Administrative Information Systems Shibboleth Install Session Technical Information Session for Developers Datta Mahabalagiri

Administrative Information Systems Identity Provider (IdP) The “server” side of Shibboleth HS: SSO/Authentication AA: Attributes One instance per campus

Administrative Information Systems Service Provider (SP) The “consumer” side of Shibboleth Apache Module or IIS ISAPI filter plus shibboleth daemon Handles all interactions with IdP Attributes in HTTP header Software by Internet2

Administrative Information Systems Federation Key/Cert, Metadata WAYF

Administrative Information Systems

Architecture Application / Resource WAYF Identity ProviderService Provider 1 ACS 3 2 HS User DB Credentials 4 AR Handle 8 9 AA Attributes 10 Attributes © SWITCH Attribute Repository SSO (ISIS)

Administrative Information Systems Resource WAYF Identity Provider at UCLA Service Provider 1 ACS I don’t know you. Not even which home org you are from. Redirect your request to the WAYF 3 2 Please tell me where are you from? HS 5 6 I don’t know you. Please authenticate Using ISIS 4 OK, I redirect your request now to the Handle Service of UCLA. AR Handle 8 I don’t know the attributes of this user. Let’s ask the Attribute Authority Handle 9 AA Let’s pass over the attributes the user has allowed me to release Attributes 10 Resoure Manager Attributes OK, based on the attributes, I grant access to the resource 7 User DB Credentials OK, I know you now. Redirect your request to the SP, together with a handle

Administrative Information Systems Access Control Read Http header request.getAttribute(“mail”) request.getAttribute(“Affiliation”) If (affiliation == student) allow Read access Else If (affiliation == faculty) allow Edit access

Administrative Information Systems Where to get help? Internet2: Mailing list: AIS: AIS: