JANETUK Shibboleth on Windows Trial TNC May 2008

JANET(UK) Shibboleth on Windows Trial TNC May 2008 Louis Searchwell Please note that the Shibboleth installer for Windows described in this presentation and the example of its use represent work undertaken for EDINA, University of Edinburgh through a JISC funded Shibboleth support and development project (SDSS) by Rod Widdowson, Steading System Software LLP Copyright JNT Association 2008 TNC 2008

Contents • • • Intro & background Why we are doing this How it works JANET(UK) project objectives Conclusions so far Further Information Copyright JNT Association 2008 TNC 2008

Introduction & Background • UK Federation launched November 2006 • Jointly funded by JISC and Becta • Push from Government • Estimate 70% of organisations Microsoft / AD network • Shibboleth installer funded by JISC Copyright JNT Association 2008 TNC 2008

Why? • • Provide a Wizard Style installer for AD Help simplify the installation steps Customer demand Reduce the complexity and resource reliance for Id. P Installation • Prevalence of Microsoft Windows Active Directory • Reduce barrier to entry for smaller institutions to join the UK federation Copyright JNT Association 2008 TNC 2008

What it Does • Prompts for a minimal amount of information – These all have sensible defaults • Installs JAVA, Tomcat & Shibboleth Id. P • Creates installation notes • Creates “to do next” notes “The desire is that you download the installer, accept the defaults and be 95% done. ” Copyright Edinburgh University 2008 TNC 2008

What you don’t have to do • Download & configure a shopping list of related packages e. g. Tomcat • Change Active Directory LDAP schema • Have expert knowledge of Tomcat, Apache & Active Directory • Have Java, Tomcat, & Open. SSL Installed • Have Apache or IIS installed • Detailed knowledge on how to deploy an Id. P Copyright Edinburgh University 2008 TNC 2008

How it Works Copyright Edinburgh University 2008 TNC 2008

Testing with Test. Shib Copyright Edinburgh University 2008 TNC 2008

What to do Next • Join a Federation • Configure access to Active Directory – But not necessarily co-located • A certificate for the “Browser port” • Two holes in the firewall Copyright JNT Association 2008 TNC 2008

Network Topology Considerations • Must be able to see the Active Directory server’s LDAP and Kerberos Ports. • Must have ports 8442 and 8443 visible to the Internet. • Either use a DMZ or tunnel through your firewall. Copyright Edinburgh University 2008 TNC 2008

Network Topology HTTPS (8443) SP Kerberos AD Server Shibboleth Id. P LDAP HTTPS (8442) Copyright Edinburgh University 2008 TNC 2008 User

JANET(UK) Project Objectives • Establish a test bed of JANET sites • Test the initial installation and provide feedback to the developer • Track identified bugs/deficiencies and test any subsequent fixes/enhancements • Documentation • Publish installation and configuration documentation and case studies of the installer • Establish an ongoing community e-mail support list using expertise gained as part of the project Copyright JNT Association 2008 TNC 2008

Sites Currently Involved Highbury College Coventry University Swansea College Swindon College Edinburgh Telford College C 2 K (HP – supported) Wider participation – Other organisations Copyright JNT Association 2008 TNC 2008

Time Scales • Project expected to be complete by August 2008 • Installer available for general release with documentation mid August • Shib 2. 0 version under development • Case studies available on JANET Web Site – End of August 2008 • A release version, based on Shibboleth 2. 0, is planned for the Autumn Copyright JNT Association 2008 TNC 2008

Conclusions • Install requires few parameters • Ideal for organisations with limited resources • It works! • 1. 3 Beta 1 version will be available in near future Copyright JNT Association 2008 TNC 2008

For further information Please visit the project website: http: //www. ja. net/development/middleware/s hibboleth-on-windows. html Documentation: https: //spaces. internet 2. edu/display/SHIB/Id PActive. Directory or Join Mailing List: SHIBONWINDOWS@JISCMAIL. AC. UK Further information Email: (Louis. Searchwell@ja. net) Copyright JNT Association 2008 TNC 2008

JANET(UK) Shibboleth on Windows Trial TNC May 2008 Questions? Acknowledgements – Rod Widdowson of SDSS Copyright JNT Association 2008 TNC 2008