Shibboleth Service Providers: Technical Requirements and Considerations or How I Spent My Winter/Spring/Summer Vacation Scott Cantor cantor.2@osu.edu Copyright Scott Cantor 2004. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

Getting Started GPG-signed source and Win32 binaries at https://wayf.internet2.edu/shibboleth/ Source: opensaml-1.0.tar.gz shibboleth-1.2.tar.gz Read doc/INSTALL.txt in each thoroughly for build assistance and common problems and compiler notes Binaries: win32/shibboleth-1.2-win32.exe Additional Windows binaries for other libraries, MySQL, and Apache 1.3 and 2.0 5/11/2019 2

Current Build/Install Issues UNIX Some packages may install uncleanly on non-GNU/Linux platforms. “make install” will overwrite configuration files Windows Installer modifies path, rebooting normally required Uninstaller can remove files but will leave behind environment changes and SHAR service mod_shib_13.so and mod_shib_20.so built against Apache packages on the web site, unlikely to work with an arbitrary install 5/11/2019 3

Out of the Box Installs in a hybrid configuration supporting the InQueue sample IdPs and a “localhost” IdP matching the default configuration of the origin Uses a dummy key pair named “localhost”, which allows the default install on both ends to run on a single server Advanced deployment session will discuss PKI configuration and naming issues 5/11/2019 4

Service Provider Architecture INTERNAL EXTERNAL ARP <Requester> Web Resources Shibboleth Application(s) <RequestMap> providerId Service Provider(s) Unit of Access Control Unit of Session Management and Configuration 5/11/2019 5

What is a Service Provider? Collection of resources that share a common set of requirements for user attributes Unit of policy in attribute release by IdPs Entity to whom assertions are issued by IdPs Key Requirements: Choose a providerId, a unique (URI) name for your service; good choice is an https:// URL controlled by the SP's organization: https://jstor.org/shibboleth Publish metadata about your SP that can be used by partners or incorporated by federations for use by IdPs 5/11/2019 6

Service Provider Metadata <SiteGroup Name="urn:mace:inqueue" xmlns="urn:mace:shibboleth:1.0"> <DestinationSite Name="urn:mace:inqueue:example.edu"> <Alias>Example State Service Provider</Alias> <Contact Type="technical" Name="InQueue Support" Email="inqueue-support@internet2.edu"/> <AssertionConsumerServiceURL Location="https://wayf.internet2.edu/Shibboleth.shire"/> <AttributeRequester Name="wayf.internet2.edu"/> </DestinationSite> </SiteGroup> 5/11/2019 7

Service Provider Metadata 1.2 introduces a limited set of metadata required from SP's to properly interact with 1.2 origins. 1.3 is expected to support both the older format and the SAML 2.0 metadata format, which includes the ability to publish descriptions of attribute-consuming services within an SP. Some metadata may be general, some may be partner-specific, but format should be consistent. 5/11/2019 8

Attributes Shibboleth (the project) involved in standardizing attributes and semantics, along with related efforts such as InCommon Shibboleth (the software) knows nothing about specific attributes or semantics, except: Encourages use of unique single-part naming of attributes via URIs SAML attribute values can be arbitrary XML; simplifying this requires some assumptions 5/11/2019 9

Attribute Types Built-in support for Simple and Scoped Attributes string-valued atomic serialization filtering based solely on value e.g. eduPersonEntitlement, eduPersonAffiliation, sn, givenName Scoped compound serialization (value@scope) filtering based on value and/or scope e.g. eduPersonPrincipalName, eduPersonScopedAffiliation, eduPersonTargetedID 5/11/2019 10

Attribute Examples eduPersonPrincipalName eduPersonTargetedID Non-privacy-preserving persistent user identifier Apps maintaining user lists that migrate to EPPN can be instantly Shib-aware eduPersonTargetedID Currently an attribute, a privacy-preserving persistent user identifier modeled on Liberty Likely becomes an alternate SAML NameIdentifier format in 2.0 5/11/2019 11

Attribute Examples eduPersonScopedAffiliation eduPersonEntitlement Small set of values scoped/contextualized to a DNS-style subdomain Could be considered a role expression with the roles derived from eduPersonAffiliation and the group derived from the scope (e.g. student@law.osu.edu) eduPersonEntitlement Usually represents the result of an authorization policy applied by the IdP and asserted directly to the SP Useful but seductive 5/11/2019 12

Writing Shibboleth Applications Does Shibboleth have an API? You can: Programmatically request authentication Access the raw SAML attribute assertion Access the user's IdP's providerId Access the SAML AuthenticationMethod URI Access the individual SAML attributes in stringized form Works from any language ;-) For many applications, no Shibboleth-specific coding necessary 5/11/2019 13

Writing Shibboleth Applications What's Different? WAYF issues Reliance on authentication as authorization rapidly falls apart Shibboleth sessions: here to help you Most deployments must deal with implications of user privacy controls: assume nothing, fail gracefully 5/11/2019 14

Use of PKI Service Providers use keys for distinct purposes: SSL server for user interactions, out of scope SSL client authentication on attribute queries Digitally signing SAML requests (FUTURE) Receive wrapped encryption keys to decrypt XML (FUTURE) Different federations or IdPs MAY require different certificates be used SP metadata identifies (by name) the keys used by an SP so an IdP can authenticate them 5/11/2019 15

Use of PKI Service Providers must: Verify XML signatures created by IdPs Validate SSL server certificates to authenticate IdPs Signature verification keys and CA lists MAY depend on IdP or federation IdP metadata identifies (by name) the keys used by an IdP so an SP can authenticate them A Trust Provider is a pluggable SP (and soon IdP) component that decides how to validate signed messages and SSL certificates Metadata says "use key Foo", Trust says "validate key Foo with CA Bar" 5/11/2019 16

1.2 Component Model Shibboleth Core OpenSAML Protocol Engine Metadata Trust Credentials SP Core IdP Core Attribute Resolver ARP Engine NameID Resolver Authentication Authority (HS) Attribute Authority (AA) Attribute Filtering Access Control Session Cache mod_shib, isapi_shib, etc. Protocol Engine 5/11/2019 17

1.2 Pluggable C++ Interfaces Metadata Trust Revocation Credentials Attribute Acceptance Filtering Configuration SHAR Listener (remains too RPC-centric) Session Cache Request Mapping Access Control 5/11/2019 18