Preparation
- Get the following information from the college/district that is responsible for configuring the college IDP and include in the CIP JIRA ticket for the district/college (found here)
- Entity ID of IDP
- Scope(Suffix) the IDP will assert on the EPPN attribute.
- MIS Codes served by the district or college level IDP.
- Get metadata for school's IdP, if is not already in InCommon. If it is in InCommon metadata, skip step #3 and proceed with step #4.
Metadata Changes
Add the school's metadata to metadata/ccc-metadata-unsigned.xml in the cccnext/saml-ccc Bitbucket repo to the Section marked "College IdP Metadata".
In that same file, add a AssertionConsumerService, e.g.
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sso.ci.cccmypath.org/simplesaml/module.php/saml/sp/saml2-acs.php/PilotMock" index="0"/>
to the the following Pilot IdP Proxy "SP side" SP descriptor. Be sure to change the "570" numeric in the example above to match the misCode of the new school or district. Each new entry should increment the index value.
- Validate the metadata additions using ./validateMetadata.sh. If the validation passes, commit and push the change. Build automation will sign and push the updated metadata saml.cccmypath.org S3 bucket and, within one hour, downloaded to the Proxy IdP deployments.
Authsources Changes
- Add an entry for the new college/district in two places in the authsources.php config file in the external-config/pilot/opt/ccc/config in the cccnext/idp-proxy Bitbucket repo, git add, and commit.
- aws s3 cp authsources.php s3://ccc-pilot-proxy-simplesaml-config/opt/ccc/config/
- Add a new authsource entry to resources/authsources.json with the appropriate AuthSource alias, IDP entity ID, Eppn scope/suffix, description and MIS code(s) in the cccnext/saml-ccc Bitbucket repo. See example below.
InCommon Updates
- Go to https://www.incommon.org/federation/siteadmin.html, click on Federation Manager sign in in the left nav and log in using Franz's InCommon creds in LastPass.
- Once authenticated, change the url to https://service1.internet2.edu/siteadmin/organizations/10513/service_providers
- Click on https://sso.pilot.cccmypath.org/simplesaml/module.php/saml/sp/metadata.php [ Edit ]
Go about half way down the page and click on [ Edit ], and add the new AssertionConsumerService line that was added to the Proxy in one of the three blank fields at the bottom of the AssertionConsumerService section.
Production Onboarding
- Once testing in Pilot has been verified, Metadata Change #2 (only) will need to be made for the Production environment. For this, add the same AssertionConsumerService line as done for pilot in the Prod IdP Proxy "SP side SP descriptor.
- Add an entry for the new college/district in two places in the authsources.php config file in the external-config/prod/opt/ccc/config in the cccnext/idp-proxy Bitbucket repo, git add, and commit.
- aws s3 cp authsources.php s3://ccc-prod-proxy-simplesaml-config/opt/ccc/config/
- Add a new authsource entry to resources/authsources.json with the appropriate AuthSource alias, IDP entity ID, Eppn scope/suffix, description and MIS code(s) in the cccnext/saml-ccc Bitbucket repo. See example below.
Upon completion of the steps above, after propagation of the updates (approximately one hour), testing of the new school with the IdP proxy can commence. Note, some colleges/districts will have different metadata for their prod IdP versus their pilot IdP. If so, we'll need to add their prod IdP metadata just like we did their pilot metadata in section 2.1.
Updating authsources.json
authsources.json is used by applications such as SSP and Assess to create links to other services via the SSO Proxy
The file is maintained in Bitbucket in the cccnext/ccc-saml repository.
