Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution...

35
Shibboleth: Molecules, Music, and Middleware

Transcript of Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution...

Page 1: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Shibboleth:Molecules, Music, and Middleware

Page 2: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Outline● Terms● Problem statement● Solution space – Shibboleth and Federations● Description of Shibboleth

– 3 examples of Shib uses at Penn State● Description of Federations

– A look at InCommon● What's it take to do all of this?

Page 3: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Some terms

● Authenticate

– Determine that someone is who they say they are● Authorize

– Determine that someone has the privileges or attributes necessary to perform some function or gain access to information

● Federate

– Take action across institutional realms● Directory

– Middleware service that describes people in your institution

Page 4: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

What's the problem?

● We're serving lots of people (120,000)

● Those people want access to web-based information resources

● Rising legal, ethical, and economic development concerns about legal consumption and distribution of digital information

● Continued concerns about privacy, growing concerns about privacy

Page 5: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Communications

Learning Materials

Student LifeResearch Materials

Stuff

Page 6: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Communications

Learning Materials

Student LifeResearch Materials

Stuff

Communications

Learning Materials

Student LifeResearch Materials

Stuff

Communications

Learning Materials

Student LifeResearch Materials

Stuff

Communications

Learning Materials

Student LifeResearch Materials

Stuff

Communications

Learning Materials

Stuff

Research MaterialsStudent Life

Page 7: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

What's a solution?

● Shibboleth– Let's us use our existing infrastructures,

processes, identities– Open source & open standards– Preserves anonymity, provides tools for

managing privacy– We can provide pathways for

appropriate/legal consumption and distribution of digital materials

Page 8: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

What's a solution?● Federations

– Provides an infrastructure of trust (“trust fabric”)

– Associations of enterprises come together to exchange information about their users and resources in order to enable collaborations and transactions

– Built on the premise of “Enroll,authenticate and attribute locally...Act federally.”

– InCommon – Federation for Higher education and research in the U. S.

Page 9: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Shibboleth – What is it?

• An Internet2 middleware initiative designed to provide federated access management between Web-based resources

• Based on OASIS Security Assertion Markup Language (SAML)

• Allows you to authenticate locally and access Web resources from other institutions or sites

• Can be used to make complex, attribute-based authorization decisions

• Preserves privacy of individual from remote site

Page 10: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

ShibbolethHigh Level Architecture

• Service Provider site (SP) and (Identity Provider) IdP site collaborate to provide a privacy-preserving “context” for Shibboleth users

• IdP authenticates user, asserts Attributes

• Destination site (SP) requests attributes about user directly from Identity Provider site

• Destination site makes an Access Control Decision

• Users (and IdP organizations) can control what attributes are released

• Federations provide common Policy and Trust (more later)

Page 11: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

SAML(Security Assertion Markup Language)

● Developed by the OASIS XML-Based Security Services Technical Committee (SSTC)

● A way to represent authentication and attributes in XML

● Integrity and trust ensured by cryptographically signing the XML assertion

● http://xml.coverpages.org/SAML-TechOverviewV20-Draft7874.pdf

Page 12: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Shibboleth – Classical

Page 13: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Shibboleth – Attribute Push

Page 14: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Shibboleth - Artifact

Page 15: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Demo Time!

Page 16: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Shibboleth at Penn State● Example 1 - WebAssign

– Access to course materials at another university

– NC State, WebAssign, Penn State Dept. of Physics

● Example 2 - Napster Experiment– Access to digital repositories

● Example 3 - LionShare– Authenticated peer-to-peer file sharing

Page 17: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Example 1 - WebAssign

• Summer 2002● ~ 20 students, 2 weeks, 1 course

• Fall 2002● ~200 students● 3 courses

• Spring 2003● ~1800 students● Successful login: 63,026 ● All physics courses at UP location can use

Shibboleth

• Fall 2003 - Production!

Page 18: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Example 1 - WebAssign

WebAssign questions

0

5

10

15

20

25

30

35

Date

Qu

es

tio

ns

● Before Shib:– 1st 2 weeks, 30

questions/day

– Most questions about login

● After Shib– Down to 1-2

questions/day

– Non Shib sections still at 15 questions/day

Page 19: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Example 2 - Napster Experiment

●Technical challenge

● Enable residence hall students access to web based music resource in less than 40 days

● Initial community size ~18,000

● 24 campus locations throughout PA

● Roll-out to all of Penn State following semester● Community size ~100,000

Page 20: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Example 2 - Napster Experiment●Using Shibboleth allowed/allows us to:

● authenticate locally to the near universally-adopted Penn State Access Account

● query attributes of individual and determine eligibility● present Napster with a role and unique identifier, without

exposing the identity of the individual● hand–off transaction to Napster where individual sets up

Napster account● execute the terms and conditions of the contract AND

preserve the individual's ability to maintain the Napster relationship after eligibility changes

Page 21: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Example 3 - LionShare

● A federated peer-to-peer file search application

● Users can identify each other and restrict sharing

● Leverages Internet2's InCommon federation and Shibboleth middleware for trust

● Authorization is attribute-based:

● Ex: “Share syllabus.pdf with any student at Penn State in English 202A section 15.”

