To Generate and Customize the Service Provider Template Files

1. Log in as a root user to the host FederationManager–1.

2. Go to the following directory:

   /opt/SUNWam/saml2/bin

3. Generate the SAMLv2 template files.

   # ./saml2meta -i /var/opt/SUNWam/fm/war_staging template -u amadmin -w 11111111 -e loadbalancer-9.siroe.com -s /sp -a LoadBalancer-9 -f LoadBalancer-9-enc -m /etc/opt/SUNWam/config/saml2-sp-template.xml -x /etc/opt/SUNWam/config/saml2-sp-extented-template.xml

   The saml2-sp-extended-template.xmlis similar to the standard saml2-sp-template.xml file. However, the extended file contains data about the SAMLv2 plug-in that is specific to Federation Manager.

4. Customize the saml2–sp-template.xml file.

   When the file is first generated, default values are automatically generated and placed in the file. You must manually change these values to match the actual deployment environment. In this deployment example, a load balancer with SSL termination is being used. So you must modify the file to use the HTTPS protocol and the load balancer service URL.

   # vi /etc/opt/SUNWam/config/saml2-sp-template.xml

   1. In each Location URL and each ResponseLocation URL, change the protocol http to https.

      Search for each occurrence of Location and ResponseLocation to be sure you have changed each URL.

   2. Globally change all occurrences of FederationManager-1 to loadbalancer-9.

   3. Globally change all occurrences of 8080 to 3443.

   Save the file.

5. Customize the saml2-sp-extended-template.xml file.

   # vi /etc/opt/SUNWam/config/saml2-sp-extended-template.xml

   1. Modify the following attribute-pair values to enable XML signing.

      <Attribute name="wantArtifactResponseSigned"> <Value>true</Value> <Attribute name="wantLogoutRequestSigned"> <Value>true</Value> <Attribute name="wantLogoutResponseSigned"> <Value>true</Value> <Attribute name="wantMNIRequestSigned"> <Value>true</Value> <Attribute name="wantMNIResponseSigned"> <Value>true</Value> <Attribute name="cotlist"> <Value>saml2_circle_of_trust</Value>

6. Load the metadata.

   See 7.3 Loading the Service Provider SAMLv2 Metadata.