Page Comparison

...

We need to configure the community and rp_realm appropriate for your Moonshot IdPservice, and the Trust Router that it will connect to.

Open the /etc/raddb/mods-enabled/realm for editing.
Find the "realm suffix {" configuration directive, and fill out the fields as appropriate.
Repeat this for the "realm bangpath {" configuration directive.

For the default Jisc Assent Trust Router this will look like the following:

Code Block

linenumbers	true

realm suffix {
  format = suffix
  delimiter = "@"
  default_community = "ov-apc.moonshot.ja.net"
  rp_realm = "Your service realm as registered in the Jisc Assent Portal"
  trust_router = "tr.moonshot.ja.net"
  rekey_enabled = yes
}

realm bangpath {
  format = prefix
 "hostname of your IdP delimiter = "!"
  default_community = "ov-apc.moonshot.ja.net"
  rp_realm = "Your service realm as registered in the Jisc Assent Portal"
  trust_router = "tr.moonshot.ja.net"
  rekey_enabled = yes
}

Tip

title	Example

Camford University has a Moonshot IdP service registered in the Jisc Assent Portal at the service realm of moonshot-idp.camford.ac.uk, so its realm file would look like this:

Code Block

linenumbers	true

realm suffix {
  format = suffix
  delimiter = "@"
  default_community = "ov-apc.moonshot.ja.net"
  rp_realm = "moonshot.camford.ac.uk"
  trust_router = "tr.moonshot-idp.ja.net"
  rekey_enabled = yes
}
 
realm bangpath {
  format = prefix
  delimiter = "!"
  default_community = "ov-apc.moonshot.ja.net"
  rp_realm = "moonshot.camford.ac.uk"
  trust_router = "tr.moonshot.ja.net"
  rekey_enabled = yes
}

Register your Trust Router client with a Trust Router

At this point, the Moonshot RP Proxy service needs to be associated with a Trust Router. To do this, you need to contact the operator of a Trust Router you wish to join for their specific instructions on how to do this.

Once you have joined the Trust Router service, you will be issued with a Trust Router an Organisation credential file in XML file format.

...

Note

title	Jisc Assent service instructions

The below instructions are specific to the world's first Trust Router service, Jisc Assent, operated by Jisc in the United Kingdom:

If you are not signed up to Assent, sign up to Assent first. This step may take a day or two while your organisation details are verified and you are invited to join the portal.
If you are signed up to Assent, log into the Assent portal.
Info
For more information about the Assent Portal, see the Assent Portal Primer.
Download a Trust Router
and follow instructions on how to do it https://assent.jisc.ac.uk/help/organization#manage-credentials
Download an Organisation credential under the 'Credential' section of your organisation in the portal (in the form of an XML file). Keep this file safe!

You must import the issued credential file using the moonshot-webp command as the freerad radiusd user:
Code Block
language bash
linenumbers true
$ su - --shell=/bin/bash radiusd $ unset DISPLAY $ moonshot-webp -f [path to credential file]
Check that the credential has been correctly imported, by starting the UI and checking the credential has been correctly imported:
$ ls -la /var/lib/radiusd/.local/share/moonshot-ui/identities.txt
Code Block
language bash
linenumbers true
moonshot
If the file exists, the credential file's contents should be present in the file.

Versions Compared

Old Version 1

New Version Current

Key

Register your Trust Router client with a Trust Router