2. Shibboleth at Newcastle Caleb Racey Webteam ISS

3. Shibboleth experiences Program  Background  What shib has enabled  Benefits of shib  How to do shib

4. Background IAMSECT Project - JISC funded  Shib early adopter  2 year project (finished this summer)  VLE focussed  Focus on shared medical students  Collaboration with Durham One of few practical deployment Projects

5. What we use shib for Blogs Mailing lists Wikis Webforms Course submission VLEs Athens

6. Blogs

7. Ease of installation: Modify php authentication code (1 man day) Benefits: User account creation automated Login never exposed to potentially untrustworthy code

8. Sympa mailings list

9. Sympa Mailing lists Ease of installation: Supported out of the box, adjust config file (1 hour) Benefits: SSO Auto account creation Allows both shib and local Auth

10. Mediawiki

11. Ease of installation: Download + install “extension” tweak config file (1 hour) Benefits: SSO User accounts creation automated Login never exposed to potentially untrustworthy code

12. Access controlled websites

13. Quick easy Access Control Ease of installation:.htaccess file by users (5 mins) Benefits: Web developers don’t need to understand complexities of secure login Auto population of info fields (email addresses etc)

14. Coursework.cs

15. Ease of installation: Install shib + configure server Work out how best to do WAYF Benefits: Federated service now possible, Durham students can now use.

16. Medical VLE

17. Ease of installation: Hard (Zope based) fast_cgi complex difficult user base Large legacy Benefits: SSO Roadmap away from legacy Reduced admin

18. Athens

20. Ease of installation: Hard (at the time) : - easy now? working out how to join multiple feds SSL cert incompatibility worries- now gone Benefits: SSO Reduced Admin overhead

21. What shib is not used for Blackboard in Newcastle  Blackboard shib support is UNIX based  Windows possible (but not out of the box)  Durham have test UNIX install

22. Benefits of shib International takeup = defacto standard “out of the box” shibd apps available. One web login technology to support Less SysAdmin effort Less documentation Less user education Less burden on web developers, don’t need to understand: How to do secure login How / Where to get user data

23. How to install Very brief overview of steps Prerequisites IdP SP Timescales See http://iamsect.ncl.ac.uk for detailshttp://iamsect.ncl.ac.uk

24. How to install: prerequisites Prerequisites: Identify suitable password store e.g. Active Directory Learn how to do https SSL certs, certificate Authorities Deploy WebISO or simple sign on e.g. Pubcookie, CAS, Mod_auth_Ldap

25. How to install: shib IdP Install and configure the software: not that hard (anymore) Java based (java skills not needed) Follow guide tweak xml config files Difficult bits: SSL certs (global sign or Thawte) Identify institutional data stores

26. How to Install: shib SP Linux + Apache: Prerolled RPMs= install + tweak config file (couple of hours) Windows + IIS: MSI installer= install+tweak config file (couple of hours) Java, Python, Ruby, Perl or cgi: Stick behind linux + apache, Install + configure connector (mod_jk, fast_cgi) (couple of days)

27. Where to get help  https://authdev.it.ohio- state.edu/twiki/bin/view/Shibboleth/Web Home  http://iamsect.ncl.ac.uk http://iamsect.ncl.ac.uk  http://shib.kuleuven.be/ http://shib.kuleuven.be/  http://www.switch.ch/aai/

28. Questions?