Supporting education and research Access Management: the Campus Issues Alan Robiette, JISC Development Group

18 June 2004RUGIT Meeting, LSE2 Topics Single sign-on on campus Via portal or otherwise Integration with external resources Athens, AthensDA and Shibboleth UKERNA wireless roaming project Implications for campus infrastructure planning [And what about the Grid...?]

18 June 2004RUGIT Meeting, LSE3 The JISC vision A next-generation AAA infrastructure must support the following scenarios: Internal (intra-institutional) applications as well as use between organisations Management of access to third-party digital library-type resources (as now) Inter-institutional use – stable, long-term resource sharing between defined groups (e.g. shared e-learning scenarios) Inter-institutional use – ad hoc collaborations, potentially dynamic in nature (virtual organisations or VOs)

18 June 2004RUGIT Meeting, LSE4 VO characteristics A VO's members typically belong to more than one real organisation Wishing to share resources across real- world organisational boundaries (often problematic in security terms) VO membership – which may be more or less formal – could be based on numerous criteria (discipline, project, course enrolment, personal interests...) The authority regulating VO membership could equally take many forms And timescales may be very varied also

18 June 2004RUGIT Meeting, LSE5 Principles (1) Authentication is the responsibility of the user's home site Requests to authenticate the user should be routed back to the home site and take place there National infrastructure will require institutionally-managed authentication services Plus interfacing of these to other components to link to national services

18 June 2004RUGIT Meeting, LSE6 Principles (2) Authorisation is the responsibility of the resource owner Based on attributes supplied by the home site (and/or possibly other authorities) Workable systems depend on agreed attribute naming and sources of authority Progress towards more sophisticated management of digital rights (DRM) requires increased intelligence in the resource's decision engine

18 June 2004RUGIT Meeting, LSE7 Other factors Internet2 and the NMI-EDIT programme Funded by the US National Science Foundation to develop middleware in much the same areas Initial award 2001 – funding renewed in Autumn 2003 NSF and Internet2 both welcome complementary programme of work by JISC (NMI-EDIT has deferred work on digital rights management and VO authorisation)

18 June 2004RUGIT Meeting, LSE8 SSO on campus Single logon for wide range of (usually nowadays) web based services? JISC study reporting shortly Looked at usability, portability, support, portal integration, etc. etc.... CAS (Yale), Webauth3 (Stanford), Pubcookie (Washington/CMU), Cosign (Michigan) A-Select (SURFnet) Quick look at certificates and KX509

18 June 2004RUGIT Meeting, LSE9 Some conclusions US universities' web-login systems: no clear winner All had strengths and weaknesses A-Select: interesting newcomer meriting further work Authentication “broker” Front-ends many (optionally multiple) authentication methods Wide range of applications Commercial support available

18 June 2004RUGIT Meeting, LSE10 External resources: Athens Now well embedded in UK HE Also well supported by publishers AthensDA offers integration with campus authentication schemes Overcomes the dual namespace problem Proof of concept using certificates as user credentials also demonstrated Shibboleth gateway capability is planned (and included in JISC service contract)

18 June 2004RUGIT Meeting, LSE11 So why change? Athens today is still a single- supplier product/service Software owned, maintained and developed by EduServ Little international take-up as yet Athens design lacks the flexibility of more recent approaches Not well adapted to intra-institutional or VO scenarios

18 June 2004RUGIT Meeting, LSE12 Intention to support “roaming” – authenticated guest connection on visited campuses Mainly targeted at wireless use (though in principle also applicable to wired networks – e.g. UK Computers Plus?) Pilot begins Summer 2004 Will require RADIUS infrastructure on participating campuses Eventual international capability UKERNA LIN project

18 June 2004RUGIT Meeting, LSE13 How will it work? User at visited site attempts to authenticate Via login as Guest status recognised and request passed up to national RADIUS proxy Proxy recognises home.domain and passes request on to there Authentication validated by home domain RADIUS server Success/failure code passed back through the chain If “success”, visitor dropped into Guest VLAN

18 June 2004RUGIT Meeting, LSE14 Requirements so far AthensDA requires: A campus authentication regime which supports the AthensDA interface Management of Athens “permission sets” to effect authorisation for Athens resources UKERNA LIN requires: A RADIUS server (RADIATOR recommended) with prescribed form of link to the national-level RADIUS proxy

18 June 2004RUGIT Meeting, LSE15 Shibboleth An architecture developed by the Internet2 middleware community NOT an authentication scheme (relies on home site infrastructure to do this) NOT an authorisation scheme (leaves this to the resource owner) BUT an open, standards-based protocol for securely transferring attributes between home site and resource site Also provided as an open-source reference software implementation

18 June 2004RUGIT Meeting, LSE16 How does it work?

18 June 2004RUGIT Meeting, LSE17 Technical details Currently works via http redirects (but is being extended to other contexts) Assertions in SAML, digitally signed to ensure integrity Open source reference implementation Apache/BSD-style licence Apache, Tomcat, Java, OpenSAML...

18 June 2004RUGIT Meeting, LSE18 Shibboleth pros Good international acceptance US, Australia, some European countries Basic software now well tested Around 30 US universities working with it seriously, plus several content vendors Swiss national HE system deployment Satisfies the main requirements “out of the box” Addresses digital library, shared e- learning and internal use scenarios

18 June 2004RUGIT Meeting, LSE19 Shibboleth cons Software still lacks user-friendly management tools In its present state, still quite demanding to install and run Might require outsourced or packaged services for smaller institutions? Relatively unsophisticated authorisation model Single attribute authority No generalised decision engine

18 June 2004RUGIT Meeting, LSE20 How does it work?

18 June 2004RUGIT Meeting, LSE21 What needs to be done? Implement Shibboleth on JISC services Provides a critical mass of Shibboleth- enabled resources Gain experience on campuses In a variety of institutions Build the national components Which are very few Charm offensive with publishers Plus development work to extend to VOs and more sophisticated DRM

18 June 2004RUGIT Meeting, LSE22 Implications for campuses Shibboleth requires: A campus authentication regime which supports the Shibboleth interface An “attribute authority” holding the user attributes required for authorisation for the resource base served [Standard Shib software distribution allows for this to be SQL database or LDAP directory] N.B. All this strongly reminiscent of the Athens DA requirements

18 June 2004RUGIT Meeting, LSE23 Migration Athens and Shibboleth can co-exist Two-way Athens-Shib gateway is in the EduServ contract; work begins 2004 Some institutions (particularly the smaller ones) could opt to stay with Athens long term? As could smaller publishers... JISC could encourage migration by reducing the central subsidy Though financial models would have to be carefully thought through

18 June 2004RUGIT Meeting, LSE24 Certificates and the Grid End-user certificates likely to remain the basis of Grid security Even considering evolution to mainstream web services However: Trend is to remove certificates from user environment (MyProxy, GridLogin) Various projects (NSF/NMI, JISC) to link Grid authentication and identity management back into campuses – including Shibboleth integration

18 June 2004RUGIT Meeting, LSE25 Summary Everything discussed depends on a comprehensive directory/user DB A-Select (for example) can authenticate against a wide range of technologies, e.g. RADIUS, LDAP, userID/pwd files RADIATOR can also use external user databases in many formats AthensDA requires the same infrastructure (today) Much the same infrastructure will migrate to Shibboleth if/when desired

Supporting education and research Questions?