CNI Spring 2006 Task Force Meeting Shibboleth for Real Oren Beit-Arie Ex Libris Group CNI Spring 2006 Task Force Meeting April 3-4, 2006 – Arlington, VA

Shibboleth and Ex Libris – Past Work Project Goals Establish SFX as a Shibboleth target (Service Provider) Main motivation: enable role-based features Started discussions with the Internet2/Shibboleth group in Summer 2001 Integrated SFX as a Shibboleth Target (0.9…) as part of Pilot/Alpha Testing in 2002 Rolled out test system to 2 Pilot sites Conclusion - too early to assess the value of such an integration Early stage of Shibboleth development No real Shibboleth adoption in libraries Not enough biz case: role-based entitlements in SFX weren’t a priority

Shibboleth and Ex Libris – Current Work Goals: Focus on local library system’s integration with Shib Specific interest in consortia (including hybrid shib/non-shib) Method: ‘Shibbolize’ the Patron Directory Services (PDS) module

Patron Directory Services (PDS) Module Aleph Authentication AuthN sys Credentials/ID MetaLib Authentication PDS DigiTool Authentication User File * Facilitates a single point of integration with authentication systems for Ex Libris products * Simplifies maintenance * Provides infrastructure for single sign-on (SSO) across Ex Libris products * Accommodates consortia with different institutional AuTN/AuTZ services * Enables easier integration with institutional frameworks (e.g. Shibboleth) Other Applications Other Authentication Systems ID/Attributes

PDS – Authentication hub to Shibboleth AuthN sys Credentials/ID PDS User File Other Applications ID/Attributes

Shibboleth and Ex Libris – Current Work Began working with several MetaLib customers Summer 2005 PDS serves dual roles as the Shibboleth Service Provider and, in consortia, as the Shibboleth WAYF SSO fully or partially implemented to suit institutional MetaLib workflow Results – successful implementations at three MetaLib sites Some good input on future direction… Help identify pre-requisites

Current Integration Projects University System of Maryland (USMAI) successfully implemented MetaLib/Shibboleth integration in a test environment National Library of Finland (FinELib) upgraded existing MetaLib/Shibboleth integration As of late-February 2006, six FinELib institutions are live with with a seventh institution nearly complete University of Newcastle upon Tyne completed beta testing MetaLib/Shibboleth integration Included an automatic sign-in (SSO) Uni of Newcastle’s implementation differs from USMAI and FinELib: At Newcastle, a user with a Shibboleth session is automatically logged in to MetaLib – SSO is fully configured – while users who do not have a Shibboleth session access MetaLib as guests. At FinELib and USMAI, users access MetaLib as guests with Shibboleth authentication invoked only after a subsequent login request by the user.

Lessons Learned PDS/MetaLib implementations vary – requires flexibility to accommodate customer’s unique requirements Shibboleth/PDS/MetaLib integration approaches also vary to accommodate the authentication/authorization workflow of each customer’s unique environment… Customers must have a good technical understanding of Shibboleth, PDS/MetaLib Recent projects enabled Ex Libris to identify customer prerequisites for successful PDS/Shibboleth integration with MetaLib Ex.Pre-Reqs: Implement a Shibboleth Identity Provider that can provide user attributes necessary for MetaLib to make authorization decisions Implement logout functionality suitable for their environment Implement the latest versions of MetaLib and related components Integration with Shibboleth Version 1.2 or 1.3 is supported

Next Steps Gradually roll out Shibboleth support for MetaLib – general release TBD Continue working with customers interested in ‘Shibbolizing’ PDS for MetaLib authentication Interested customers must complete integration prerequisites Continue documenting guidelines and best practices for successful Shibboleth/PDS/Ex Libris product integration

Open Issues Policies/Guidelines Functions/scenarios Development: Is there a need for better support or consultancy mechanisms to support large-scale implementation? Federations: InCommon, HAKA - what about the rest of the world? Functions/scenarios Sign-off (Shib v.2?) How to accommodate multiple roles of users? Development: Shib & Metasearch - API/Web services (v.2?) Be able to release OpenURL’s baseURL attribute

Oren Beit-Arie oren@exlibris-usa.com Shibboleth for real Oren Beit-Arie oren@exlibris-usa.com