3 Nov 2003 A. Vandenberg © Second NMI Integration Testbed Workshop on Experiences in Middleware Deployment, Anaheim, CA 1 Shibboleth Pilot Local Authentication and Authorization Control for Access to Remote Web Resources Art Vandenberg Director, Advanced Campus Services Georgia State University “Copyright Art Vandenberg This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.”

3 Nov 2003 A. Vandenberg © Second NMI Integration Testbed Workshop on Experiences in Middleware Deployment, Anaheim, CA 2 Given that... Shibboleth – you know what it is... You know key concepts of privacy preserving trust across federated domains... You understand it uses open source standards…

3 Nov 2003 A. Vandenberg © Second NMI Integration Testbed Workshop on Experiences in Middleware Deployment, Anaheim, CA 3 What’s the Problem Space at Georgia State? Access to digital library resources (vendor databases) Current solution –IP-based access spoofable, limiting –Proxy server –Group accounts some database passwords posted on public web! –Additional accounts & passwords management hassles, synchronization complexity extra account for user lag time setting up a new person (faculty, student, or employee) low level assurance

3 Nov 2003 A. Vandenberg © Second NMI Integration Testbed Workshop on Experiences in Middleware Deployment, Anaheim, CA 4 Shibboleth Solution for Georgia State’s Pullen Library Access without proxy Leverage local enterprise authentication Access based on role attributes (finer grained) Enables access from anywhere on web Reduced logins Stronger authentication (not just IP) Addresses user privacy

3 Nov 2003 A. Vandenberg © Second NMI Integration Testbed Workshop on Experiences in Middleware Deployment, Anaheim, CA 5 Architecture components Sun Solaris for Georgia State Shibboleth Origin Apache, Tomcat, J2SE Origin site (enterprise) requirements –Handle Server single signon (SSO) or web initial signon (WebISO) –Attribute Authority repository (mySQL or LDAP) Target site requirements –SHIRE –SHAR –WAYF –Resource Manager See NMI component PubCookie See NMI component LDAP recipe See NMI component eduPerson

3 Nov 2003 A. Vandenberg © Second NMI Integration Testbed Workshop on Experiences in Middleware Deployment, Anaheim, CA 6 Flow Diagram Handle Service SHIRE (Shibboleth Handle Indexical Reference Establisher Authentication System Attribute Authority WAYF (Where are you from?) Web resource ( SHAR (Shibboleth Attribute Requester)

3 Nov 2003 A. Vandenberg © Second NMI Integration Testbed Workshop on Experiences in Middleware Deployment, Anaheim, CA 7 EZProxy Institutions Georgia Quite some potential… Especially if we work together to convince Vendors. (Or do we want to use IP access and still pay site license rates while only few may need the resource?)

3 Nov 2003 A. Vandenberg © Second NMI Integration Testbed Workshop on Experiences in Middleware Deployment, Anaheim, CA 8 Georgia State Shibboleth October 2003 V 1.0 origin installed Authenticate using CampusID Attributes via eduPerson from Campus LDAP Pilot with EBSCO, OCLC, JSTOR Library Shibboleth pilot page – Let’s take a look LDAP Recipe for directory, ids 2. eduPerson for eduPersonAffiliation eduPersonEntitlement 3. Shibboleth for access to web resources

Access Web Resource – EBSCO GSU Library Shibboleth Pilot info page 1. EBSCO test URL

Redirect via WAYF InQueue Federation (for pilot testing) 2. Pick your Shib origin (these are Inqueue sites recognized by target WAYF)

Local Authentication (GSU origin) 3. Don't worry about certificate warning, say OK -- your browser has not been configured for certificates used by the test environment

(Interim Certificate used at Target) 4. Ditto… say Yes test certificates Not known to your browser

GSU Origin – Local Login 5. Use local authentication (GSU CampusID/pw) This page invoked by Georgia State Origin

Successful Authentication Authenticated user is being directed to web site… (with Authorization checking behind the scenes)

EBSCO Web Resources Accessing EBSCO research Databases. 6. Do your thing. 5 steps: 1. Pick url 2. Pick origin 3. Ok to cert 4. Yes to cert 5. Login Use resource

Access Web Resource – JSTOR 1. Now Select Browse JSTOR (continuing current browser session)

Access, no Re-login (Shib saves session) Direct access to next Shibboleth site – (no WAFY, no GSU local login) 2. Do your thing. 1 (NOT 5) steps: 1. Pick url [2. NA] [3. NA] [4. NA] [5. NA] Use resource

JSTOR site knows it’s GSU “Your access to JSTOR is provided by Georgia State University” (identity not passed, but attributes may be)

OCLC / authorization attributes OCLC needs no further authentication, but does require specific attributes eduPersonAffiliation = eduPersonEntitlement= urn:mace:oclc:org…

OCLC web resources Appropriate attributes permit access... OCLC recognizes Georgia State member (and contract)

3 Nov 2003 A. Vandenberg © Second NMI Integration Testbed Workshop on Experiences in Middleware Deployment, Anaheim, CA 21 Ongoing Work Federations –InQueue (pilot) to InCommon (incorporated Board of Directors…) –Policy framework Production Server (Origin Service) –Enterprise level hardware –Full SSL on all components –Production certificates (not test certs…) Provisioning services & management of attributes/roles –IBM Directory Integrator component

3 Nov 2003 A. Vandenberg © Second NMI Integration Testbed Workshop on Experiences in Middleware Deployment, Anaheim, CA 22 Ongoing NMI Working Groups... Shibboleth Academic Sig –Focus group: Library SysAdmin of vendor licenses –Drafting second set of vendors Other vendors? Georgia State needs –200+ Library Vendors –WebCT –Galileo (Georgia Statewide Library) Research & deployment opportunities? –Vaishnavi & Stucke (CIS) & Atlanta Airport

3 Nov 2003 A. Vandenberg © Second NMI Integration Testbed Workshop on Experiences in Middleware Deployment, Anaheim, CA 23 More info & links you can test drive Shibboleth – Internet2 – Switch - Swiss Education and Research Network (demo) – –Demos using Example State University WebCT press release Shibboleth – etymology –

3 Nov 2003 A. Vandenberg © Second NMI Integration Testbed Workshop on Experiences in Middleware Deployment, Anaheim, CA 24 Contact Art Vandenberg Thank you

Second NMI Integration Testbed Workshop on Experiences in Middleware Deployment Anaheim, CA Monday November 3, :30 am – 5:00 pm