Módosítások

 {{STOP|A '''new release (3For documentation about the more recent 4.1) is approaching'''x version, therefore the text below refers to some features that are not part of the last release. Please consult the please read [[#Change logDrupalShibbolethReadmeDev]] for the current stable release (3.0).}}

Module is being developed for Drupal 6.x. We try to backport have stopped backporting new features to the 5.x from time to time, though branch and Drupal 7 is not yet supported as long as it might take several weeksisn't the stable branch. If you can help with backportingwant to contribute to development or porting, please contact '''aai _AT_ niif _DOT_ hu'''!

Older versions of Drupal are not supported, nor is Drupal 7 as long as it is not the stable branch. Both Shibboleth 1.3 and Shibboleth 2.x are supported. {{ATTENTION_EN|When using along with Userprotect module (which is recommended anyway), there was a [http://drupalalthough some features might require Shibboleth 2.org/node/305989 bug], which [http://drupal.org/node/306912 turned out to be] a [http://drupal.org/node/165642 Drupal core bug].  The bug was fixed in Drupal 5.10 and 6.4, so '''only versions above 5.10 and 6.4 are supported'''x.}}

There is no upgrade procedure. If you are upgrading from the same major version, you don't even only need to uninstall overwrite the module before upgrading. This way files within your configuration (role mappings<code>modules/shib_auth</code> directory, etc) persiststhen run <code>update.php</code>.

You should be familiar with protecting resources with Shibboleth before using this module. (See [https://spaceswiki.internet2shibboleth.edunet/confluence/display/SHIB2/NativeSPProtectContent Shibboleth Wiki]) Please check that Shibboleth authentication is working for that location and all the necessary attributes are exported to the headers. You can enable [[Drupal Shibboleth module#DEBUG mode | DEBUG mode]] to dump the whole '''$_SERVER''' array. If you can see Shibboleth attributes there, you're fine.

{{STOP|If you decide to use lazy sessions and you don't want your users to be able to log in with a password, '''YOU MUST DISABLE PASSWORD CHANGE'''. (See below.)[[#Disallowing password change|you have to disable changing passwords]]}}

* ''Use Require and use only Shibboleth-provided e-mail address'' (default on): if with this option is checkedset, Drupal e-mail address is rewritten with the Shibboleth-provided oneon each login. This means that your users can only use the e-mail address which is provided by the IdP provides. '''When this option The IdP is on, missing required to send the e-mail address results in attribute otherwise the user gets a fatal error.'''* ''Ask for missing e-mail address'' (default off): let the user modify her own e-mail address by unchecking editing her Drupal account. If the option above and checking thisIdP provides an e-mail address, you instruct then that value will be the module to ask default, otherwise the user for the missing is asked to specify her e-mail address if the IdP does not provide one.

{{INFO_EN|;There are a couple of concerns you should keep Keep in mindif you leave this option off:* if the Shibboleth session is lost, all the Shibboleth-derived attributes disappear, therefore the user probably loses her the [[#Automatic role assignment|assigned Shibboleth roles]]** on the other hand, the rolesassigned to the ''Drupal account of the user'' persist as long as the Drupal session is valid

Define an URL here, where you want the user to be navigated after logout. The URL can be absolute or relative to the server base url. The relative paths will be automatically extended with the site base URL.  ==== SAML2 Logout ====At the moment, Shibboleth2 SP supports SAML2 logout while the Shibboleth2 IdP does not. It has a consequence that (if you have a standard Shibboleth2 installation), you will get a Shibboleth error message on logout, like this: Global Logout Status of Global Logout: Identity provider does not support SAML 2 Single Logout protocol.You can avoid this message by commenting out SAML2 global logout initiator from <code>/Logout</code> handler in <code>/etc/shibboleth/shibboleth2.xml</code>:<source lang="xml"> <!-- LogoutInitiators enable SP-initiated local or global/single logout of sessions. --> <LogoutInitiator type="Chaining" Location="/Logout" relayState="cookie"> <!-- The following line should be commented out to make Drupal logout work, as long as your IdPs do not support SAML2 logout --> <!--LogoutInitiator type="SAML2" template="bindingTemplate.html"/--> <LogoutInitiator type="Local"/> </LogoutInitiator></source> 

[[Category: AAI]] [[Category: Drupal]] [[Category: Shibboleth SP]][[Category: HOWTO]][[Category: English]]