1. Shibboleth Deployment Overview
Keith Hazelton
University of Wisconsin-Madison
Internet2 MACE
Broomfield, Colorado 28-June-04

2. Shibboleth v 1.2 Deployment Overview
Identity Provider (Origin) Deployment
Authentication/Identifier Assertion Phase Components & Dependencies
Identity Attribute Assertion Phase
Service Provider (Target) Deployment
Two scenarios for each:
Shib “classic” e-Lib: accessing licensed resources
Shib federation across a state system: shared services
2/24/2019 2

3. Identity Provider / (Origin)
“HS”
Service
Provider
Browser User
Attribute Authority
Apache (1.3 or 2.0) / Tomcat
Web server / Servlet container
2/24/2019 3

4. Identity Provider / (Origin): AuthN, Identifier
Campus
WebISO
Identity
Provider
“HS”
Attribute Authority
Apache (1.3 or 2.0) / Tomcat
Web server / Servlet container
2/24/2019 4

5. WebISO requirements from Shib
Campus
WebISO
WebISO can authenticate a set of users based on locally issued/registered credentials
Open source WebISO package, PubCookie,mentioned in “Origin” Deployment Guide.
For details & download, see
2/24/2019 5

6. WebISO alternatives
Campus
WebISO
But end-user PKI certs work fine, too (configurable filter)
And there are ways to support multiple AuthN methods with failover (see poster session on “World’s Smallest WebISO”)
2/24/2019 6

7. WebISO requirements from Shib
Campus
WebISO
WebISO can authenticate a set of users based on locally issued/registered credentials
Are all the people who should get the licensed resources included?
Do the policies governing accounts and credentials keep service provider’s risk at an acceptable level?
Have you got WebISO? Which?
Are you shopping?
2/24/2019 7

8. Shib assumes core middleware including Identity Management (IdM) Services
Meta-
Directory
Processes
Registry
Student
System of Record
Campus
WebISO
Human Resources
System of Record
LDAP Directory
Other
Systems of Record
Enterprise Directory
2/24/2019 8

9. Identity Provider Middleware
Campus
WebISO
Enterprise
Directory
“HS”
Attribute Authority
Apache (1.3 or 2.0) / Tomcat
Web server / Servlet container
2/24/2019 9

10. Identity Provider / (Origin)
“HS”
Service
Provider
Browser User
Attribute Authority
Apache (1.3 or 2.0) / Tomcat
Web server / Servlet container
2/24/2019 10

11. Identity Provider / (Origin) Attribute Assertion Phase
“HS”
Service
Provider
Browser User
Attribute Authority
Apache (1.3 or 2.0) / Tomcat
Web server / Servlet container
2/24/2019 11

12. Identity Provider Middleware
Campus
WebISO
Enterprise
Directory
“HS”
Attribute Authority
Apache (1.3 or 2.0) / Tomcat
Web server / Servlet container
2/24/2019 12

13. Attribute Authority (AA) <–> Ent. Directory
Shib AA Deployment Issues:
Configure AA to connect to Ent. Directory
Data connectors can be JNDI-based, JDBC-based (xml-configurable) or custom user plug-ins
Map Directory attributes to SAML attributes
2/24/2019 13

14. Attribute Authority (AA) <–> Ent. Directory
Fragment of ..conf/origin.xml
2/24/2019 14

15. Attribute Authority (AA) <–> Ent. Directory
Resolver links named attributes to specific data connectors:
2/24/2019 15

16. Attribute Authority (AA) <–> Ent. Directory
…and specifies connector (here JNDI LDAP):
2/24/2019 16

17. Attribute Authority (AA) <–> Ent. Directory
…and specifies connector (here JDBC SQL):
2/24/2019 17

18. Attribute Authority (AA) <–> Ent. Directory
Shib AA Deployment Issues, cont.:
Comply with Attribute Release Policy (ARP) in determining which service providers get which attributes
Federation rules are given
Bilateral rules need to be worked out & agreed to
2/24/2019 18

19. Attribute Authority (AA) <–> Ent. Directory
Ah, yes, data access policy
This may drag stakeholders kicking & screaming into the room to confront policy
How you manage this will be key to successful deployment
The big, friendly “DON’T PANIC” on the InCommon Book may help
2/24/2019 19

20. Attribute Authority (AA) <–> Ent. Directory
Shib can transport any attribute--it’s up to sender and receiver to agree on its semantics
“Simple matter of configuration”
Some of the newer attributes
eduPersonTargetedID if you want a persistent identifier, but one that is specific to a given Identity Provider-Service Provider pair
Course-related attributes. URN-based identifier guideline near for course offering. eduCourse coming.
2/24/2019 20

21. Service Provider / (Target)
Identity
Provider
Browser User
Apache (1.3 or 2.0) / Tomcat
Web server / Servlet container or
IIS 5.x or 6
2/24/2019 21

22. Shib Features for Service Providers
WAYF for federations, other options configurable
Authentication method can be passed in attribute assertion for fine tuning risk management
A site may have a public face with specific links that invoke Shib
2/24/2019 22

23. Services you might not have thought of Shibbing
Roaming Access to WLAN
programme/presentations/show.php?pres_id=165
Mikael Linden, CSC, the Finnish IT center for Science
RADIUS-based access controller is a Shibboleth target
Network access control decision based on user’s “home” attributes
2/24/2019 23

24. Services you might not have thought of Shibbing
Portal as Shib Service
Apache in front of Portal on Tomcat
Other approaches under consideration
See Wed. am session, John Paschoud
2/24/2019 24

25. Coming Shib Features for Service Providers
PKI-based direct-to-target scenario
Cert would contains
(possibly opaque) subject id
Identifier for associated Identity Provider
Would eliminate the first several steps in the classic Shib flow diagram
First Service Provider contact to Identity Provider would be the request for attributes
Lots of points of agreement to be worked out
2/24/2019 25

26. Multi-campus system deployment model 1
CampusA
IdProv
CampusB Service
Provider
CampusB
IdProv
Browser User
Apache (1.3 or 2.0) / Tomcat
Web server / Servlet container or
IIS 5.x or 6
CampusC
IdProv
CampusD
IdProv
CampusE
IdProv
2/24/2019 26

27. Multi-campus system deployment model 1
Identity Provider per campus (vs. System IdP model)
Create a system federation (some policy & configuration work here)
Any campus can put up Shibbed service
Or a system library can offer system-licensed resources
Each campus retains control of Identity Management--high autonomy model
2/24/2019 27

28. Multi-campus system deployment model 2
CampusA Dir
Browser User
System-level
Identity Provider
Service
Provider
Service
Provider
Service
Provider
CampusB Dir
Service
Provider
CampusC Dir
2/24/2019 28

29. Multi-campus system deployment model 2
System-level Identity Provider model
Significant campus-to-system metadirectory infrastructure
Create a system federation (some policy & configuration work here)
Any campus can put up Shibbed service
Or a system library can offer system-licensed resources
More seamless “system citizen” experience
2/24/2019 29

30. Coming: Shib breaks free of the browser
Number of open source projects are exploring this space (details in afternoon session)
Ongoing work on a Java implementation of Service Provider components of Shibboleth will really open the door
2/24/2019 30

31. Q & A
Which of these issues seem tough to you?
Lunch BoFs
2/24/2019 31