1. Using Umbrella with other technologies at Diamond
Umbrella applied
Using Umbrella with other technologies at Diamond
6th PaNdata & CRISP Harmonisation Meeting, 25 March 2014, Trinity College, Dublin

2. What is...? Umbrella Everyone here knows what it is Uses Shibboleth
iCat
Moonshot
Brings power and richness of SAML to RADIUS
Uses RADIUS + GSS-API.
6th PaNdata & CRISP Harmonisation Meeting, 25 March 2014, Trinity College, Dublin

3. What have Diamond done so far?
Connected Moonshot PoC with Umbrella (late Aug ’13)
Published Jasig CAS ABFAB authenticator on Maven Central (Nov ’13)
Built Shibboleth ECP client together with DARIAH-DE (Dec ‘13/Jan ‘14)
Used indirectly in new iCat Shib2Local authenticator
Launched pilot beamline with Moonshot + Umbrella using above (Mar ‘14)
Umbrella can extend beyond just UO + WWW applications, examples follow
6th PaNdata & CRISP Harmonisation Meeting, 25 March 2014, Trinity College, Dublin

4. Umbrella + Moonshot DLS has implemented Moonshot on a beamline (P45)
Umbrella is another IdP source for P45
Internal Umbrella server, syncing with UmbrellaID.org
Umbrella server has FreeRADIUS server (v3.0.1) installed
Authentication with EAP-TTLS/EAP-GTC (EAP-TTLS/PAP)
Future:
Add UmbrellaID as a Moonshot trust-router IdP
Part of GÉANT, part of what Björn is doing
6th PaNdata & CRISP Harmonisation Meeting, 25 March 2014, Trinity College, Dublin

5. Umbrella + iCat (1/2)
Shibboleth and Shibboleth-2-Local (Shib2Local) iCat connectors
Uses Shibboleth ECP functionality
Remains secure over SSL even though SAML attributes in plain text
Java 1.7 supports TLS SNI (Server Name Indication), i.e. safer SSL
Shibboleth connector
Uses simple yes/no AuthN (username typed in is user for iCat)
Shibboleth-2-Local (Shib2Local) connector
Uses local database mapping for EAAHash -> local username
Verified as functional in SV8
6th PaNdata & CRISP Harmonisation Meeting, 25 March 2014, Trinity College, Dublin

6. Umbrella + iCat (2/2) Current (v1.0.x)
Proves the concept that Umbrella + iCat is possible
Uses both SP and IdP of a Shibboleth conversation, sits in the middle
ECP client requests access to SP, receives SP AuthN request
ECP client forwards AuthN request to IdP, gets SAML assertion
Consumes assertion
Future
ECP client will be SP, simply builds + sends AuthN request
The rest remains the same
Will allow us to use conditional encryption on assertions
6th PaNdata & CRISP Harmonisation Meeting, 25 March 2014, Trinity College, Dublin

7. What next? As part of new JANET role, will be involved in GÉANT
Will continue to support DLS and STFC in Moonshot roll-out, then extend to other Research + Industry organisations (this is my new job)
Hope to continue work with Richard Eckart de DARIAH-DE on Shibboleth ECP client
Hope to continue work with Björn + Umbrella
Last function at DLS will be presentation of this work at Janet’s Networkshop42 on April 2 in Leeds, UK. This will be available online
6th PaNdata & CRISP Harmonisation Meeting, 25 March 2014, Trinity College, Dublin

8. Questions?
6th PaNdata & CRISP Harmonisation Meeting, 25 March 2014, Trinity College, Dublin