Presentation is loading. Please wait.

Presentation is loading. Please wait.

Trust Router Workshop 15 th October 2014. Introduction to the Day Moonshot Workshop.

Similar presentations


Presentation on theme: "Trust Router Workshop 15 th October 2014. Introduction to the Day Moonshot Workshop."— Presentation transcript:

1 Trust Router Workshop 15 th October 2014

2 Introduction to the Day Moonshot Workshop

3 Agenda 10:00 – 10:10 Intro to the morning 10:00 – 12:30 Trust Router & Peering ( 11:00 Break) 12:30 – 13:30 Lunch 13:30 – 13:40 Summary 13:40 – 15:45 Set up a Trust Router ! (15:00 break) 15:45 – 16:00 Summary

4 Moonshot & Communities A quick reminder… What are communities?

5 Communities and Policy Authentication Policy Community / (Community of Registration) Authentication Policy Community / (Community of Registration) Community A Community B Community C Organisation validation to APC’s defined standards Policy coming from community requirements. Could include: Registration LoA AuthN LoA Operational Practices User behaviour Attribute release (RADIUS & SAML) Etc.

6 Moonshot & Communities Communities will consist of a subset of the entities connected to a particular APC.

7 Whole Trust Network

8 Community A

9 Community B

10 Community C

11 Trust Router

12 Hey TR, do you know bob.com? Yeah, he’s over there! P.S. I’ve done some DH magic. Yeah, he’s over there! P.S. I’ve done some DH magic. kthxbye Hi IdP, I’ve got someone claiming to be one of your users.

13 Trust Router

14

15 Hey TR1, do you know bob.com? Yeah, he’s over there! P.S. I’ve done some DH magic. Yeah, he’s over there! P.S. I’ve done some DH magic. Hmm, I don’t. TR2 is my default peer, I’ll ask it… Hey TR2, do you know bob.com? Hmm, I don’t. TR3 is my default peer, I’ll ask it… Hey TR3, do you know bob.com? He’s over there. P.S. DH magic.

16 Hi IdP, I’ve got someone claiming to be one of your users.

17 Routing between Trust Routers Eventually will have routing tables across the whole network For now, default peers can be configured.

18 Trust Router Peering Peering Policy APCs

19 Current Trust tr1.moonshot.ja.net ms-tr.cf.ac.uk ms-rp-ssh.cf.ac.uk

20 By End of tr1.moonshot.ja.net ms-tr.cf.ac.uk ms-rp-ssh.cf.ac.uk Your TR Your Test RP

21 By End of tr1.moonshot.ja.net ms-tr.cf.ac.uk ms-rp-ssh.cf.ac.uk Your TR Your Test RP

22 By End of tr1.moonshot.ja.net ms-tr.cf.ac.uk ms-rp-ssh.cf.ac.uk Your TR Your Test RP Your TR Your Test RP Your TR Your Test RP Your TR Your Test RP

23 Setting up a Trust Router is easy! In the world of Moonshot, a Trust Router is just a resource provider. The resource it’s providing is trust. Like any RP, the TR needs to query an Identity Provider to authenticate users…

24 TR’s own IdP The IdP used by a TR is just an ordinary moonshot IdP, with the identity realm ‘apc.moonshot.ja.net’ - this is the IdP representing the Authentication Policy Community.apc.moonshot.ja.net It keeps a list of credentials used by IdPs and RPs - the XML files that you’ve used to add your own IdPs and RPs to Janet’s TR. For this workshop this step will be skipped, as you’ve probably set up at least one IdP by now.

25 Process 1.Register your RP and TR in the portal as a new RPs – If you don’t have access to the portal, ask for assistance 2.Configure and deploy your TR – See next slide and readme files 3.Test! 4.Configure and deploy your RP 5.Test! 6.Bonus: Reconfigure your IdP to talk to your TR

26 Deploying a Trust Router RHEL/CentOS: – TR: https://wiki.moonshot.ja.net/x/hIQyhttps://wiki.moonshot.ja.net/x/hIQy – RP: https://wiki.moonshot.ja.net/x/vAEphttps://wiki.moonshot.ja.net/x/vAEp Debian: – TR: https://wiki.moonshot.ja.net/x/goQyhttps://wiki.moonshot.ja.net/x/goQy – RP: https://wiki.moonshot.ja.net/x/ugEphttps://wiki.moonshot.ja.net/x/ugEp Sample configurations and key material is available at: – https://portal.moonshot.ja.net/keys/ https://portal.moonshot.ja.net/keys/ – U: octoberws – P: homemade-push-whistle

27 peering.cfg { "default_servers":[ "tr1.moonshot.ja.net" ] }

28 Trusts.cfg communities: – APC, Followed by all CoIs Each has list of idp_realms and rp_realms idp_realms: – Details of each idp_realm (hostname, apc, shared config) rp_realms: – Details of each rp_realm (domain & realm constraints, filters, gss names) gss_names: – gss name for your trust router

29 Domain constraints: – What acceptor hostnames are legal. – (these hosts can claim to be in that realm) – Constrain gss acceptor hostname Realm Constraints: – Constrain gss acceptor realm names Filters: – RP Permitted filters – Future - more – Constraints

30 THANK YOU Janet, Lumen House Library Avenue, Harwell Oxford Didcot, Oxfordshire t: +44 (0) f: +44 (0) e:


Download ppt "Trust Router Workshop 15 th October 2014. Introduction to the Day Moonshot Workshop."

Similar presentations


Ads by Google