1   Introduction

IdPC is an implementation of a Liberty Identity Provider in the form of several CGI C programs.

It supports the following IDFF-1.2 profiles:

• Single Sign-On and Federation (Liberty Artifact and Liberty-Enabled Client and Proxy)
• Single Logout (SOAP, initiated by SP)
• Federation Termination (SOAP, initiated by SP)

It will complete existing profiles and implement other core profiles in the future.

IdPC can authenticate users through several means including HTTP authentication and client certificates.

2   Download

IdPC releases can be downloaded from http://labs.libre-entreprise.org/download/idpc/

Development code is available using CVS (web interface):

export CVSROOT=:pserver:anonymous@cvs.labs.libre-entreprise.org:/cvsroot/idpc
cvs login     # press enter
cvs -z3 checkout idpc

3   Installation

IdPC uses automake and autoconf which should make compilation and installation a breeze. Kind of.

Basic usage is:

./configure
make
make install

It will most likely bail out because of missing libraries. You need libxml2 (XML support, used for configuration file), neon (HTTP support, used for SOAP requests), OpenSSL (OCSP support) and Lasso (Liberty Alliance support).

Additionaly, you will also need either PostgreSQL or MySQL for the database support. PostgreSQL is the default. It is possible to set the database engine to use that way:

./configure --with-dbengine=mysql

It may also be useful to set the path to the configuration files; default is ${prefix}/etc (hence /usr/local/etc/):

./configure --sysconfdir=/etc/

It is possible to combine configure flags such as:

./configure --prefix=/usr/ --sysconfdir=/etc/  --dbengine=postgresql

Compilation is then straightforward; just type make.

Once compiled; make install won't do much since there are no standard places for CGI. You can copy them (they are the executables in src/) in your favourite place. Note that if you want to use HTTP authentication; singleSignOn should be installed in a different directory.

4   IdPC Configuration

IdPC needs a configuration file to work; its location depends of compilation options; IdPC will tell you the correct path if you call one of the CGI with the --help argument:

 $ /usr/lib/cgi-bin/idpc/soapEndpoint --help
This is IdPC; it is meant to be used as a CGI

Config file should be installed as:
  /etc/idpc/config.xml

The configuration file must be a valid XML file and its root element should be named "idpc" and placed in the following namespace http://www.entrouvert.org/namespaces/idpc.

metadataFilePath:

path to the Liberty identity provider metadata file

idpPublicKey:

path to the IdP public key (PEM encoded)

idpPrivateKey:

path to the IdP private key (PEM encoded)

idpCertificate:

path to the IdP certificate (PEM encoded) (?)

serviceProvider:

element that should contains three other elements; metadataFilePath, spPublicKey and spCaCertificate. You can of course have more than one <serviceProvider> element.

authenticationMethod:

authentication method to use, detailed below

reauthenticationDelay:

The time at, or after which the service provider must reauthenticate the user against the IdP. (in seconds) (default is 7200, 2 hours)

dbhost:

hostname where the IdPC database is installed (optional)

dbport:

port where the IdPC database is listening (optional)

dbname:

name of the IdPC database

dblogin:

login to connect to the IdPC database

dbpassword:

password to connect to the IdPC database

ocspCheck:

true to use OCSP to check certificates (default false)

ocspUrl:

URL to the OCSP service for certificate validation (optional) (fallback if the user certificate doesn't have a proper authority info access element)

ocspIssuer:

path to the OCSP issuer certificate (PEM encoded)

5   Apache Configuration

Imagine soapEndPoint has been installed in /usr/lib/cgi-bin/idpc/ and singleSignOn (and other service URLs) in /usr/lib/cgi-bin/idpc/auth/. Apache CGI configuration will typically look as follow:

ScriptAlias /idpc/ /usr/lib/cgi-bin/idpc/

<Directory /usr/lib/cgi-bin/idpc/>
  AllowOverride None
  Options ExecCGI -MultiViews +SymLinksIfOwnerMatch
  Order allow,deny
  Allow from all
</Directory>

For HTTP authentication Apache must be configured to restrict access to the service URLs (singleSignOn, singleLogout, federationTermination); it may done as follow:

<Directory /usr/lib/cgi-bin/idpc/auth>
  AuthType Basic
  AuthName "IdPc"
  AuthUserFile /etc/apache/passwd
  Require valid-user
</Directory>

For X.509 certificate authentication Apache must be configured with the following SSL options:

SSLOptions +ExportCertData
SSLOptions +StdEnvVars
SSLOptions +ExportCertData

Additionally it is necessary to cache SSL session for some versions of Microsoft Internet Explorer; this is done through the SSLSessionCache directive:

SSLSessionCache dbm:/var/log/apache/ssl-session-cache.dbm
SSLSessionCacheTimeout 600

See mod_ssl FAQ for details on browser quirks.

6   Database configuration

CREATE USER idpc PASSWORD 'pass';

CREATE TABLE nameidentifiers (
      name_identifier varchar(100) primary key,
      user_id         varchar(100)
);

CREATE TABLE users (
      user_id         varchar(100) primary key,
      user_dump       text,
      session_dump    text
);

CREATE TABLE assertions (
      artifact        varchar(100),
      assertion       text
);

GRANT DELETE, INSERT, SELECT, UPDATE ON nameidentifiers TO idpc;
GRANT DELETE, INSERT, SELECT, UPDATE ON users TO idpc;
GRANT DELETE, INSERT, SELECT, UPDATE ON assertions TO idpc;

# TYPE   DATABASE    USER    IP-ADDRESS    IP-MASK            METHOD
host     idpc        idpc    127.0.0.1     255.255.255.255    password

7   Liberty Metadata Files

Liberty metadata files are XML files with details about protocols implemented by the provider and their URLs. The exact URLs will depend upon the Apache configuration but here is a mapping between metadata elements and script names.

8   Copyright and License

IdPC (both code and documentation) is copyright © 2004 Entr'ouvert and released under the GNU General Public License.