All Versions
- DSpace 7.x (Current Release)
- DSpace 8.x (Unreleased)
- DSpace 6.x (EOL)
- DSpace 5.x (EOL)
- More Versions...
...
Below, we have provided a sample Apache configuration. However, as every institution has their own specific Apache setup/configuration, it is highly likely that you will need to tweak this configuration in order to get it working properly. Again, see the official mod_shib documentation for much more detail about each of these settings: https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig These configurations are meant to be added to an Apache <VirtualHost> which acts as a proxy to your Tomcat (or other servlet container) running DSpace. More information on Apache VirtualHost settings can be found at: https://httpd.apache.org/docs/2.2/vhosts/
Code Block |
---|
#### SAMPLE MOD_SHIB CONFIGURATION FOR APACHE2 (it may require local modifications based on your Apache setup) #### # While this sample VirtualHost is for HTTPS requests (recommended for Shibboleth, obviously), # you may also need/want to create one for HTTP (*:80) <VirtualHost *:443> ... # PLEASE NOTE: We have omitted many Apache settings (ServerName, LogLevel, SSLCertificateFile, etc) # which you may need/want to add to your VirtualHost # As long as Shibboleth module is installed, Enableenable all Shibboleth/mod_shib related settings <IfModule mod_shib> # Shibboleth recommends turning on UseCanonicalName # See "Prepping Apache" in https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig UseCanonicalName On # Most DSpace instances will want to use Shibboleth "Lazy Session", which ensures that users # can access DSpace content without first authenticating via Shib. # This section turns on Shibboleth "Lazy Session". Also ensures that once they have authenticated # (by accessing /Shibboleth.sso/Login path), then their Shib session is kept alive <Location /> AuthType shibboleth ShibRequireSession Off require shibboleth # If your "shibboleth2.xml" file specifies an <ApplicationOverride> setting for your DSpace, your # DSpace Service Provider, then you may need to tell Apache which "id" to redirect Shib requests to. # Just uncomment this and change the value "my-dspace-id" to the associated @id attribute value. #ShibRequestSetting applicationId my-dspace-id </Location> # If a user attempts to access the DSpace shibboleth login page, force them to authenticate via Shib <Location "/shibboleth-login"> AuthType shibboleth ShibRequireSession On # DSpace requires using Shibboleth Headers. So this MUST be "On" ShibUseHeaders On require valid-user </Location> # Ensure /Shibboleth.sso path (in Apache) can be accessed # By default it may be inaccessible if your Apache security is tight. <Location "/Shibboleth.sso"> Order deny,allow Allow from all # Also ensure Shibboleth/mod_shib responds to this path SetHandler shib </Location> # Finally, optionally you may need to ensure that requests to /Shibboleth.sso are NOT redirected # to Tomcat (as they will be handled by mod_shib instead). # NOTE: THIS SETTING IS LIKELY ONLY NEEDED IF YOU ARE USING PROXYPASS TO REDIRECT # ALL REQUESTS TO TOMCAT (e.g. ProxyPass / ajp://localhost:8080/) # ProxyPass /Shibboleth.sso ! </IfModule> ... </VirtualHost> |
...