Step 1: Login
  • Access the correct environment using wp_admin login with the DevOps standard password:
    • PROD: https://blog.kimconnect.com/wp-admin
    • STAGE: https://stage.kimconnect.com/wp-admin
    • QA: https://qa.kimconnect.com/wp-admin
    • DEV: https://dev.kimconnect.com/wp-admin
 
Step 2: Create DNS Entries
  • Ensure that a new site name, to be created, would resolve to the host’s IP via one of these two methods:
    • 1. Create a DNS CNAME record of {URL} with IP of {HOST-IP}
    • 2. Edit /etc/hosts of client machine to include sample sites (please review the “Sample Sites” section)
 
Step 3: Add SSO Metadata to IdP Server & SP Client
Please review the SSO Metadata section to ensure that records exist to associate each newly created site to be recognized by the SSO server.
 
Step 4: Create New Site
  • On the top navigation > hover cursor over {My Sites} > {Network Admin} > {Sites} > Click {Add New} > fill in text fields:
     
    • Site = {project-name}.web01.{env}.kimconnect.com
    • Site Title = {Project Name}
    • Click {Add Site}
       
      By default, WordPress multi-site removes the second ‘:’ portion of the URL, which would render the non-standard port configuration as broken. Thus it is not possible to access the generated site without fixing its associated entries in the database. Moreover, editing http/https & port numbering options must be done via SQL.
# Check the list of sites to locate the {blod_id} associated with newly created site:

mysql -uwebadmin -pPASSWORD --execute="select * from wp_stage.wp_blogs where domain like '%stage.kimconnect%';"

# Adapt the following commands to update the site according to its {blog_id}, {partner-ID} and {Project-Name}

mysql -uwebadmin -p --execute="
UPDATE wp_stage.wp_blogs
set domain = replace(domain, 'com8443', 'com:8443')
WHERE domain LIKE '%com8443';
UPDATE wp_stage.wp_{blog_id}_options
SET option_value = replace(option_value, 'com8443', 'com:8443')
WHERE option_value LIKE '%com8443';
UPDATE wp_stage.wp_{blog_id}_options
SET option_value = replace(option_value, 'http', 'https')
WHERE option_value like 'http://%';
UPDATE wp_stage.wp_{blog_id}_options
SET option_value = '{Project_Name}'
WHERE option_name = 'blogname';
UPDATE wp_stage.wp_{blog_id}_options
SET option_value = 'TEST'
WHERE option_name = 'blogdescription';
UPDATE wp_stage.wp_{blog_id}_options
SET option_value = '[email protected]'
WHERE option_name like '%admin_email%';
UPDATE wp_stage.wp_{blog_id}_options
SET option_value = '/index.php/%year%/%monthnum%/%day%/%postname%/'
WHERE option_name = 'permalink_structure';
UPDATE wp_stage.wp_{blog_id}_options
SET option_value = 'testapp-ui'
WHERE option_name = 'template';
UPDATE wp_stage.wp_{blog_id}_options
SET option_value = 'testapp-ui'
WHERE option_name = 'stylesheet';
INSERT INTO wp_stage.wp_{blog_id}_options (option_name,option_value,autoload) VALUES
    ('host','https://stage.kimconnect.com:8443','yes'),
    ('partner_id','XX','yes'),
    ('eua','true','yes'),
    ('elasticsearch','https://prod.kimconnect.com:9200','yes'),
    ('theme_mods','a:3:{i:0;b:0;s:18:"nav_menu_locations";a:1:{s:8:"leftmenu";i:2;}s:18:"custom_css_post_id";i:-1;}','yes'),
    ('sso_host','sso.kimconnect.com','yes');"
 
  • Logon to hosting server as webadmin to create a symlink for SimpleSaml
# Verify whether SimpleSaml has been deployed to this server

# This is an example of a broken SimpleSaml (missing items)
[webadmin@server01 plugins]$ ls /home/webadmin/pkg/share/simplesamlphp/
locales

# This is another example of SimpleSaml with expected settings
[webadmin@server01 plugins]$ ls /home/webadmin/pkg/share/simplesamlphp/
attributemap cert config COPYING extra locales metadata-templates schemas tests www
bin composer.json config-templates dictionaries lib log modules templates tools
cache composer.lock CONTRIBUTING.md docs LICENSE metadata README.md TESTING.md vendor

[webadmin@server01 plugins]$ ls /home/webadmin/pkg/share/simplesamlphp/config
acl.php authmemcookie.php authsources.php config.php

[webadmin@server01 simplesamlphp]$ ls /home/webadmin/pkg/share/simplesamlphp/metadata

adfs-idp-hosted.php saml20-idp-hosted.php saml20-sp-remote.php shib13-idp-remote.php shib13-sp-remote.php wsfed-sp-hosted.php

adfs-sp-remote.php saml20-idp-remote.php shib13-idp-hosted.php shib13-sp-hosted.php wsfed-idp-remote.php

# This is a correct settings for authsources.php

--- Truncated ---

// The entity ID of this SP.

// Can be NULL/unset, in which case an entity ID is generated based on the metadata URL.

#'entityID' => null,

'entityID' => 'https://'.$_SERVER['HTTP_HOST'].'/simplesaml/module.php/saml/sp/metadata.php/default-sp',

// The entity ID of the IdP this should SP should contact.

// Can be NULL/unset, in which case the user will be shown a list of available IdPs.

#'idp' => null,

#'RelayState' => 'https://'.$_SERVER['HTTP_HOST'],

'idp' => 'https://sso.kimconnect.com/simplesaml/saml2/idp/metadata.php',

// The URL to the discovery service.

// Can be NULL/unset, in which case a builtin discovery service will be used.

'discoURL' => null,

--- Truncated ---

# This is a correct settings for /home/webadmin/pkg/share/simplesamlphp/metadata/saml20-idp-remote.php

$metadata['https://sso.kimconnect.com/simplesaml/saml2/idp/metadata.php'] = array (
'metadata-set' => 'saml20-idp-remote',
'entityid' => 'https://sso.kimconnect.com/simplesaml/saml2/idp/metadata.php',
'SingleSignOnService' =>
array (
0 =>
array (
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
'Location' => 'https://sso.kimconnect.com/simplesaml/saml2/idp/SSOService.php',
),
),
'SingleLogoutService' =>
array (
0 =>
array (
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
'Location' => 'https://sso.kimconnect.com/simplesaml/saml2/idp/SingleLogoutService.php',
),
),
'certData' => 'CERT-SIGNATURE-HERE,
'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
);

# Assuming that the "WP SAML Auth" plugin is installed and activated, this is the command to link the WordPress SimpleSaml to the prepared instance of such plugin
rm -rf /home/webadmin/pkg/share/httpd/htdocs/wp-content/plugins/wp-saml-auth
ln -s /home/webadmin/pkg/share/simplesamlphp/ /home/webadmin/pkg/share/httpd/htdocs/wp-content/plugins/wp-saml-auth/simplesamlphp
 
Categories: