @@
 === Cloudwork Configuration ===
-Download the metadata from here enter the FQDN for your IIS Server followed by /Shibboleth.sso/Metadata (For iis.domain.vm the URL would be iis.domain.vm/Shibboleth.sso/Metadata) and then [https://wiki.studentnet.net/index.php?title=XML_file_upload| upload the XML file]
+Download the metadata from here enter the FQDN for your IIS Server followed by /Shibboleth.sso/Metadata (For iis.domain.vm the URL would be iis.domain.vm/Shibboleth.sso/Metadata) and then [https://wiki.studentnet.net/index.php?title=XML_file_upload upload the XML file]
 === Edit Claim Issuance Policy ===