[Prev]

3 Configuring and Running

ZXID ships with working demo configuration so you can run it right away and once you are familiar with the concepts, you can return to this chapter.

ZXID uses a configuration file in default path ((See Simple API for description on how to change this path at deplyment or run time.)) 

  /var/zxid/zxid.conf

for figuring out its parameters. If this file is not present, built-in default configuration is used (see zxidconf.h). ((You can override configuration options at run time by supplying fragments of configuration using -O flags, but for CGI use you would have to use a wrapper shell script to supply them. Hence, easier to just use the config file.)) The built-in configuration will allow you to test features of ZXID, but should not be used in production because it uses default certificates and private keys. Obviously the demo private key is of public knowledge since it is distributed with the ZXID package, and as such it provides no privacy protection what-so-ever. For production use you MUST generate your own certificate and private key.

Usually configuring a system involves following tasks

  1. Configure web server (see your web server documentation)

    1. HTTPS operation and TLS certificate. In the minimum you need the main site, but you may want to configure the Common Domain Cookie virtual host as well.

    2. Arrange for ZXID to be invoked. This could mean configuring zxid, zxid-java.sh, or zxid.pl to be recognized as a CGI script, or it could mean setting up your mod_perl or mod_php system to call ZXID at the appropriate place.

  2. Configure ZXID, including signing certificate and CoT with peer metadata

    1. generate or acquire certificate

    2. Obtain peer metadata (from their well known location) or enable Auto CoT feature.

  3. Configure CoT peers with your metadata. They can download your metadata from your well known location (which is the URL that is your entity ID). For this to happen you need to have web server and ZXID up and running.

[Prev | Next]