The file name in the REPO is cccnext/saml-ccc/src/resources/authsources.json
Adding a new authsources involves creating a new authSource entry in the authsources.json file with the following values
authSource | this should be the same name used in the authsources.php file in the sso proxy configuration |
eppnSuffix | this is the scope/suffix the IDP sends with authenticating a user. This value can be found in the implementation JIRA ticket |
description | A description of the entry |
idpEntityId | The Metadata entity id of the college idp. This value can be found in the implementation JIRA ticket |
misCodes | An array of mis codes served by the college IDP. This value can be found in the implementation JIRA ticket |
authsources.json example
[ { "authSource": "idp.collegea.edu", "eppnSuffix": "idp.collegea.edu", "description": "College A IDP", "idpEntityId": "https://idp.collegea.edu/idp/shibboleth", "misCodes": [ "311", "312", "313" ] }, { "authSource": "CIMock", "eppnSuffix": "democollege.edu", "description": "Uni College IDP", "idpEntityId": "https://ci-idp.ccctcportal.org:8443/idp/shibboleth", "misCodes": [ "ZZ1" ] } ]
District ID | District Name | MIS Code | College Name | |
20 | GROSSMONT-CUYAMACA | 21 | Cuyamaca College | |
20 | GROSSMONT-CUYAMACA | 22 | Grossmont College | |
30 | IMPERIAL | 31 | Imperial Valley College | |
50 | MIRA COSTA | 51 | MiraCosta College | |
60 | PALOMAR | 61 | Palomar College | |
70 | SAN DIEGO | 71 | San Diego City College | |
70 | SAN DIEGO | 72 | San Diego Mesa College | |
70 | SAN DIEGO | 73 | San Diego Miramar College | |
90 | SOUTHWESTERN | 91 | Southwestern College | |
110 | BUTTE | 111 | Butte College | |
120 | FEATHER RIVER | 121 | Feather River Community College | |
130 | LASSEN | 131 | Lassen Community College | |
140 | MENDOCINO-LAKE | 141 | Mendocino College | |
160 | REDWOODS | 161 | College of the Redwoods | |
170 | SHASTA-TEHAMA-TRINITY | 171 | Shasta College | |
180 | SISKIYOUS | 181 | College of the Siskiyous | |
220 | LAKE TAHOE | 221 | Lake Tahoe Community College | |
230 | LOS RIOS | 231 | American River College | |
230 | LOS RIOS | 232 | Cosumnes River College | |
230 | LOS RIOS | 233 | Sacramento City College | |
230 | LOS RIOS | 234 | Folsom Lake College | |
240 | NAPA VALLEY | 241 | Napa Valley College | |
260 | SONOMA | 261 | Santa Rosa Junior College | |
270 | SIERRA | 271 | Sierra College | |
280 | SOLANO | 281 | Solano Community College | |
290 | YUBA | 291 | Yuba College | |
290 | YUBA | 292 | Woodland Community College | |
310 | CONTRA COSTA | 311 | Contra Costa College | |
310 | CONTRA COSTA | 312 | Diablo Valley College | |
310 | CONTRA COSTA | 313 | Los Medanos College | |
330 | MARIN | 334 | College of Marin | |
340 | PERALTA | 341 | College of Alameda | |
340 | PERALTA | 343 | Laney College | |
340 | PERALTA | 344 | Merritt College | |
340 | PERALTA | 345 | Berkeley City College | |
360 | SAN FRANCISCO | 361 | City College of San Francisco | |
370 | SAN MATEO | 371 | Canada College | |
370 | SAN MATEO | 372 | College of San Mateo | |
370 | SAN MATEO | 373 | Skyline College | |
410 | CABRILLO | 411 | Cabrillo College | |
420 | FOOTHILL-DEANZA | 421 | De Anza College | |
420 | FOOTHILL-DEANZA | 422 | Foothill College | |
430 | OHLONE | 431 | Ohlone College | |
440 | GAVILAN | 441 | Gavilan College | |
450 | HARTNELL | 451 | Hartnell College | |
460 | MONTEREY | 461 | Monterey Peninsula College | |
470 | SAN JOSE-EVERGREEN | 471 | Evergreen Valley College | |
470 | SAN JOSE-EVERGREEN | 472 | San Jose City College | |
480 | CHABOT-LAS POSITAS | 481 | Las Positas College | |
480 | CHABOT-LAS POSITAS | 482 | Chabot College | |
490 | WEST VALLEY-MISSION | 492 | Mission College | |
490 | WEST VALLEY-MISSION | 493 | West Valley College | |
520 | KERN | 521 | Bakersfield College | |