Page 22: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.
Page 23: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Back to Federations......

Page 24: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Why Federations?● Institutional users acquiring content from popular providers

(Napster, etc.) and academic providers (Elsevier, JSTOR, EBSCO, Pro-Quest, etc.)

● Institutions working with outsourced service providers, e.g. grading services, scheduling systems

● Inter-institutional collaborations, including shared courses and students, research computing sharing, etc.

● Shared network security monitoring, interactions between students and federal applications, peering with international activities, etc.

Page 25: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Examples of Federations

● JISC, SDSS● InCommon● Fed fed● SWITCH● ws-*● Liberty Alliance● Others are being developed

Page 26: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Deeper look at InCommon● A federation to support the R&E community in inter-

institutional collaborations● InCommon operates at a high level of security and

trustworthiness● InCommon requires its participants to post their relevant

operational procedures on identity management, privacy, etc

● InCommon will be constructive and help its participants move to higher levels of assurance as applications warrant

● InCommon will work closely with other national and international federations

Page 27: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Federations Update – InCommon Membership

● Case Western● Cornell● Dartmouth● Elsevier Science Direct● Georgetown University● Houston Academy of Medicine● Medical Center Library● Internet2● OCLC● Ohio University● OhioLink - The Ohio Library &

Information Network● Napster● SUNY Buffalo

● Penn State● University of Chicago● Ohio State University● UC Irvine● UCLA● University of California-Office of

the President● UC San Diego● University of Rochester● University of Southern California● University of Virginia● University of Washington● WebAssign

Page 28: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

How'd you do that?

Page 29: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

“If you want to make an apple pie from scratch, you must first create the universe.”

-Carl Sagan

Page 30: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Baking Shibboleth/Federations

● Processes, procedures and policies for distributing and managing digital identities– Signature Stations, AD-20, enforcement tools,

etc. -> identity management● An eduPerson compliant enterprise directory● Authentication method(s)● Acceptance of the identifier● Strategies for protecting the identifier● Put in the oven....

Page 31: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Shibboleth speeds/feeds at PSU

● Environment of 8 IBM Blade HS20 proc 2.4GHz (Xeon) mem 2.5GB

● Production Shibboleth IdP environment– Shibboleth 1.3a– InCommon Federation– (blades) servers– Load balance using Cisco SLB– WebAssign– Future - Angel, PHEAA, FastLane (FedFed)

Page 32: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Shibboleth speeds/feeds at PSU (cont.)

● Napster Shibboleth IdP environment– Shibboleth 1.1– non-federated– 4 (blades) servers– Load balance using Cisco SLB

● Future - migrate to current software, and integrate into production IdP environment

● Test Shibboleth environment– 1 (blade) server, IdP, 1 (blade) server, SP

Page 33: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Shibboleth Futures at Penn State

● WorldWide University Network● FastLane● iParadigm TurnItIn● PHEAA/AES● Library vendors● Digitally signed transcripts● Thomson Publishing● ANGEL - CMS

Page 34: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Useful URLs/pointers

● http://www.nmi-edit.org● http://shibboleth.internet2.edu● Subscribe to shib mailing lists● http://www.incommonfederation.org/● http://lionshare.its.psu.edu● Emerging issues/technologies/recipes

– http://middleware.internet2.edu/signet/– SAML 2.0: http://www.oasis-open.org/

http://www.nmi-edit.org/
http://shibboleth.internet2.edu/
http://www.incommonfederation.org/
http://middleware.internet2.edu/signet/
Page 35: Shibboleth: Molecules, Music, and Middleware. Outline ● Terms ● Problem statement ● Solution space – Shibboleth and Federations ● Description of Shibboleth.

