1. Identity Federations - Installation and operation
Marco Fargetta - INFN – Italy
EthERNet e-Research Hackfest – Addis Ababa (Ethiopia)

2. Several software are available to implement an IdP or an SP
Software available
Several software are available to implement an IdP or an SP
The most famous are:
Shibboleth IdP/SP
SimpleSAMLphp
Some applications implement the support to SAML without external tools
We will concentrate on Shibboleth solutions

3. Many linux distributions already include the package
Shibboleth SP
The SP is provided as a module for apache httpd web server
Libraries for application developers are provided but they promote the module as the simplest and more efficient solution
Many linux distributions already include the package
After the installation the main configuration files are in:
/etc/shibboleth

4. The files attribute-map.xml and attribute-policy.xml allow to specify:
SP Configuration
Inside the main configuration, shibboleth2.xml, file it is important to specify:
The parameter for the session
If a DS has to be used
The IdPs to use for the authentication
Can be a list of IdP or a federation file
The files attribute-map.xml and attribute-policy.xml allow to specify:
The attributes retrieved from the IdP
A filter for the attributes

5. Any web application can be configured to work with apache httpd
SP Configuration
Apache can be configured to protect a location or a directory with shibboleth
If the user try to access the authentication is performed and the user attributes are provided to the application behind
Any web application can be configured to work with apache httpd
In some cases apache httpd can be configured as a proxy for the real server
E. g. java application running on tomcat or similar

6. Shibboleth IdP is a java web application
IdP Configuration
Shibboleth IdP is a java web application
It perform all the authentication steps
User management is out of scope and a separated tool has to be used
Last version requires tomcat 8 for the deployment
Deployment file has to be defined
The configuration is in the conf directory where it is deployed
An ansible role has been developed to perform the basic installation
An update and tests could be requested

7. User information can be stored in LDAP or RDBMS (e.g. mysql)
IdP Configuration
Main items to configure include:
The user authentication (ldap.properties)
The attribute database (ldap.properties, attribute-resolver.xml and attribute-filter.xml)
The accepted SPs (metadata-provider.xml)
User information can be stored in LDAP or RDBMS (e.g. mysql)
A software can be provided for basic user management in LDAP but not tested with tomcat 8

8. When the IdP or SP is configured it should publish its own metadata
After Configuration
When the IdP or SP is configured it should publish its own metadata
Metadata should be provided to the other services or the federation
Generated metadata miss some information so they should be copied locally to the service and extended
The link to the extended version has to be provided

9. Thank you!
sci-gaia.eu