[Shib-Users] mod_shib missing in Shibboleth2 on Ubuntu 9.04

[natha...@gatewest.co.uk]

Hi,

I'm currently investigating Shibboleth as a means for single sign on to one of our applications. I've managed to build and install Shibboleth2 on an Ubuntu server, but the mod_shib_xx.so file appears to be missing.

There is a Makefile in the apache subdirectory, which means that configure worked, but no build of mod_shib. Everything else builds and installs perfectly fine.

Output of secondary make attempt says:
Making all in apache
make[2]: Entering directory `/root/shibboleth-2.3.1/apache'
make[2]: Nothing to be done for `all'.
make[2]: Leaving directory `/root/shibboleth-2.3.1/apache'

This is using shibboleth version 2.3.1 available from http://shibboleth.internet2.edu/downloads/shibboleth/cppsp/latest/

I'm using the build/install process outlined here:
http://backyardbamboo.blogspot.com/2009/10/shibboleth2-on-ubuntu-904.html

I am now attempting the same process on version 2.3 (just wondering if it's a makefile issue...)

Does anyone have any ideas as to what the problem could be?

ndtreviv

[Nathaniel Trevivian]

No problem - just found the apt-get package for karmic and lucid - for those who want to know:
apt-get install libapache2-mod-shib
OR
apt-get install libapache2-mod-shib2
will give you what you want.

ndtreviv

[Peter Schober]

* Nathaniel Trevivian <natha...@gatewest.co.uk> [2010-04-09 11:06]:

> > This is using shibboleth version 2.3.1 available from
> http://shibboleth.internet2.edu/downloads/shibboleth/cppsp/latest/
> >
> > I'm using the build/install process outlined here:
> > http://backyardbamboo.blogspot.com/2009/10/shibboleth2-on-ubuntu-904.html

You might also be interested in
http://wiki.debian.org/Teams/DebianShibboleth
where you can get the source to the Debian (and Ubuntu) packages
straight from the VCS and build your own .deb packages (so you can
update and remove them properly).

> No problem - just found the apt-get package for karmic and lucid - for those who want to know:
> apt-get install libapache2-mod-shib
> OR
> apt-get install libapache2-mod-shib2
> will give you what you want.

There is no reason anyone should install libapache2-mod-shib today as
it will be EOL'ed in less than three months:

"The Shibboleth team will transition Shibboleth v1.3 from Previous
Stable release to the Earlier / Unsupported category on June 30, 2010."
http://shibboleth.internet2.edu/

Also you probably shouldn't install vanilla libapache2-mod-shib2 -- at
least not on Debian 5.0 (Lenny, current stable) or Ubuntu 9.10 (Karmic
Koala) since these ship versions of the Shib SP that are out of date.

For Debian stable the backports are preferred, for Ubuntu 10.04 LTS
(Lucid Lynx) you should be fine with the version included -- once
10.04 is released, that is.

Debian: http://packages.debian.org/search?keywords=libapache2-mod-shib2
Ubuntu: http://packages.ubuntu.com/search?keywords=libapache2-mod-shib2

cheers,
-peter

[Scott Cantor]

> I'm currently investigating Shibboleth as a means for single sign on to
one
> of our applications. I've managed to build and install Shibboleth2 on an
> Ubuntu server, but the mod_shib_xx.so file appears to be missing.

That just means your configure attempt didn't include or auto-detect any
Apache to use.

As Peter said, your workaround is the wrong approach.

-- Scott

[Nathaniel Trevivian]

On 9 Apr 2010, at 14:19, Peter Schober wrote:

This is using shibboleth version 2.3.1 available from

http://shibboleth.internet2.edu/downloads/shibboleth/cppsp/latest/

I'm using the build/install process outlined here:

http://backyardbamboo.blogspot.com/2009/10/shibboleth2-on-ubuntu-904.html

You might also be interested in
http://wiki.debian.org/Teams/DebianShibboleth
where you can get the source to the Debian (and Ubuntu) packages
straight from the VCS and build your own .deb packages (so you can
update and remove them properly).

No problem - just found the apt-get package for karmic and lucid - for those who want to know:

apt-get install libapache2-mod-shib

OR

apt-get install libapache2-mod-shib2

will give you what you want.

There is no reason anyone should install libapache2-mod-shib today as
it will be EOL'ed in less than three months:

Thanks for that information.

 "The Shibboleth team will transition Shibboleth v1.3 from Previous
 Stable release to the Earlier / Unsupported category on June 30, 2010."
 http://shibboleth.internet2.edu/

Also you probably shouldn't install vanilla libapache2-mod-shib2 -- at
least not on Debian 5.0 (Lenny, current stable) or Ubuntu 9.10 (Karmic
Koala) since these ship versions of the Shib SP that are out of date.

Right you are - just noticed that the version is different in libapache2-mod-shib2 between karmic and lucid.

For Debian stable the backports are preferred, for Ubuntu 10.04 LTS
(Lucid Lynx) you should be fine with the version included -- once
10.04 is released, that is.