Contact Information

● Renee Shuey– Rshuey @ psu.edu


Shibboleth Access Management Federations as an Organisational Model for SDI C.I.Higgins, M.Koutroumpas, A.Seales, EDINA National Datacentre, Scotland A.Matheus,

Shibboleth Access Management Federations as an Organisational Model for SDI C.I.Higgins, M.Koutroumpas, A.Seales, EDINA National Datacentre, Scotland A.Matheus,

Shibboleth Archive

Shibboleth Archive

Shibboleth Identity Provider Version 3 IAM Online March 11, 2015 Scott Cantor, Shibboleth Development Team Marvin Addison, Shibboleth Development Team.

Shibboleth Identity Provider Version 3 IAM Online March 11, 2015 Scott Cantor, Shibboleth Development Team Marvin Addison, Shibboleth Development Team.

Shibboleth at Cardiff University Lindsay Roberts Project Manager – Shibboleth Implementation Phase 2.

Shibboleth at Cardiff University Lindsay Roberts Project Manager – Shibboleth Implementation Phase 2.

Shibboleth Identity Provider (IdP) - CLARIN · Shibboleth Identity Provider (IdP) Sebastian Rieger sebastian.rieger@gwdg.de. CLARIN AAI Shibboleth Workshop 2 Integrating your local

Shibboleth Identity Provider (IdP) - CLARIN · Shibboleth Identity Provider (IdP) Sebastian Rieger [email protected]. CLARIN AAI Shibboleth Workshop 2 Integrating your local

3 September 2015 Federated R US. Agenda Background on Internet2 Middleware and NSF Middleware Initiative The body of work Directories Shibboleth.

3 September 2015 Federated R US. Agenda Background on Internet2 Middleware and NSF Middleware Initiative The body of work Directories Shibboleth.

Federated Identity Management: The Shibboleth Approach Renee Woodten Frost Internet2 Middleware and Security University of Michigan 22 March 2005.

Federated Identity Management: The Shibboleth Approach Renee Woodten Frost Internet2 Middleware and Security University of Michigan 22 March 2005.

Shibboleth Roadmap -- 2005

Shibboleth Roadmap -- 2005

Shibboleth Federations and Secure SDI

Shibboleth Federations and Secure SDI

Shibboleth Access Management Federations and Secure SDI: ESDIN Experience from the OGC Authentication Interoperability Experiment C.I.Higgins, M.Koutroumpas,

Shibboleth Access Management Federations and Secure SDI: ESDIN Experience from the OGC Authentication Interoperability Experiment C.I.Higgins, M.Koutroumpas,

Shibboleth: EBSCOhost implementation

Shibboleth: EBSCOhost implementation

Shibboleth Access Management Federations and Secure SDI ... · Shibboleth Access Management Federations and Secure SDI: ESDIN Experience from the OGC Authentication Interoperability

Shibboleth Access Management Federations and Secure SDI ... · Shibboleth Access Management Federations and Secure SDI: ESDIN Experience from the OGC Authentication Interoperability

Anwendungen sch ützen mit Shibboleth 4. Shibboleth-Workshop Berlin, 28. Februar 2007

Anwendungen sch ützen mit Shibboleth 4. Shibboleth-Workshop Berlin, 28. Februar 2007

24 Jun 2004 Shibboleth: Building Tools for Inter-institutional Resource Sharing Renee Woodten Frost Internet2 Middleware and Security.

24 Jun 2004 Shibboleth: Building Tools for Inter-institutional Resource Sharing Renee Woodten Frost Internet2 Middleware and Security.

What Lies Ahead: Grids, Shibboleth, PKI Ken Klingenstein, Director, Internet2 Middleware Initiative Copyright Ken Klingenstein 2003. This work is the intellectual.

What Lies Ahead: Grids, Shibboleth, PKI Ken Klingenstein, Director, Internet2 Middleware Initiative Copyright Ken Klingenstein 2003. This work is the intellectual.

The Art of Federations. Topics Federations of what… Federated identity versus federations Federations in other sectors – business, gov, ad hoc R&E Federations.

The Art of Federations. Topics Federations of what… Federated identity versus federations Federations in other sectors – business, gov, ad hoc R&E Federations.

Shibboleth Setup

Shibboleth Setup

1 Shibboleth-aware Portals S P I E Information Environments Shibboleth-WS vs. WS-Shibboleth vs. SAML 2.0 SSO with Constrained Delegation JISC Core Middleware.

1 Shibboleth-aware Portals S P I E Information Environments Shibboleth-WS vs. WS-Shibboleth vs. SAML 2.0 SSO with Constrained Delegation JISC Core Middleware.

Shibboleth and TAGPMA

Shibboleth and TAGPMA

Shibboleth Access Management Federations as an Organisational Model for SDI

Shibboleth Access Management Federations as an Organisational Model for SDI