1. Federated Identity Management at Virginia Tech
Addressing the Risky Business
Virginia Tech Case Study
Mary Dunker
April 14, 2010

2. Copyright
Copyright Mary Dunker, This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

3. About Virginia Tech Located in Blacksburg, Virginia
Nine colleges, graduate school, newly-formed medical school
65 bachelor degree programs
145 master and doctoral degree programs
30,000+ full-time students
10,000+ faculty/staff
200,000+ alumni

4. Why Federate? Emphasis on trust and security
“Everybody’s” doing it – common standards
Service providers can use a single interface for identity providers
Local credentials not necessary for users outside the institution

5. Virginia Tech Implementation
Shibboleth Identity Provider
Shibboleth authentication more secure than LDAP for externally hosted services
eduPersonScopedAffiliation
opaque identifier, different for each service provider per user
Shibboleth front-ended with CAS (Central Authentication Service)
Provides a familiar login + single sign-on using either PID or personal digital certificate

6. Virginia Tech Use Cases: Virtual Library of Virginia
Service hosted at University of Virginia
Enables users from institutions that are members of VIVA and InCommon to view video content
First use at Virginia Tech; standard attributes released: eduPersonScopedAffiliation + opaque identifier (eduPersonTargetedID)

7. Virginia Tech Use Cases: Microsoft DreamSpark
Provides developer software from Microsoft at no charge to students
Student must sign up at DreamSpark site and create Windows Live ID
Shibboleth login used to verify user is a student during first time login
Subsequent logins use Live ID

8. Virginia Tech Use Cases: PeopleAdmin
Human resource system for job applications
eliminates credential creation at hosted site
Used LDAP initially
Virginia Tech required migration to Shibboleth or CAS to increase security
HR administrator must create profiles on host
VT could deliver profile information in SAML payload, if PeopleAdmin could process info.

9. Virginia Tech Use Cases: Google e-Mail
Shibboleth authentication – not InCommon
Web access to Google using VT PID; requires eduPersonPrincipleName
Allows single sign-on using VT CAS
Does not accommodate POP or IMAP clients
Over 31,000 alumni eligible; > 19,000 VT Google accounts set up as of March, 2010

10. Virginia Tech Use Cases: Digital Measures
Future plans to implement Activity Insight using Shibboleth for authentication.

11. References
Virginia Tech Shibboleth Implementation
InCommon CAMP
InCommon Affiliate Program
Shibboleth InstallFest

12. What did you think? Your input is important to us!
Click on “Evaluate This Session” on the conference program page.