Shibboleth 2.0: 6 months later… Shibboleth 2.0 -- Again Nate Klingenstein [email protected].
Shibboleth at Cardiff University Lindsay Roberts Project Manager – Shibboleth Implementation Phase...
-
Upload
jocelyn-mccallum -
Category
Documents
-
view
223 -
download
1
Transcript of Shibboleth at Cardiff University Lindsay Roberts Project Manager – Shibboleth Implementation Phase...
Shibboleth at Cardiff University
Lindsay RobertsProject Manager –
Shibboleth Implementation Phase 2
Outline
What’s the problem?What is Shibboleth?What have we done in Cardiff?Where are we now?For the future…
What's the problem?
Users accessing many different systems/resources : User problems
• Lots of usernames/passwords to remember!
Admin Problems• Account creation and administration overhead• Forgotten passwords
Security Problems • Security & Integrity compromised (e.g. “abc123”)
What is Shibboleth?
Shibboleth: Offers single sign-on access to multiple web-
based services Usernames and password at our end –
standard network username/password Based on trust (and legal documents) within
a federation
Shibboleth and FederationsFederation
... WAYF
Shibboleth-Athens
AthensResources
Shib-Athens
Federation
...WAYF
How does Shibboleth work?
WAYF
AA
User DB AA
SSO
Res
ou
rce
ACS
AR
Res
ou
rce
Man
ag
er
I don’t know who you are or where you are
from… redirecting you to the home locator
1
2
So, where are you from?
34
CFU
5
Ok, redirecting you to your organisation
6
Don’t know who you are: please login
7Credentials
9Handle
I need to know attributes... Ask AA
8Handle
Ok, I know you! Redirecting you to the resource, with a handle
Handle
Service ProviderIdentity Provider
Attributes 10
These are the attributes you’re allowed to see:
11
11
Ok, you’re allowed to see this. Here
you go!
Athens
What have we done in Cardiff?
Early adopter funded by JISCPhase 1 – completeLed to entitlements groupPhase 2 – in progress Extensive testing on resources
Still 4 resources not Shibboleth compliantIn the process of rewriting relevant
documentation
Where are we now?
Going live 1st August for: New training grade doctors 1st year undergrads, postgrads, new staff Existing users with expired passwords and
problems
For the future
Next summer Rest of Athens users in University
2008 Athens accounts turned off before we have to
pay
Conclusion
For users Shibboleth offers easier access to resources
– don’t have to remember yet another username/password
This isn’t the end Native Shibboleth…
an aside: “Shibboleth”?
old testament (judges 12:1-6). ephraimites lived to the west of river jordan invaded gilead over river, defeated retreating, way blocked by the gileadites ephraimites/gileadites had different accents pronounced the ‘sh’ sound as ‘sh’/‘si’ those crossing river asked to pronounce ‘shibboleth’
(it means an ear of corn) 42,000 who pronounced it ‘sibboleth’ were killed