Steps to Add New School to IdP Proxy

1. Get the following information from the college/district that is responsible for configuring the college IDP and include in the CIP JIRA ticket for the district/college (found here)
   1. Entity ID of IDP
   2. Scope(Suffix) the IDP will assert on the EPPN attribute.
   3. MIS Codes served by the district or college level IDP.
2. Get metadata for school's IdP, if is not already in InCommon.  If it is in InCommon metadata, skip step #3 and proceed with step #4.

3. Add the school's metadata to metadata/ccc-metadata-unsigned.xml in the saml-ccc Bitbucket repo to the Section marked College IdP Metadata

4. Update authsources.php config file in simplesamlphp

5. Add a AssertionConsumerService, e.g. 

   <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sso.ci.cccmypath.org/simplesaml/module.php/saml/sp/saml2-acs.php/PilotMock" index="0"/>

   to the the following SP descriptors, Pilot IdP Proxy "SP side". Be sure to change the "570" numeric in the example above to match the misCode of the new school or district. Each new entry should increment the index value

6. Add a new authsource entry to resources/authsources.json with the approriate AuthSource alias, IDP entity ID, Eppn scope/suffix, description and MIS code(s).  See example below
7. Validate the metadata additions using ./validateMetadata.sh. If the validation passes, commit and push the change. Build automation will sign the file and push to the correct S3 location
8. Commit the updated metadata file to Bitbucket.  It will be signed, pushed out to S3 and, after within one hour, downloaded to the Proxy IdP deployments.
9. Update authsources.php in the ccc-<env>-proxy-simplesaml-config/opt/ccc/config to include the new school.  This will again trigger an automated update to the appropriate environment's SSO proxy.
10. Once testing in Pilot has been verified, Step #6 will need to be made for the Production environment.

Upon completion of the steps above, after propagation of the updates (approximately one hour), testing of the new school with the IdP proxy can commence.

Updating authsources.json

authsources.json is used by applications such as SSP and Assess to create links to other services via the SSO Proxy

The file is maintained in Bitbucket in the cccnext/ccc-saml repository.

The file name in the REPO is cccnext/saml-ccc/src/resources/authsources.json

Adding a new authsources involves creating a new authSource entry in the authsources.json file with the following values

authsources.json example

[
  {
    "authSource": "idp.collegea.edu",
    "eppnSuffix": "idp.collegea.edu",
    "description": "College A IDP",
    "idpEntityId": "https://idp.collegea.edu/idp/shibboleth",
    "misCodes": [
      "311",
      "312",
      "313"
    ]
  },
  {
    "authSource": "CIMock",
    "eppnSuffix": "democollege.edu",
    "description": "Uni College IDP",
    "idpEntityId": "https://ci-idp.ccctcportal.org:8443/idp/shibboleth",
    "misCodes": [
      "ZZ1"
    ]
  }
]