...
| Bloc de code |
|---|
|
<VirtualHost *:80>
ServerName esup-nfc-tag.univ-ville.fr
ServerAdmin webmaster@univ-ville.fr
DocumentRoot /var/www/html
ErrorLog ${APACHE_LOG_DIR}/error_esup-nfc-tag.log
CustomLog ${APACHE_LOG_DIR}/access_esup-nfc-tag.log combined
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
RewriteRule ^/(.*)$ https://esup-nfc-tag.univ-ville.fr/$1 [L,R]
</VirtualHost>
<VirtualHost *:443>
ServerName esup-nfc-tag.univ-ville.fr
ServerAdmin webmaster@univ-ville.fr
DocumentRoot /var/www/html
ErrorLog ${APACHE_LOG_DIR}/error_esup-nfc-tag.log
CustomLog ${APACHE_LOG_DIR}/access_esup-nfc-tag.log combined
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/esup-nfc-tag.univ-ville.fr/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/esup-nfc-tag.univ-ville.fr/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/esup-nfc-tag.univ-ville.fr/chain.pem
ProxyPass /Shibboleth.sso !
ProxyPass /secure !
ScriptAlias /secure /var/www/printenv.pl
ShibCompatValidUser Off
<Location /Shibboleth.sso>
SetHandler shib
# Security measure: remove any client-supplied REMOTE_USER header early. AuthType None
Require all granted
</Location>
<Location /shibboleth-sp>
AuthType None
Require all granted
</Location>
Alias /shibboleth-sp/main.css /usr/share/shibboleth/main.css
<Location /secure>
AuthType shibboleth
ShibRequestSetting requireSession 1
require shib-session
ShibUseHeaders On
ShibRequestSetting applicationId esup-nfc-tag
</Location>
RequestHeader unset <Location /manager>
AuthType shibbolethREMOTE_USER early
ShibRequestSetting requireSession 1<Location /Shibboleth.sso>
requireSetHandler shib-session
ShibUseHeadersAuthType OnNone
ShibRequestSettingRequire applicationId esup-nfc-tagall granted
</Location>
<Location /admin>shibboleth-sp>
AuthType shibbolethNone
ShibRequestSettingRequire requireSessionall 1granted
</Location>
requireAlias shib-/shibboleth-sp/main.css /usr/share/shibboleth/main.css
<Location /secure>
AuthType shibboleth
ShibRequestSetting requireSession 1
require shib-session
ShibUseHeaders On
ShibRequestSetting applicationId esup-nfc-tag
</Location>
<Location /nfc>manager>
AuthType shibboleth
ShibRequestSetting requireSession 1
require shib-session
ShibUseHeaders On
ShibRequestSetting applicationId esup-nfc-tag
</Location>
ProxyPass<Location / ajp://localhost:8309/ ttl=10 timeout=3600 retry=1
admin>
AuthType shibboleth
ShibRequestSetting requireSession 1
require shib-session
ShibUseHeaders On
ShibRequestSetting applicationId esup-nfc-tag
</Location>
<Location /nfc>
AuthType shibboleth
ShibRequestSetting requireSession 1
require shib-session
ShibUseHeaders On
ShibRequestSetting applicationId esup-nfc-tag
</Location>
ProxyPass / ajp://localhost:8309/ ttl=10 timeout=3600 retry=1
AddOutputFilterByType DEFLATE text/plain text/html text/css text/javascript application/x-javascript application/javascript application/json image/svg+xml
</VirtualHost> |
...
| Bloc de code |
|---|
|
<ApplicationDefaults entityID="https://esup-sgc.univ-ville.fr" ...>
<Sessions ...>
<!--
<SSO entityID="https://idp.univ-ville.fr/idp/shibboleth">
SAML2 SAML1
</SSO>
-->
<SSO location="/"
discoveryProtocol="SAMLDS" discoveryURL="https://discovery.renater.fr/renater"> discoveryProtocol="SAMLDS" discoveryURL="https://discovery.renater.fr/renater">
SAML2 SAML1
SAML2 SAML1
</SSO> |
Concernant la gestion des sessions, obligez l'usage de https pour les cookies mais permettez un changement d'IP de l'utilisateur (certains fournisseurs d'accès internet bas coût ne fixe pas les IPs de leurs clients en mobile) : checkAddress et consistentAddress doivent être à false.
Exemple :
| Bloc de code |
|---|
|
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" consistentAddress="false" handlerSSL="true" cookieProps="https"
</SSO> redirectLimit="exact"> |
Penser à modifier le contact du support:
...