History: Shibboleth Authentication

            -=Shibboleth Authentication for TikiWiki=-


To Enable Shibboleth Authentication you will need to Do 2 main Steps.

!!!Shibboleth Step 1: Update the Wiki

To enable Shibboleth authentication within the Wiki goto the Admin page and in dropdown box select Shibboleth

When Selected Goto the bottom to the Shibboleth Seettings.

Below is a table of the options and what they do.

~tc~ Preference documentation generated from https://sourceforge.net/p/tikiwiki/code/HEAD/tree/trunk/lib/prefs/ ~/tc~
~tc~ To update documentation see https://dev.tiki.org/How-to-get-commit-access ~/tc~
{PREFDOC(tab="login-shibboleth")/}

When the above is completed the wiki is ready to use shibboleth as an authentication source. You will now need to ensure that shibboleth is setup correctly.

Below are the files that were modified to enable Shibboleth Authentication;
* lib/userslib.php
* templates/modules/mod-login_box.tpl
* templates/tiki-admin-include-login.tpl
* tiki-admin_include_login.php
* tiki-setup_base.php

Below is a table of these files and a description of the changes;

||__File name__|__Description__
userslib.php|This is used to validate a shibboleth user, changes have been made to the validate_user function.
tiki-admin-include-login.tpl|This file needs to be changed to display “Login through Shibboleth�? login box when not loged in.
tiki-admin-include-login.tpl|This file needs to be changed to display the Shibboleth options in the Login Admin page
tiki-admin_include_login.php|This file changes will process the new values in the Login Admin page above.
tiki-setup_base.php|This page will need to be changed to ensure the shibboleth user is validated.||

!!!Shibboleth step 2:Update Shibboleth

To enable the wiki to be protected by Shibboleth you will need to add a the following to you apache conf.

__<Location /tikiwiki/tiki-login_scr.php>__
~hs~~hs~~hs~__AuthType shibboleth__
~hs~~hs~~hs~__ShibRequireSession On__
~hs~~hs~~hs~__ShibRequireAll On__
~hs~~hs~~hs~__require valid-user__
__</Location>__

The other thing you will need to do is update your Shibboleth Service Providers AAP (Attribute Assertion Policy) AAP.XML.

Below are the Attributes required by the Tikiwiki Auth and the required Header values;


__<AttributeRule Name="urn:mace:dir:attribute-def:eduPersonPrincipalName" Scoped="false" Header="REMOTE_USER">__
~hs~~hs~~hs~__<AnySite>__
~hs~~hs~~hs~~hs~~hs~~hs~__<!-- Ensure the value is unscoped so all IDs are unique-->__
~hs~~hs~~hs~~hs~~hs~~hs~__<Value Type="regexp">.*@.*</Value>__
~hs~~hs~~hs~__</AnySite>__
__</AttributeRule>__

__<AttributeRule Name="urn:mace:dir:attribute-def:mail" Header="MAIL">__
~hs~~hs~~hs~__<AnySite>__
~hs~~hs~~hs~~hs~~hs~~hs~__<AnyValue/>__
~hs~~hs~~hs~__</AnySite>__
__</AttributeRule>__

__<AttributeRule Name="urn:mace:dir:attribute-def:eduPersonAffiliation" Header="Shib-EP-UnscopedAffiliation">__
~hs~~hs~~hs~__<AnySite>__
~hs~~hs~~hs~~hs~~hs~~hs~__<AnyValue/>__
~hs~~hs~~hs~__</AnySite>__
__</AttributeRule>__