test

Deployment Example 2: Federation Using SAML v2

ProcedureTo Load the Identity Provider Metadata into the Service Provider Servers

  1. As a root user, log into the Federation Manager 1 host.

  2. Copy the following Identity Provider configuration files from the Access Manager host to the Federation Manager host:


    /etc/opt/SUNWam/config/saml2-idp-template.xml
/etc/opt/SUNWam/config/saml2-idp-extended-template.xml

    In this deployment example, the files are copied to the following directory on the Federation Manager host:


    /etc/opt/SUNWam/config/

  3. Customize the saml2-idp-extended-template.xml file.


    # cd /etc/opt/SUNWam/config/
# vi saml2-idp-extended-template.xml

    1. Go to the following directory:


      
      		

      

      

      2. 


    2. 

      Open the saml2-idp-extended-template.xml file.
      


      3. 


    3. 

      Set the following parameter value:
      


      

      


      

      <EntityConfig xmlns="urn:sun:fm:SAML:2.0:entityconfig"
			xmlns:fm="urn:sun:fm:SAML:2.0:entityconfig"
			hosted="0"
			
      
      		

      

      

      This indicates that you are using the a configuration from a
remote host. A 1 value indicates that the configuration
is provided by the local host.
      


      Save the file.
      


      4. 


    

    4. 


  4. 

    Load the customized Identity Provider configuration files.
    


    

    


    

    # /opt/SUNWam/saml2/bin/saml2meta 
-i /var/opt/SUNWam/fm/war_staging import -u amadmin -w 11111111
-m /etc/opt/SUNWam/config/saml2-idp-template.xml 
-x /etc/opt/SUNWam/config/saml2-idp-extended-template.xml
File "/etc/opt/SUNWam/config/idp/saml2-idp-template.xml" was 
imported successfully.
File "/etc/opt/SUNWam/config/idp/saml2-idp-extended-template.xml" was 
imported successfully.
    
    		

    

    

    5. 


  5. 

    Restart the Federation Manager Servers.
    


      


    1. 

      As a root user, log into the Federation Manager 1 host. 
      


      

      


      

      # cd /opt/SUNWwbsvr/https-FederationManager-1.siroe.com
# ./stop; ./start
      
      		

      

      

      2. 


    2. 

      As a root user, log into the Federation Manager 2 host.
      


      

      


      

      # cd /opt/SUNWwbsvr/https-FederationManager-2.siroe.com
# ./stop; ./start
      
      		

      

      

      3. 


    

    6. 


  6. 

    Verify that both Service Provider and Identity Provider
belong to the same circle of trust.
    


    Run the cotmember command to display a list of entities in the circle of
trust.
    


    

    


    

    # /opt/SUNWam/saml2/bin/saml2meta -i /var/opt/SUNWam/fn/war_staging 
cotmember -u amadmin -w 11111111 -t saml2_circle_of_trust
Entity ID:loadbalancer-9.siroe.com
Entity ID:loadbalancer-3.example.com
Circle of trust "saml2_circle_of_trust" is listed successfully. 
    
    		

    

    

    7.