An Overview of the Configuration Files

Steps required to integrate SAML SP to a web application are described in this chapter. An overview of the SAML SP configuration files created or modified during the process is shown in Listing 1 . The location of the web application is denoted with <webapp_directory> and should be replaced with the actual directory.

The steps are:

1. The application’s deployment descriptor web.xml is modified to include the SAML SP servlet and filter configuration.
2. The provided binary libraries are copied to the WEB-INF\lib directory.
3. The provided logger configuration logback.xml is copied to WEB-INF\classes directory.
4. SAML SP identity information is created to the WEB-INF\saml2\sp directory and the IDP metadata is copied to the WEB-INF\saml2\sp\metadata directory.

<webapp_directory>\WEB-INF\web.xml		   					                          [servlet and filter configuration] 
<webapp_directory>\WEB-INF\lib\*.jar						                        [SAML SP binary libraries]
<webapp_directory>\WEB-INF\classes\logback.xml              [SAML SP logger configuration for Logback]
<webapp_directory>\WEB-INF\saml2\sp\identity.properties		     [SAML SP identity]
<webapp_directory>\WEB-INF\saml2\sp\metadata\metadata.xml	   [IDP metadata]

Copying the Binary Libraries

Copy the binary libraries from ubispservlet/webapp/WEB-INF/lib to the WEB-INF/lib directory of the web application.

cd ubispservlet\webapp\WEB-INF\lib
copy lib\*.jar <webapp_directory>\WEB-INF\lib\.

SAML SP application logging

The SAML SP package uses SLF4J API and distributed with Logback logger implementation and a configuration file for it.

If the web application uses different logger implementation than Logback then do not copy logback*.jar files to the <webapp_directory>\WEB-INF\lib or remove them from there if they were copied. In this case to enable SAML SP logging it may require to add the additional dependencies for SLF4J depending on the logger implementation.

If the web application uses Logback as well consider also to copy the provided configuration:

cd ubispservlet\webapp\WEB-INF
copy classes\logback.xml <webapp_directory>\WEB-INF\classes\

Create the SAML Service Provider identity

...

The HTTP endpoint is the fully qualified URL address where ServiceProviderServlet is bound. The path of ServiceProviderServlet is /spsso.
The identity is generated into a file named identity.properties. This file is located in the /WEB-INF/saml2/sp/identity.properties path of the web application.

...

<path_to_ubispservlet> is the path were the SAML SP servlet package was extracted to.

cd <webapp_directory>\WEB-INF
mkdir saml2\sp
java -jar lib\sso-ubisaml2<path_to_ubispservlet>\tools\metadata-generator.jar Generate https://sp.example.com/webapp/spsso -o saml2\sp

...

SAML metadata is an XML formatted document. The metadata represents the public information about the Service Provider identity.

cd <webapp_directory>\WEB-INF
java -jar lib\sso-ubisaml2<path_to_ubispservlet>\tools\metadata-generator.jar Metadata saml2\sp -f c:\temp\sp.xml

...

If your application uses an attribute authority (AA) for attribute queries, you should copy the AA metadata to /WEB-INF/saml2/sp/metadata folder together with the IDP metadata file. The name of each file is insignificant, but should have the suffix .xmlfilenames must match, for example metadata.xml and metadata.href.

Key rotation

In order to use Key Rotation feature and update IDP/AA metadata automatically a ".href" file must exist. Don't be confused with the file extension since it is just a normal properties file in "key=value" format.

...

The following properties are supported in ".href" file:

The example:

entityId=https://localhost:8443/uas
type=AAIDP
url=https://localhost:8443/uas/saml2/metadata.xml
refreshInterval=20

...