{"id":4452,"date":"2025-04-17T13:15:30","date_gmt":"2025-04-17T13:15:30","guid":{"rendered":"https:\/\/geekmungus.co.uk\/?p=4452"},"modified":"2025-04-17T13:15:32","modified_gmt":"2025-04-17T13:15:32","slug":"example-site-authenticated-with-okta-and-shibboleth-sp-or-openathens-and-shibboleth-sp","status":"publish","type":"post","link":"https:\/\/geekmungus.co.uk\/?p=4452","title":{"rendered":"Example Site Authenticated with OKTA and Shibboleth sP (or OpenAthens and Shibboleth sP)"},"content":{"rendered":"\n

The document provides an overview of how to setup and configure OKTA with a test Shibboleth sP (Service Provider) instance with a example site which is secured using OKTA. It can be used to explore how OKTA and Shibboleth sP interact with the SAML assertion exchange. The deployment is simple and provides the following:<\/p>\n\n\n\n

An AWS VPC, with an EC2 instance that will act as the Shibboleth sP and host the test website.
OKTA Application acting as the IdP (Identity Provider) to allow the Shibboleth sP to authenticate with the IdP to allow user access to the test website. OR
Open Athens acting as the IdP (Identity Provider) to allow the Shibboleth sP to authenticate with the IdP to allow user access to the test website.
The example site used a domain called www.domain.com, but you may choose to use another domain, additionally in this example the domain has its Name Servers (NS) within AWS Route53, again this not essential, nor is using AWS for running the test instance, it was chosen being its an easy method to spin something up rapidly for testing. Terraform was used to deploy the instance, however you could configure this manually, additionally no fancy Terraform state management is used, this is just stored locally. Additionally the steps are manual, although they could be automated if required, however for the purposes of this document, exposing these steps gives a more rounded learning and understanding of the approach and the mechanisms involved.<\/p>\n\n\n\n

Option 1 – Example Site Authenticated with OKTA and Shibboleth sP<\/h1>\n\n\n\n

An example configuration that allows you to authenticate a test website using Shibboleth sP with OKTA as the IdP. There are another section where we explore the configuration for using the Shibboleth sP, but instead using Open Athens as the IdP.<\/p>\n\n\n\n

Deploy the Instance<\/h2>\n\n\n\n

Ensure you have the a workstation with Terraform and the AWS CLI installed, and you have the Terraform script(s) downloaded from the below:<\/p>\n\n\n\n

Terraform: https:\/\/github.com\/tristanhself\/general\/tree\/master\/aws\/test-sp<\/a><\/p>\n\n\n\n

So now we deploy the instance with:<\/p>\n\n\n\n

cd test-sP\nterraform apply --auto--approve<\/code><\/pre>\n\n\n\n
Once the instance has been deployed, retrieve its ID from the AWS console (or CLI) and then connect to it via SSM so you can get a BASH prompt.<\/p>\n\n\n\n
aws ssm start-session --target <instance-ID><\/code><\/pre>\n\n\n\n
Perform Apache Install and Configuration<\/h2>\n\n\n\n
You’ll now need to install Apache including the various rewrite modules so we can put up a simple test site.<\/p>\n\n\n\n
sudo apt-get install apache2 -y\nsudo a2enmod ssl\nsudo a2ensite default-ssl\nsudo a2enmod rewrite\nsudo systemctl restart apache2\n \nsudo apt-get install ntp\ntimedatectl set-timezone Europe\/London<\/code><\/pre>\n\n\n\n
You should now be able to get to the default page site on:<\/p>\n\n\n\n