1. Introduction to Shibboleth Attribute Delivery for Campuses New to Shibboleth Paul Caskey The University of Texas System

2. Agenda Intro/Background The lure of attributes How are we using attributes in the U.T. System? What are some of the challenges? Questions?

3. Intro / Background U.T. System consists of 15 campuses and System Administration We are pursuing federated IdM in a closed “federation” among these institutions (much like a large decentralized campus) Pilot ops 2004-2006, production as of 9/2006 Policies specify campus IdM practices, established governance structure Current: All institutions on-board, 10 federated apps, new apps emerging (and they want attributes!)

4. The lure of attributes Authorization Get information directly from the authoritative source Can make very granular decisions about access Security No app-based service accounts for accessing directory info Receive timely, accurate information at run-time Eliminate “islands” of potentially stale identity info User convenience More reliable than self-assertion, eliminate typos Users like this feature!

5. How is the U.T. System using attributes? Current: eduPersonPrincipalName primarily used, with app databases still containing lots of directory info A few apps are consuming e-mail address One or two apps consuming eduPersonAffiliation 2 local apps consuming eduPersonEntitlement Emerging: Now, apps are wanting many other atributes: cn, givenName, sn, eduPersonAffiliation, eduPersonEntitlement (multiple values), group membership, and even some as-yet-undefined attributes!

6. What are some of the challenges? Rolling your own – what happens when standard object classes fall short? Who defines these “local” attributes? What restrictions are placed on their vocabulary? How are changes to the above managed over time? Provisioning Converting institutional knowledge into attributes Requires accurate, reliable source data, strong provisioning technology, and a programmer or two… Where does the provisioning function live organizationally?

7. What are some of the challenges? (cont) Attribute Release You want what?? You’re going to do what with it?? Governance: How does an SP request attributes from IdPs? Who approves this? Policy: Ensuring SPs treat attributes “with proper respect” (regulatory issues?) Technology: Per-attribute, per-SP release – managing this level of flexibility can be quite a challenge! Attribute Acceptance Scoped values The Attribute “Authority” What do you do when there are multiple sources for an attribute with varying trust levels (a.k.a. attribute LoA)? How do you handle the situation where the set of all possible values for an attribute come from multiple sources (VOs)?

8. Questions? Thank you!