This is the Concourse deployment pipeline for shibboleth-boshrelease
Using the UAA database with shibboleth for authentication
For this deployment of
shibboleth-boshrelease we're leveraging the UAA
database to authenticate against the UAA db
user table and a custom table
totp_seed for joining users with TOTP seed tokens and potentially other
things in the future.
Schema modifications for UAA database
There are two tables which are created for Shibboleth to work properly for TOTP
authentication and multi-zone Shibboleth HA. These tables modify the
TOTP seed table for multi-factor authentication
The schema for the
totp_seed table in the UAA database is here in
cg-provision. Three columns are required which are the
seed columns. This will allow Shibboleth to leverage the
18F/Shibboleth-IdP3-TOTP-Auth fork to read and save TOTP seed
tokens to the UAA database.
CREATE TABLE IF NOT EXISTS totp_seed ( username varchar(255) PRIMARY KEY, seed varchar(36), backup_code varchar(36) )
Storage records table for multi-zone Shibboleth HA
The schema for the
storagerecords table in the UAA database is here in
cg-provision. This table is used to maintain
session state between Shibboleth instances across availability zones.
CREATE TABLE storagerecords ( context varchar(255) NOT NULL, id varchar(255) NOT NULL, expires bigint DEFAULT NULL, value text NOT NULL, version bigint NOT NULL, PRIMARY KEY (context, id) )
For more information on this, take a look here.
Rotating signing and encryption certificates for Shibboleth
Use bosh interpolate to generate these certs, e.g. for production:
bosh interpolate --vars-file=bosh/varsfiles/production.yml --vars-store=prod-creds.yml bosh/manifest.yml
Be sure to add the bosh ca (which is also the default_ca) as either a vars file argument or just copy and paste into the file
bosh/varsfiles/production.yml. The new creds will be stored in
prod-creds.yml. Remove the
END lines from the certs; add these certs to the vars store for shibboleth and deploy. To finish the rotation, also find and replace these certs in the idp metadata xml for the respective CloudFoundry deployment and deploy CF.