Debian: http://packages.debian.org/search?keywords=libapache2-mod-shib2
Ubuntu: http://packages.ubuntu.com/search?keywords=libapache2-mod-shib2

cheers,
-peter

So it looks like I'm back to where I started then! Trying to get the make to work! Thanks for your information - it's definitely set me back on the right path, even if I'm back to where I began!

Has anyone actually got a v2.3.1 of shibboleth-sp running on Ubuntu? If so, any pearls of wisdom would be really useful right now.

thanks,

ndtreviv 

[Scott Cantor]

> Has anyone actually got a v2.3.1 of shibboleth-sp running on Ubuntu? If
so,
> any pearls of wisdom would be really useful right now.

Install relevant Apache 2.x development files, try configure, check output
for results of Apache autodetection, override as necessary. Nothing magic.

-- Scott

[Nathaniel Trevivian]

Thanks Scott.
And the answer was:
apt-get install apache2-threaded-dev

use the following configure command:
./configure --with-log4shib=/opt/shibboleth-sp --with-apxs=/usr/bin/apxs2 --prefix=/opt/shibboleth-sp

Thanks again for putting my feet back on the path.

Cheers,
ndtreviv

[Scott Cantor]

> And the answer was:
> apt-get install apache2-threaded-dev
>
> use the following configure command: ./configure
> --with-log4shib=/opt/shibboleth-sp --with-apxs=/usr/bin/apxs2 --
> prefix=/opt/shibboleth-sp

I think if you look at the result, you'll find that it did nothing with the
--with-apxs option there, since that's for Apache 1.3. It's fortunate that
it worked (unless it turns out it didn't, but it probably would have choked
on it).

-- Scott

[Nathaniel Trevivian]

Definitely worked. It built a new mod_shib_22.so and deployed it. It's now sorted out.

[Peter Schober]

* Nathaniel Trevivian <natha...@gatewest.co.uk> [2010-04-09 16:05]:

> use the following configure command:
> ./configure --with-log4shib=/opt/shibboleth-sp --with-apxs=/usr/bin/apxs2 --prefix=/opt/shibboleth-sp

Why go through with this on a platform renowned for its superior
package management? If all you want is configure && make && make
install why not use FreeBSD or Gentoo or something like that?

See the aforementioned Debian Shib Team page, get the source from
there (or alternatively get the source packages from Ubtuntu Lucid)
and simply rebuild the package for your Ubuntu release (potentially
adjusting a versioned dependency or two).

A few results from STFW:

http://www.debian.org/doc/manuals/apt-howto/ch-sourcehandling.en.html
http://www.debian.org/doc/FAQ/ch-pkg_basics.en.html -- Section 7.14
http://www.debianhelp.co.uk/debcreation.htm

And before any of that you might also try installing the Debian
backports version, which could also work.
-peter

[Nathaniel Trevivian]

> * Nathaniel Trevivian <natha...@gatewest.co.uk> [2010-04-09 16:05]:
>> use the following configure command:
>> ./configure --with-log4shib=/opt/shibboleth-sp --with-apxs=/usr/bin/apxs2 --prefix=/opt/shibboleth-sp
>
> Why go through with this on a platform renowned for its superior
> package management? If all you want is configure && make && make
> install why not use FreeBSD or Gentoo or something like that?

Agreed - I'd rather use proper packages, and by the time the customer actually needs this Lucid will have been released and I'll no doubt do that.
For now, I just need to know what changes are necessary to our application in order to implement with Shibboleth. I'll admit that at the moment I'm just doing investigatory work and time is of the essence, therefore quickest and least path of resistance is preferred.

> See the aforementioned Debian Shib Team page, get the source from
> there (or alternatively get the source packages from Ubtuntu Lucid)
> and simply rebuild the package for your Ubuntu release (potentially
> adjusting a versioned dependency or two).

Potentially rebuild several packages vs re-make one application - both for my Ubuntu release or use Lucid packages on my earlier Ubuntu version (it's a breadcrumb-trail of dependencies) vs one make just to investigate impact on my application - I'd rather do the make for now.

> A few results from STFW:
>
> http://www.debian.org/doc/manuals/apt-howto/ch-sourcehandling.en.html
> http://www.debian.org/doc/FAQ/ch-pkg_basics.en.html -- Section 7.14
> http://www.debianhelp.co.uk/debcreation.htm
>
> And before any of that you might also try installing the Debian
> backports version, which could also work.
> -peter

When we've had the go ahead to do the work and the customer is paying then I'll absolutely be looking into the most maintainable solution.
For now, quick and dirty is fine - sorry if you disagree. It's working now and I'm happy about that.
Thanks again for your help.

[Peter Schober]

* Nathaniel Trevivian <natha...@gatewest.co.uk> [2010-04-09 16:42]:

> When we've had the go ahead to do the work and the customer is
> paying then I'll absolutely be looking into the most maintainable
> solution.
> For now, quick and dirty is fine - sorry if you disagree. It's
> working now and I'm happy about that.

That's certainly fine with me. I just had the impression you're not
making use of the good work others have put in to easily (re-)build
the software for the platform of your choice (which, as you will know,
is officially unsupported by the Shibboleth project).

Glad it worked out,
-peter