Identity Federations - Installation and operation Marco Fargetta - INFN – Italy (marco.fargetta@ct.infn.it) EthERNet e-Research Hackfest – Addis Ababa (Ethiopia)

Several software are available to implement an IdP or an SP Software available Several software are available to implement an IdP or an SP The most famous are: Shibboleth IdP/SP SimpleSAMLphp Some applications implement the support to SAML without external tools We will concentrate on Shibboleth solutions

Many linux distributions already include the package Shibboleth SP The SP is provided as a module for apache httpd web server Libraries for application developers are provided but they promote the module as the simplest and more efficient solution Many linux distributions already include the package After the installation the main configuration files are in: /etc/shibboleth

The files attribute-map.xml and attribute-policy.xml allow to specify: SP Configuration Inside the main configuration, shibboleth2.xml, file it is important to specify: The parameter for the session If a DS has to be used The IdPs to use for the authentication Can be a list of IdP or a federation file The files attribute-map.xml and attribute-policy.xml allow to specify: The attributes retrieved from the IdP A filter for the attributes

Any web application can be configured to work with apache httpd SP Configuration Apache can be configured to protect a location or a directory with shibboleth If the user try to access the authentication is performed and the user attributes are provided to the application behind Any web application can be configured to work with apache httpd In some cases apache httpd can be configured as a proxy for the real server E. g. java application running on tomcat or similar

Shibboleth IdP is a java web application IdP Configuration Shibboleth IdP is a java web application It perform all the authentication steps User management is out of scope and a separated tool has to be used Last version requires tomcat 8 for the deployment Deployment file has to be defined The configuration is in the conf directory where it is deployed An ansible role has been developed to perform the basic installation An update and tests could be requested

User information can be stored in LDAP or RDBMS (e.g. mysql) IdP Configuration Main items to configure include: The user authentication (ldap.properties) The attribute database (ldap.properties, attribute-resolver.xml and attribute-filter.xml) The accepted SPs (metadata-provider.xml) User information can be stored in LDAP or RDBMS (e.g. mysql) A software can be provided for basic user management in LDAP but not tested with tomcat 8

When the IdP or SP is configured it should publish its own metadata After Configuration When the IdP or SP is configured it should publish its own metadata Metadata should be provided to the other services or the federation Generated metadata miss some information so they should be copied locally to the service and extended The link to the extended version has to be provided

Thank you! sci-gaia.eu info@sci-gaia.eu