520 | KERN | 522 | Cerro Coso Community College | |
520 | KERN | 523 | Porterville College | |
530 | MERCED | 531 | Merced College | |
550 | SAN JOAQUIN DELTA | 551 | San Joaquin Delta College | |
560 | SEQUOIAS | 561 | College of the Sequoias | |
570 | STATE CENTER | 571 | Fresno City College | |
570 | STATE CENTER | 572 | Reedley College | |
570 | STATE CENTER | 576 | Clovis Community College | |
580 | WEST HILLS | 581 | West Hills College-Coalinga | |
580 | WEST HILLS | 582 | West Hills College-Lemoore | |
590 | YOSEMITE | 591 | Columbia College | |
590 | YOSEMITE | 592 | Modesto Junior College | |
610 | ALLAN HANCOCK | 611 | Allan Hancock College | |
620 | ANTELOPE VALLEY | 621 | Antelope Valley College | |
640 | SAN LUIS OBISPO | 641 | Cuesta College | |
650 | SANTA BARBARA | 651 | Santa Barbara City College | |
660 | SANTA CLARITA | 661 | College of the Canyons | |
680 | VENTURA | 681 | Moorpark College | |
680 | VENTURA | 682 | Oxnard College | |
680 | VENTURA | 683 | Ventura College | |
690 | WEST KERN | 691 | Taft College | |
710 | COMPTON | 711 | Compton CCD | |
720 | EL CAMINO | 721 | El Camino College | |
730 | GLENDALE | 731 | Glendale Community College | |
740 | LOS ANGELES COMMUNITY COLLEGE | 741 | Los Angeles City College | |
740 | LOS ANGELES COMMUNITY COLLEGE | 742 | Los Angeles Harbor College | |
740 | LOS ANGELES COMMUNITY COLLEGE | 743 | Los Angeles Mission College | |
740 | LOS ANGELES COMMUNITY COLLEGE | 744 | Los Angeles Pierce College | |
740 | LOS ANGELES COMMUNITY COLLEGE | 745 | Los Angeles Southwest College | |
740 | LOS ANGELES COMMUNITY COLLEGE | 746 | Los Angeles Trade Technical College | |
740 | LOS ANGELES COMMUNITY COLLEGE | 747 | Los Angeles Valley College | |
740 | LOS ANGELES COMMUNITY COLLEGE | 748 | East Los Angeles College | |
740 | LOS ANGELES COMMUNITY COLLEGE | 749 | West Los Angeles College | |
740 | LOS ANGELES COMMUNITY COLLEGE | 74A | ITV/The Weekend College | |
770 | PASADENA | 771 | Pasadena City College | |
780 | SANTA MONICA | 781 | Santa Monica College | |
810 | CERRITOS | 811 | Cerritos College | |
820 | CITRUS | 821 | Citrus College | |
830 | COAST | 831 | Coastline Community College | |
830 | COAST | 832 | Golden West College | |
830 | COAST | 833 | Orange Coast College | |
840 | LONG BEACH | 841 | Long Beach City College | |
850 | MT. SAN ANTONIO | 851 | Mt San Antonio College | |
860 | NORTH ORANGE | 861 | Cypress College | |
860 | NORTH ORANGE | 862 | Fullerton College | |
870 | RANCHO SANTIAGO | 871 | Santa Ana College | |
870 | RANCHO SANTIAGO | 873 | Santiago Canyon College | |
880 | RIO HONDO | 881 | Rio Hondo College | |
890 | SOUTH ORANGE | 891 | Saddleback College | |
890 | SOUTH ORANGE | 892 | Irvine Valley College | |
910 | BARSTOW | 911 | Barstow Community College | |
920 | CHAFFEY | 921 | Chaffey College | |
930 | DESERT | 931 | College of the Desert | |
940 | MT. SAN JACINTO | 941 | Mt. San Jacinto Community College District | |
950 | PALO VERDE | 951 | Palo Verde College | |
960 | RIVERSIDE | 961 | Riverside Community College | |
960 | RIVERSIDE | 962 | Moreno Valley Community College | |
960 | RIVERSIDE | 963 | Norco Community College | |
970 | COPPER MOUNTAIN | 971 | Copper Mountain Community College | |
980 | SAN BERNARDINO | 981 | Crafton Hills College | |
980 | SAN BERNARDINO | 982 | San Bernardino Valley College | |
990 | VICTOR VALLEY | 991 | Victor Valley College | |
ZZ0 | CCCTC Test College District | ZZ1 | Unicollege | |
ZZ0 | CCCTC Test College District | ZZ2 | Rainforest College | |
ZZ0 | CCCTC Test College District | ZZ3 | CCCTC College A | |
ZZ0 | CCCTC Test College District | ZZ4 | CCCTC College B | |
ZZ0 | CCCTC Test College District | ZZ5 | South Bay JBL Consortium | |
ZZ0 | CCCTC Test College District | ZZ6 | FAUX Allan Hancock |