internet2 camp shibboleth scott cantor [email protected] (hey, that’s my eppn too.) tom dopirak...
TRANSCRIPT
Internet2 CAMPShibbolethInternet2 CAMPShibboleth
Scott [email protected] (Hey, that’s my EPPN too.)
Scott [email protected] (Hey, that’s my EPPN too.)
2
Outline
Overview and Status
Life as an Origin Site
Life as a Destination Site
Pilots and Next Steps
3
What is Shibboleth?
An initiative to develop an architecture, policy framework, and practical technologies to support inter-organizational sharing of secured web resources and services
An Internet2/MACE project with intellectual and financial support from IBM/Tivoli
4
Division of Labor
Destination and origin site collaborate to provide a privacy-preserving “context” for Shibboleth users
Origin site authenticates user (federated identity)
Destination site requests attributes about user directly from origin site and manages access policies based on them
Users (and organizations) can control what attributes are released
5
Establishing a User Context
6
Getting Attributesand Determining Access
7
Planned Deliverables
•An open-source reference implementation of much (but not all) of SAML and all Shibboleth components
•Documentation (reference materials, deployment assistance)
•Policies and procedures for joining an initial community of sites (Club Shib)
8
Licensing
The Shibboleth implementation will be open-source under one of the prevailing license models (which one is TBD).
Every effort to require only open-source (and non-copylefted) libraries and supporting products is being made (so far, so good).
By aligning with SAML, commercial solutions may develop.
9
Status Report
•Architecture and policy discussions wrapping up, documents being drafted
•Programming is underway, divided among IBM/Tivoli, Carnegie Mellon, and Ohio State
•Early implementations of a Handle Service and SHIRE are functioning
10
Schedule
•SAML headed to last call imminently, allowing “1.0” publication of architecture and APIs
•Some alpha code due in late February
•Beta implementation due in late Spring
11
Early Implementation Details
•Operating Systems: Red Hat Linux, Solaris
•Java SDK 1.3.1
•XML libraries from xml.apache.org
•Apache 1.3.x
•mod_ssl and OpenSSL
•Tomcat
•Web ISO (e.g. pubcookie)
•Directory Services: OpenLDAP, iPlanet
•MySQL
•Perl
12
Interesting URLs
Shibboleth
http://middleware.internet2.edu/shibboleth/
SAML
http://www.oasis-open.org/committees/security/
API Docs (for those with copious free time)
http://usfs2.us.ohio-state.edu/webdev/shibboleth/
13
Outline
Overview and Status
Life as an Origin Site
Life as a Destination Site
Pilots and Next Steps
14
Shibbolization Cookbook forOrigin Sites
•Apply to the club as an origin site
•Choose any web server that can host Java Servlet and JSP applications
•Deploy a HS behind web initial sign-on
•Deploy an AA in conjunction with the HS
•Install AA plugins for attributes (Java API)
•Establish default ARPs for community
15
It’s About the Data: Attributes
To share resources securely, authorization attributes are needed.
Cooperating sites share a common core of attributes, and may define custom attributes for special needs (such as a contract).
eduPerson is the starting point.
16
Some “Club Shib” Attributes
eduPersonPrincipalName(identity-based access)
eduPersonAffiliation(broad demographic access)
eduPersonEnrolledCourse(class membership access)
eduPersonEntitlement(access per-agreement)
eduPersonExtension(used for groups)
ou (organizational unit)(member of department)
Demographic information?
17
Attribute Sources
Shibboleth defines logical attributes that may (but not must) map directly to their directory or database representation.
Initial attributes are designed to easily map to the eduPerson LDAP schema.
Attribute Authority obtains attributes from plugins (LDAP, JDBC, ????).
18
Privacy and ARPs
The P3P makes privacy the voluntary responsibility of the site collecting the information (you may have no privacy, but now it’s explicit).
Shibboleth allows the origin site and the user to share an explicit role in the responsibility with Attribute Release Policies.
19
Attribute Release Policies
Default policies let users and admins pick a starting point in the privacy spectrum with minimal effort (e.g. member of community only).
Admins work with vendors and partners to define special release policies or attributes needed for a specific destination site.
Local privacy concerns can be addressed.
20
Managing ARPs
21
Shibboleth and Web-ISO
User authentication is up to the origin site.
The Shibboleth Handle Service is like a web application that needs to authenticate its users (though of more importance).
Use pubcookie, client certificates, or <insert ISO system here> to populate REMOTE_USER and let Shibboleth take over.
22
Outline
Overview and Status
Life as an Origin Site
Life as a Destination Site
Pilots and Next Steps
23
Shibbolization Cookbook for Destination Sites
•Apply to the club as a destination site
•Choose any web server (as long as it’s Apache 1.3.x, but others to follow)
•Equip it with the SHIRE and SHAR modules (note the SHIRE includes a Java servlet for the time being)
• Install SHAR plugins for attributes (C++ API)
24
Access Control andAttribute Consumption
•A Resource Manager leveraging .htaccess will be provided to evaluate and test simple policy rules before fulfilling requests.
•Shibboleth defines a standard interface between web applications and attribute data (a CGI header mechanism).
•Attributes provide their own serialization and matching rules (via plugins).
25
Sample Attribute Expressions(still a work in progress)
To test an attribute, we must know its unique name (URN?), its value, and possibly its scope/domain.
urn:mace:eduPerson:[email protected]
urn:mace:eduPerson:[email protected]
urn:mace:eduPerson:Entitlementhttp://jstor.org/shib/contracts/osu.edu/1234
26
Existing Applications(from most to least integrated)
•Shibbolize the application and unify intra-campus and inter-campus users
•Add a second URL tree for inter-campus users
•Use a Shibbolized proxy server
(The latter two might also require code changes or attribute mapping. This is all much simpler for static content.)
27
Outline
Overview and Status
Life as an Origin Site
Life as a Destination Site
Pilots and Next Steps
28
Profile of Pilot Sites
Member of campus community accessing licensed resource• University hosting licensed databases accessed from other universities• Talking to several commercial vendors (they need “their customers” asking
for this functionality…)
Member of a course accessing remotely controlled resource• Web based testing• Clearinghouse for curriculum packages• Web based tools used in courses
Member of a workgroup accessing controlled resources• Multi-institution project teams
Intra-campus scenario• Unified access for internal and external users to resources
29
Some Pilots
Penn State, Virginia, WebAssignweb-based testing for courses
University of DelawareProblem Based Learning Clearinghouse (resource for instructors)
EDINA (Edinburgh, UK), London School of Economicslicensed information resources
OSUintra-campus use
Internet2multi-campus workgroups
30
We’re Talking To….
•SFX
•Commercial Information Vendors
•Project Meteor