Shibboleth at NC State » Moving from WRAP to Shibboleth

Moving from WRAP to Shibboleth

Background Information

Installing Service Providers

If you are running your own web servers, you will need to install the Shibboleth Service Provider software and setup one or more SP Entities. If all you want to do is replace WRAP with Shibboleth, these notes will help guide you through the planning process in step 1 below.

Installation steps

  1. Planning For a New SP
  2. Install SP Software
  3. Configure the SP
  4. Register the SP
  5. Test the SP
  6. Advanced Configuration

Hosted Service Providers

If you are not running your own servers, you will need to make sure your hosting provider is prepared to setup and run a Shibboleth Service Provider on your behalf.

At this time (April 2015), OIT web hosting supports Shibboleth SPs as follows:

You can verify that Shibboleth is setup and running correctly for your domain using this guide: Testing htaccess on a Hosted Server.

Migrating .htaccess files

Once your service is running a Shibboleth SP, you will need to convert any .htaccess config files from WRAP to Shibboleth. You may also need to re-write some code to look for the user attributes under different environment variable names.

For more information:

We also provide a Perl Script to Help Find WRAP Entries. This may be useful to people who are trying to upgrade a lot of directories on a single site or multiple sites.

Using Attributes

Your applications have probably been getting the Unity Userid from WRAP from one of the environment variables: the Apache standard REMOTE_USER, or the WRAP standard WRAP_USERID.


The default Shibboleth configuration populates this variable with the value from SHIB_EPPN, which is "". You have three options:


This variable is obviously not used by Shibboleth. However, to make the transition a little easier, our standard Attribute Mapping configuration file for Shibboleth already provides a map for SHIB_UID to WRAP_USERID. You can continue to use this alias as long as it is still supported by the SP software. (The Wiki warns that this feature is deprecated now.)

In the longer term you should: