Shib in the present and the future Ken Klingenstein Director, Internet2 Middleware and Security

Topics  Core software development  Coupled systems The GUI’s down the road Other AA backend dataplugins Alternative WAYF  Shib-enriched apps  Diagnostics  Managing the processes  The federation consequences

Shibboleth Today  V1.2 on the streets, v1.3 in development  Software still is “simple” but getting increasingly complex. Software is still early.  Identified as the national R&E federation technology in the US, the UK, Australia, Switzerland, Finland, and perhaps others…  Increasingly “at” Burton, Catalyst, DigitalID Conferences  Interoperability discussions and commitments being made among federating software developers

Core software development  V1.0 April 2003, v 1.2 May 2004  V1.3 targeted for fall; priorities include portal support, perhaps artifact SAML profile  SAML 2.0, OpenSAML 2.0 and the meaning of Shibboleth  WS-Fed interoperability  Shib as WebISO  SOAP and SAML –interim and long-term  Shib-lite  Refactoring into core and module for long-term management  Integrated documentation and install guides

SAML 2.0  Historic relationship of SAML and Shib  Contributions from both Liberty and Shibboleth to spec.  TC under OASIS, with contributing editor S. Cantor, Individual  Largely done, perhaps final committee work by end of August, then approval by Nov or IBM…  Refactors a lot, in Shib and vendor products – how quickly will vendors adopt?  OpenSAML 2.0 will happen…

Coupled systems  The major GUI’s – SysAdmin, Autograph, PRM  Other AA backend plug-ins  Alternative WAYF approaches Interim Long-term  Diagnostics  Other trust fabrics

GUI’s to manage Shibboleth

SysPriv ARP GUI  A tool to help administrators (librarians, central IT sysadmins, etc) set attribute release policies enterprise- wide For access to licensed content For linking to outsourced service providers Has implications for end-user attribute release manager (Autograph)  GUI design now actively underway, lead by Stanford  Plumbing to follow shortly

End-user attribute release manager (Autograph)  Intended to allow end-users to manage release policies themselves and, perhaps, understand the consequences of their decisions  Needs to be designed for everyone even though only 3% will use it beyond the defaults.  To scale, must ultimately include extrapolation on settings, exportable formats, etc.

Privacy Management Systems

Personal Resource Manager

Shib-enriched apps  uPortal  OKI and Sakai  Lionshare  Fedora   Globus  Netauth  Virtual organization systems

Diagnostics  Fine grain transparent access controls are going to be difficult to diagnose.  Right now, at least four different failure points result in the same Shib error message The target host is down Network performance caused time out of the Shib protocols Firewall blocked the ARP communications Shib itself is misconfigured  And that error message sucks… (Shire not found)  Worst, fine grain access controls will be harder for coarse users…

Diagnostics: next steps  We have a possible large scale framework for the presentation of diagnostics  We have a possible common event record for systems to create logs in and possible ways of end-end access of logs  We have nothing in between Harvesters, threaders, automated diagnostic aids, etc…  Worse, we have nothing with the network performance and security problems that can masquerade as Shib problems.  Something needs to change, sigh…

Project management  Moving to a more distributed development environment  Setting priorities and coordinating international initiatives Technical architecture and code Coordinating investments IPR  Commercial implementations  Consulting opportunities, outsourcing, etc.  Affiliating with other similar open source projects: Apache, Mozilla, etc.

Federation drivers  As we begin to deploy federations, what operational experiences will drive modifications or enhancements of the code Authentication context field Multifederation support Diagnostic support Privacy enhancements, such as use of information fields, etc…

Down the road  Boredom  Dusty remembrances