1. e-Infrastructure Workshop 28th March 2006, University of Leeds
Shibboleth
Nigel Bruce
ISS, University of Leeds

2. What is Shibboleth (1)
Shibboleth is an initiative to develop an open, standards-based solution to meet the needs for organisations such as Universities to exchange information about their users in a secure and privacy-preserving manner.
It provides the means by which a person using a web browser can be given authorised access to a website using information housed at the user's own institution.
It allows resource providers to easily control access to content based on user characteristics. Moving from identity-based access control to role-based access control.
Not a single product or a piece of software but a set of protocols for the secure exchange of identity information

3. What is Shibboleth (2)
Devolves the process of authentication and authorisation - thus making it scaleable and manageable. Imagine the administrative overheads without it!
Responsibility of user’s home institution to perform process of authentication.
Responsibility of the service provider to perform authorisation - based on trusted information sent by user’s home institution.
The privacy of the user is safeguarded. User can in theory control what personal information about them is released. Only minimum information required is actually sent.
Unless necessary the service provider shouldn’t be able to track what a user has been accessing. However, some applications may have a requirement to do so.

4. What is Shibboleth (3)
Uses the Security Assertion Markup Language (SAML) to pass all authN and authZ information.
An open standards-based protocol for securely transferring attributes between user’s home site and the service provider.
HTTP over SSL used to pass identity information
It doesn’t use ‘Web Services’ - doesn’t use SOAP.
NOT an authentication scheme. It relies on home site infrastructure to do this. e.g. at Leeds we use Active Directory for authentication.
NOT an authorisation scheme. Leaves this to the resource provider. The user’s home site merely sends what it knows and allows the SP to make the authZ decisions.
At Leeds University we use LURCIS - a SQL Server based repository as our attribute store. This is fed from SAP HR and our Banner SIMS
LURCIS contains more information about users than we’d ever want to keep in the AD.
Don’t need to extend the schema of your LDAP server to use Shibboleth

5. Shibboleth Main Components
Two main components to Shib architecture – Identity Providers (IdPs) & Service Providers (SPs).
IdP previously known as a Shibboleth ‘Origin’.
SP previously referred to as a Shibboleth ‘Target’.
IdP is responsible for authenticating users & sending out attribute information.
Shibboleth is very flexible and doesn’t dictate how authentication is actually achieved - LDAP, Kerberos, certificates, CSV.
Once authenticated, IdP generates a pseudonymous token called a ‘Handle’ which is sent to the SP.
SP uses this ‘handle’ to request further information about the user from the IdP (if necessary).
Based on attribute information received, SP then makes an authorisation decision.
For Shibboleth to work the SP and IdP must both be members of the same Federation.

6. Federations
A federation is not a technological entity. It’s an agreement between organisation where membership is restricted to certain types of organisations, e.g. HE and FE bodies
Members share a common set of agreed policies and rules in order to establish trust between members, e.g. members must ensure that ……
Only legitimate members of their respective institutions get accounts within their Authentication system
Accounts are lapsed within a reasonable timeframe after people leave.
Information held about users within their Attribute Store must be accurate and timely.
Password issuing process and security policies must be acceptable to all Service Providers.
Federations may have a legal status in the future
US HE Federation is called InCommon. UK Universities not allowed to join.
Existing test UK Federations include SDSS and the Athens’ Touchstone
JISC aims to establish a production UK HE Federation in September 2006
An IdP can be a member of multiple federations.
Federations can be internal to an organisation, i.e. one SP and one IdP within the same University.

7. Attributes
SPs make authorisation decisions based on attributes released to them.
Federation members must agree on the format of the role-based information that is being passed between them.
EduPerson Object Class has been defined for this purpose.
EduPersonAffiliation, e.g. member, student, faculty, affiliate
EduPersonScopedAffiliation e.g.
EduPersonEntitlement, e.g. “EAST1703, EAST1704, EAST1789, etc” (enrolled modules) or “Mechanical Engineering”, “Fine Arts”
EduPersonPrincipalName, e.g. “ecl6nb”
EduPersonTargetID, e.g. or “6204”
Ideal if all SPs and IdPs within a Federation agreed to use the same type of value.
In principal it’s possible to develop Custom Attribute Processors within the IdP which will send whatever information the SP requires in whatever format they want it.
An IdP can be a member of multiple Federations – each with its own requirements.
Attribute Release Policy – System-wide and user-defined.

8. Users Institutional IdP
Shibboleth Architecture Acknowledgements to John Paschoud, LSE for this slide 4
OK, I will redirect your
request now to
the Handle Service
of your institution. 3 2
Please tell me
where are you from? 1
SHIRE
I don’t know you.
Not even which institution
you are from.
I will redirect your request
to the WAYF Service
WAYF HS 5 6
I don’t know you.
Please authenticate 7
USER DB
Credentials
OK, I know you now.
I will redirect your request
to the SP, together
with a handle
Users Institutional IdP
Service Provider
Attributes 10
Manager
Resource
OK, based on the
attributes, I grant
access to the
resource
SHAR
Handle 8
I don’t know the
attributes of this user.
Let’s ask the Attribute
Authority
Handle 9 AA
Let’s pass over the
attributes the user
has allowed me to
release
Resource

9. GridShib Project
Shibboleth originally envisaged for role-based access control to web-based resources only.
Not inherently suited to Grid users but is now being extended to non-web resources
GridShib is a project which aims to integrate the Globus Toolkit with Shibboleth. See
Consists of plugins for both GT and Shibboleth which enable the Grid SP to securely request user attributes from a Shibboleth IdP.
Attribute information can be pulled by the Grid SP or chosen and intentionally pushed out by the user during the authentication stage, e.g. “Software Developer”, “Chemist”, “Physicist”, etc.
Doesn’t use the Handle Service within Shibboleth for authentication. Instead the PKI certificate is sent and examined by the Attribute Authority
Aim is to make it easier for Grid administrators. Access to resources can be granted on the basis of a user’s role within the VO rather than their specific identity.
WRG members will need to have their own institutional IdP to participate
WRG members will need an IdP for many other reasons, e.g. JISC wants every University to move to Shibboleth by Will have to pay for Athens after that.

10. Shibboleth at Leeds Funding from JISC as an early adopter
Institutional IdP now in production using AthensIM
Plan to move to the Internet2 implementation when Shibboleth version 2 is released.
Fortunate starting position with LURCIS & Active Directory.
Sorting out identity management issues within your institution is the hardest part of implementing a Shib infrastructure.
Leeds is a member of SDSS & Touchstone Federations
We’re also federated with Penn State University
Currently piloting use of Eduserv’s Athens-Shibboleth Gateway. Plan is to go live in September.
Developed a number of resources as Shibboleth Targets, e.g. British Education Index (BEI) & mvForum.
We want to Shibbolise our VLE.
No experience of using Shibboleth in GRID environment.

11. Shibboleth
Questions?