Internet2 CAMP Shibboleth Scott Cantor (Hey, that’s my EPPN too.) Tom Dopirak Scott Cantor (Hey, that’s my EPPN too.) Tom Dopirak

2 Outline Overview and Status Life as an Origin Site Life as a Destination Site Pilots and Next Steps

3 What is Shibboleth? An initiative to develop an architecture, policy framework, and practical technologies to support inter-organizational sharing of secured web resources and services An Internet2/MACE project with intellectual and financial support from IBM/Tivoli

4 Division of Labor Destination and origin site collaborate to provide a privacy-preserving “context” for Shibboleth users Origin site authenticates user (federated identity) Destination site requests attributes about user directly from origin site and manages access policies based on them Users (and organizations) can control what attributes are released

5 Establishing a User Context

6 Getting Attributes and Determining Access

7 Planned Deliverables An open-source reference implementation of much (but not all) of SAML and all Shibboleth components Documentation (reference materials, deployment assistance) Policies and procedures for joining an initial community of sites (Club Shib)

8 Licensing The Shibboleth implementation will be open- source under one of the prevailing license models (which one is TBD). Every effort to require only open-source (and non-copylefted) libraries and supporting products is being made (so far, so good). By aligning with SAML, commercial solutions may develop.

9 Status Report Architecture and policy discussions wrapping up, documents being drafted Programming is underway, divided among IBM/Tivoli, Carnegie Mellon, and Ohio State Early implementations of a Handle Service and SHIRE are functioning

10 Schedule SAML headed to last call imminently, allowing “1.0” publication of architecture and APIs Some alpha code due in late February Beta implementation due in late Spring

11 Early Implementation Details Operating Systems: Red Hat Linux, Solaris Java SDK XML libraries from xml.apache.org Apache 1.3.x mod_ssl and OpenSSL Tomcat Web ISO (e.g. pubcookie) Directory Services: OpenLDAP, iPlanet MySQL Perl

12 Interesting URLs Shibboleth SAML API Docs (for those with copious free time)

13 Outline Overview and Status Life as an Origin Site Life as a Destination Site Pilots and Next Steps

14 Shibbolization Cookbook for Origin Sites Apply to the club as an origin site Choose any web server that can host Java Servlet and JSP applications Deploy a HS behind web initial sign-on Deploy an AA in conjunction with the HS Install AA plugins for attributes (Java API) Establish default ARPs for community

15 It’s About the Data: Attributes To share resources securely, authorization attributes are needed. Cooperating sites share a common core of attributes, and may define custom attributes for special needs (such as a contract). eduPerson is the starting point.

16 Some “Club Shib” Attributes eduPersonPrincipalName (identity-based access) eduPersonAffiliation (broad demographic access) eduPersonEnrolledCourse (class membership access) eduPersonEntitlement (access per-agreement) eduPersonExtension (used for groups) ou (organizational unit) (member of department) Demographic information?

17 Attribute Sources Shibboleth defines logical attributes that may (but not must) map directly to their directory or database representation. Initial attributes are designed to easily map to the eduPerson LDAP schema. Attribute Authority obtains attributes from plugins (LDAP, JDBC, ????).

18 Privacy and ARPs The P3P makes privacy the voluntary responsibility of the site collecting the information (you may have no privacy, but now it’s explicit). Shibboleth allows the origin site and the user to share an explicit role in the responsibility with Attribute Release Policies.

19 Attribute Release Policies Default policies let users and admins pick a starting point in the privacy spectrum with minimal effort (e.g. member of community only). Admins work with vendors and partners to define special release policies or attributes needed for a specific destination site. Local privacy concerns can be addressed.

20 Managing ARPs

21 Shibboleth and Web-ISO User authentication is up to the origin site. The Shibboleth Handle Service is like a web application that needs to authenticate its users (though of more importance). Use pubcookie, client certificates, or to populate REMOTE_USER and let Shibboleth take over.

22 Outline Overview and Status Life as an Origin Site Life as a Destination Site Pilots and Next Steps

23 Shibbolization Cookbook for Destination Sites Apply to the club as a destination site Choose any web server (as long as it’s Apache 1.3.x, but others to follow) Equip it with the SHIRE and SHAR modules (note the SHIRE includes a Java servlet for the time being) Install SHAR plugins for attributes (C++ API)

24 Access Control and Attribute Consumption A Resource Manager leveraging.htaccess will be provided to evaluate and test simple policy rules before fulfilling requests. Shibboleth defines a standard interface between web applications and attribute data (a CGI header mechanism). Attributes provide their own serialization and matching rules (via plugins).

25 Sample Attribute Expressions (still a work in progress) To test an attribute, we must know its unique name (URN?), its value, and possibly its scope/domain. urn:mace:eduPerson:EPPN urn:mace:eduPerson:Affiliation urn:mace:eduPerson:Entitlement

26 Existing Applications (from most to least integrated) Shibbolize the application and unify intra-campus and inter-campus users Add a second URL tree for inter- campus users Use a Shibbolized proxy server (The latter two might also require code changes or attribute mapping. This is all much simpler for static content.)

27 Outline Overview and Status Life as an Origin Site Life as a Destination Site Pilots and Next Steps

28 Profile of Pilot Sites Member of campus community accessing licensed resource University hosting licensed databases accessed from other universities Talking to several commercial vendors (they need “their customers” asking for this functionality…) Member of a course accessing remotely controlled resource Web based testing Clearinghouse for curriculum packages Web based tools used in courses Member of a workgroup accessing controlled resources Multi-institution project teams Intra-campus scenario Unified access for internal and external users to resources

29 Some Pilots Penn State, Virginia, WebAssign web-based testing for courses University of Delaware Problem Based Learning Clearinghouse (resource for instructors) EDINA (Edinburgh, UK), London School of Economics licensed information resources OSU intra-campus use Internet2 multi-campus workgroups

30 We’re Talking To…. SFX Commercial Information Vendors Project Meteor