vi /etc/environment
JAVA_HOME="/usr/lib/jvm/java-8-openjdk-amd64/"
JRE_HOME="/usr/lib/jvm/java-8-openjdk-amd64/jre"

cd /opt/shibboleth-idp/metadata/
wget --no-check-certificate -O sp1-metadata.xml https://sp1.local/Shibboleth.sso/Metadata
wget --no-check-certificate -O sp2-metadata.xml https://sp2.local/Shibboleth.sso/Metadata
chown tomcat8:tomcat8 *.xml

vi /opt/shibboleth-idp/conf/metadata-providers.xml
    <MetadataProvider id="SP1-Metadata"  xsi:type="FilesystemMetadataProvider" metadataFile="/opt/shibboleth-idp/metadata/sp1-metadata.xml"/>
    <MetadataProvider id="SP2-Metadata"  xsi:type="FilesystemMetadataProvider" metadataFile="/opt/shibboleth-idp/metadata/sp2-metadata.xml"/>

vi /opt/shibboleth-idp/conf/ldap.properties
idp.authn.LDAP.authenticator                   = bindSearchAuthenticator
idp.authn.LDAP.ldapURL                          = ldap://idp.local:389
idp.authn.LDAP.useStartTLS                     = false
idp.authn.LDAP.baseDN                           = dc=users,dc=nodomain
idp.authn.LDAP.userFilter                       = (uid={user})
idp.authn.LDAP.bindDN                           = cn=admin,dc=nodomain
idp.authn.LDAP.bindDNCredential                 = shibboleth
idp.attribute.resolver.LDAP.returnAttributes    = *

vi /opt/shibboleth-idp/conf/access-control.xml
    <util:map id="shibboleth.AccessControlPolicies">

        <!--entry key="AccessByIPAddress">
            <bean parent="shibboleth.IPRangeAccessControl"
                p:allowedRanges="#{ {'127.0.0.1/32', '::1/128'} }" />
        </entry-->
        <entry key="AccessByIPAddress">
            <bean parent="shibboleth.IPRangeAccessControl"
                p:allowedRanges="#{ {'127.0.0.0/8', '::1/128'} }" />
        </entry>

    
    </util:map>


cd /opt/shibboleth-idp/conf/
cp attribute-resolver-full.xml attribute-resolver.xml
... alle Attribute aktivieren
... LDAP-DC ohne TLS


vi /opt/shibboleth-idp/conf/attribute-filter.xml
    <!-- Release to local SPs. -->
    <AttributeFilterPolicy id="SPs-locals">
        <PolicyRequirementRule xsi:type="OR">
            <Rule xsi:type="Requester" value="https://sp1.local/shibboleth" />
            <Rule xsi:type="Requester" value="https://sp2.local/shibboleth" />
        </PolicyRequirementRule>
        <AttributeRule attributeID="eduPersonScopedAffiliation">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
        <AttributeRule attributeID="surname">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
        <AttributeRule attributeID="givenName">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
        <AttributeRule attributeID="mail">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
        <AttributeRule attributeID="uid">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
    </AttributeFilterPolicy>