1. Shibboleth IdP Training: Productionalization January, 2009

2. Java Virtual Machine Tuning For Sun JVM 5/6 Server option Heap space settings Varies with available memory Min/Max settings Garbage collection Multi-CPU core option Disable explicit garbage collection https://spaces.internet2.edu/display/SHIB2/JVMTuning

3. Protecting your IdP Web application listening on ports 443/8443 by default General Apache HTTPD & Tomcat hardening will work with Shibboleth

4. Logging SHIB_HOME/logs/idp-process.log Default logging configuration splits logs on a daily basis – can be changed based on need Can be configured to send email notifications on certain message levels, such as ERROR https://spaces.internet2.edu/display/SHIB2/IdPProdLoggin g https://spaces.internet2.edu/display/SHIB2/IdPProdLoggin g

5. Redundant Data Sources Define connections to redundant data sources Authentication – Login Handler Attribute resolver – Data Connector

6. Redundant Login Handlers Define an additional <LoginHandler xsi:type="UsernamePassword" login1.config jaasConfigurationLocation="file:///opt/shibbolet h-idp/conf/login1.config">... <LoginHandler xsi:type="UsernamePassword" login2.config jaasConfigurationLocation="file:///opt/shibbolet h-idp/conf/login2.config">...

7. Redundant Data Connectors Use <resolver:DataConnector id="ldap1" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc" ldap://ldap1.example.org ldapURL="ldap://ldap1.example.org"...>... ldap2 <resolver:DataConnector id="ldap2" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc" ldap://ldap2.example.org ldapURL="ldap://ldap2.example.org"...

8. Certificates Some federations operate their own CA End user browsers may not recognize the federation CA Use a different certificate for the authentication page

9. Certificates

10. Metadata Signature Validation Metadata… should be signed by the publisher signatures should be validated InCommon does publish signed metadata Metadata provider definition

11. Metadata Signature Validation Download the InCommon signing certificate Add a metadata trust engine definition Add a metadata provider filter https://spaces.internet2.edu/display/SHIB2/IdPMetadat aProvider https://spaces.internet2.edu/display/SHIB2/IdPMetadat aProvider

12. High Availability/Clustering Clustering is supported, limited documentation Different types of clustering solutions Failover Load balancing Concerns Session state preservation Different architectures

13. High Availability/Clustering Configuration of Terracotta, an open source clustering solution, is provided Load-balancing is sufficient for most deployments https://spaces.internet2.edu/display/SHIB 2/IdPCluster

14. Troubleshooting SHIB_HOME/logs/idp-process.log Common errors are documented in the wiki Time synchronization is important https://spaces.internet2.edu/display/SHIB2/IdPTroubleshootingCom monErrors