2. Shibboleth Integration Fairfield University
Michael Graham-Cornell
Director, Computing & Network Services

3. Agenda The user experience with Shibboleth (before & after CAS)
Shibboleth Overview
What we had
What we did
What we have
Benefits and Gotchas

4. Initial Shibboleth Implementation
Active Gmail Session?
Student accesses mail.student.fairfield.edu
Yes
Gmail access granted No
eduPersonPrincipalName
Active Shibboleth Session?
Yes No
User logs into Shibboleth

5. Shibboleth Integrated with CAS
Active Gmail Session?
Student accesses fairfield.edu/gmail
Yes No
Active Shibboleth Session?
Yes
Gmail access granted No
Active CAS Session?
eduPersonPrincipalName
Yes
User logs into CAS No

6. Overview of Shibboleth

7. What We Had Banner (Identity System of Record)
Sun Identity Manager (Identity Provisioning)
Sun Directory Server (LDAP)
Shibboleth Identity Provider (IdP)
Gmail Service Provider (SP)
Library Database Provider (SP)

8. What We Did Install CAS in Test Install CAS Service Manager
CASify Shibboleth

9. Benefits CAS very secure and robust SSO environment
CAS easily integrated into PHP and .NET applications (preferred for in-house authentication)
We now support CAS and Shibboleth Service Providers – very flexible and easy to configure
Only authorized service providers can authenticate
Legacy applications can still authenticate through LDAP, but are rapidly being “CASified”
Banner Forms, Self-Service, Workflow and BDMS use CAS authentication

10. What’s Better, CAS or Shibboleth?
Whatever works!
Actually, the initial framework is a challenge for both implementations.
However, adding new service providers is MUCH EASIER with CAS than with Shibboleth.