Installation Overview
- Extracting Certificate Authentication Provider distribution package
- Creating SAML identity provider configuration
- Modifying PKI policy
- Exporting SAML identity provider metadata
- Configuring GlobalSign Authentication Server
- Importing service provider metadata
- Deploying Certificate Authentication Provider
Requirements
System Requirements
- SSL connection configured on an application server or SSL reverse-proxy
- GlobalSign SSO Server 6.5 or later
Additional Requirements
- Time synchronization is required between the service provider and identity provider. If this is not possible for some isolated test case, this can be worked around by setting the service provider's server time slightly ahead of the identity provider, but this is under no circumstances a recommended practice, especially in a production environment.
- For information about the Network Time Protocol, refer to following URLs.
- NTP: The Network Time Protocol
http://www.ntp.org - Windows Time Service Technical Reference
http://technet2.microsoft.com/WindowsServer/en/library/a0fcd250-e5f7-41b3-b0e8-240f8236e2101033.mspx
- NTP: The Network Time Protocol
Required Files
-
certap-<version>.zip
PKI Requirements
- A root certificate for verifying the certificates the user
- An optional HTTP or LDAP address for the CRL distribution point, or HTTP address to OCSP server
The Certificate Authentication Provider installation includes the complete PKI files and settings for the Finnish National Electronic ID card (HST).
Preparing for Installation
Before proceeding with installation, the following configuration decisions must be made:
- Decide the deployment URL for Certificate Authentication Provider. Later in this guide, the deployment URL is referred as the base URL. Example: https://example.com/certap
- Decide the trusted certificate issuers and acquire their certificates in base64 encoded format. Resolve the CRL distribution point/OCSP server for each trusted issuer.
- Decide which attributes are transmitted to Ubisecure Authentication Server in addition to the user's subject. Please refer to later this documentation for more information about the possible attribute values.