Internet 2 CAMP Shibboleth Scott Cantor cantor 2osu

Internet 2 CAMP Shibboleth Scott Cantor cantor. 2@osu. edu (Hey, that’s my EPPN too. ) Tom Dopirak tgd@cmu. edu

Outline Overview and Status Life as an Origin Site Life as a Destination Site Pilots and Next Steps 2

What is Shibboleth? An initiative to develop an architecture, policy framework, and practical technologies to support inter-organizational sharing of secured web resources and services An Internet 2/MACE project with intellectual and financial support from IBM/Tivoli 3

Division of Labor Destination and origin site collaborate to provide a privacy-preserving “context” for Shibboleth users Origin site authenticates user (federated identity) Destination site requests attributes about user directly from origin site and manages access policies based on them Users (and organizations) can control what attributes are released 4

Establishing a User Context 5

Getting Attributes and Determining Access 6

Planned Deliverables • An open-source reference implementation of much (but not all) of SAML and all Shibboleth components • Documentation (reference materials, deployment assistance) • Policies and procedures for joining an initial community of sites (Club Shib) 7

Licensing The Shibboleth implementation will be opensource under one of the prevailing license models (which one is TBD). Every effort to require only open-source (and non-copylefted) libraries and supporting products is being made (so far, so good). By aligning with SAML, commercial solutions may develop. 8

Status Report • Architecture and policy discussions wrapping up, documents being drafted • Programming is underway, divided among IBM/Tivoli, Carnegie Mellon, and Ohio State • Early implementations of a Handle Service and SHIRE are functioning 9

Schedule • SAML headed to last call imminently, allowing “ 1. 0” publication of architecture and APIs • Some alpha code due in late February • Beta implementation due in late Spring 10

Early Implementation Details • Operating Systems: Red Hat Linux, Solaris • Java SDK 1. 3. 1 • XML libraries from xml. apache. org • Apache 1. 3. x • mod_ssl and Open. SSL • Tomcat • Web ISO (e. g. pubcookie) • Directory Services: Open. LDAP, i. Planet • My. SQL • Perl 11

Interesting URLs Shibboleth http: //middleware. internet 2. edu/shibboleth/ SAML http: //www. oasis-open. org/committees/security/ API Docs (for those with copious free time) http: //usfs 2. us. ohio-state. edu/webdev/shibboleth/ 12

Outline Overview and Status Life as an Origin Site Life as a Destination Site Pilots and Next Steps 13

Shibbolization Cookbook for Origin Sites • Apply to the club as an origin site • Choose any web server that can host Java Servlet and JSP applications • Deploy a HS behind web initial sign-on • Deploy an AA in conjunction with the HS • Install AA plugins for attributes (Java API) • Establish default ARPs for community 14

It’s About the Data: Attributes To share resources securely, authorization attributes are needed. Cooperating sites share a common core of attributes, and may define custom attributes for special needs (such as a contract). edu. Person is the starting point. 15

Some “Club Shib” Attributes edu. Person. Principal. Name (identity-based access) edu. Person. Affiliation (broad demographic access) edu. Person. Enrolled. Course (class membership access) edu. Person. Entitlement (access per-agreement) edu. Person. Extension (used for groups) ou (organizational unit) (member of department) Demographic information? 16

Attribute Sources Shibboleth defines logical attributes that may (but not must) map directly to their directory or database representation. Initial attributes are designed to easily map to the edu. Person LDAP schema. Attribute Authority obtains attributes from plugins (LDAP, JDBC, ? ? ). 17

Privacy and ARPs The P 3 P makes privacy the voluntary responsibility of the site collecting the information (you may have no privacy, but now it’s explicit). Shibboleth allows the origin site and the user to share an explicit role in the responsibility with Attribute Release Policies. 18

Attribute Release Policies Default policies let users and admins pick a starting point in the privacy spectrum with minimal effort (e. g. member of community only). Admins work with vendors and partners to define special release policies or attributes needed for a specific destination site. Local privacy concerns can be addressed. 19

Managing ARPs 20

Shibboleth and Web-ISO User authentication is up to the origin site. The Shibboleth Handle Service is like a web application that needs to authenticate its users (though of more importance). Use pubcookie, client certificates, or <insert ISO system here> to populate REMOTE_USER and let Shibboleth take over. 21

Outline Overview and Status Life as an Origin Site Life as a Destination Site Pilots and Next Steps 22

Shibbolization Cookbook for Destination Sites • Apply to the club as a destination site • Choose any web server (as long as it’s Apache 1. 3. x, but others to follow) • Equip it with the SHIRE and SHAR modules (note the SHIRE includes a Java servlet for the time being) • Install SHAR plugins for attributes (C++ API) 23

Access Control and Attribute Consumption • A Resource Manager leveraging. htaccess will be provided to evaluate and test simple policy rules before fulfilling requests. • Shibboleth defines a standard interface between web applications and attribute data (a CGI header mechanism). • Attributes provide their own serialization and matching rules (via plugins). 24

Sample Attribute Expressions (still a work in progress) To test an attribute, we must know its unique name (URN? ), its value, and possibly its scope/domain. urn: mace: edu. Person: EPPN cantor. 2@osu. edu urn: mace: edu. Person: Affiliation staff@osu. edu urn: mace: edu. Person: Entitlement http: //jstor. org/shib/contracts/osu. edu/1234 25

Existing Applications (from most to least integrated) • Shibbolize the application and unify intra-campus and inter-campus users • Add a second URL tree for intercampus users • Use a Shibbolized proxy server (The latter two might also require code changes or attribute mapping. This is all much simpler for static content. ) 26

Outline Overview and Status Life as an Origin Site Life as a Destination Site Pilots and Next Steps 27

Profile of Pilot Sites Member of campus community accessing licensed resource • University hosting licensed databases accessed from other universities • Talking to several commercial vendors (they need “their customers” asking for this functionality…) Member of a course accessing remotely controlled resource • Web based testing • Clearinghouse for curriculum packages • Web based tools used in courses Member of a workgroup accessing controlled resources • Multi-institution project teams Intra-campus scenario • Unified access for internal and external users to resources 28

Some Pilots Penn State, Virginia, Web. Assign web-based testing for courses University of Delaware Problem Based Learning Clearinghouse (resource for instructors) EDINA (Edinburgh, UK), London School of Economics licensed information resources OSU intra-campus use Internet 2 multi-campus workgroups 29

We’re Talking To…. • SFX • Commercial Information Vendors • Project Meteor 30