1. Copyright © 2006 by the University of Kansas Providing Intra-campus SSO Service Kathryn Huxtable Identity Management/Core Middleware Information Technology, A division of Information Services The University of Kansas khuxtable@ku.edu

2. Copyright © 2006 by the University of Kansas Intra-campus Service Provider Provides a service to local campus community Should integrate with campus SSO Can do so using campus SSO or via Shibboleth, assuming that Shibboleth is integrated with campus SSO We discourage direct LDAP authentication or attribute queries

3. Copyright © 2006 by the University of Kansas KU’s campus SSO (Argus) Implemented in 1999 –Inspired by UIUC’s Bluestem system –Attribute based; very similar to Shibboleth –Uses its own XML — pre-SAML Downside: for historical reasons it only supports Perl and Java applications http://www.aims.ku.edu/argus

4. Copyright © 2006 by the University of Kansas Shibboleth or Campus SSO? Is a logout button necessary? Is it static pages, or non-Java or -Perl? Could there potentially be intercampus use? Is it on a system not supported by Shibboleth, e.g. standalone Tomcat? Is it on a system not supported by campus SSO, e.g. IIS?

5. Copyright © 2006 by the University of Kansas Attribute Release Policies Policy structure was already in place, thanks to our campus SSO Not completely formalized, but is well understood. Will be formalized for ISO 27001 certification in the next few months Each attribute has one or more data custodians

6. Copyright © 2006 by the University of Kansas Where Do Attributes Come From? (Basic “Join” Outline)

7. Copyright © 2006 by the University of Kansas Basic Questions for SP owner Can the AuthN/AuthZ be externalized? –How does the Service Provider (SP) authenticate a user? –How does the Service Provider authorize a user? –What attributes does the Service Provider need to authorize a user?

8. Copyright © 2006 by the University of Kansas Data Stewards Own Release Release of an attribute to a Service Provider MUST be approved by that attribute’s data steward Some attributes come from multiple data sources, e.g. displayName may come from HR or student data; may require multiple sign-off

9. Copyright © 2006 by the University of Kansas Release Approval Process

10. Copyright © 2006 by the University of Kansas What About Problems? User fails to authorize in SP –Help Desk has access to directory information –Help Desk employees (including students) sign confidential use statement –If they don’t understand the problem, they contact Core Middleware –Core Middleware figures out the problem May require data change in database of record Core Middleware contacts data custodian

11. Copyright © 2006 by the University of Kansas Conclusions We’ve been handling these issues for several years now with our campus SSO; Shibboleth is not different for us Maintaining two SSOs is annoying; we would like to standardize on Shibboleth Where’s my *#&@ logout? KU Identity Management/Core Middleware web site: http://www.aims.ku.edu