1. Mechanisms for
Distributed Global
Authentication
David R Newman

2. The Problem But And / Or Users need to authenticate to use a service
The service provider does not want to manage user credentials
And / Or
The user already has credentials they want to use

3. The Solutions

4. Versions of OpenID
Mechanisms for OpenID and OpenID Connect somewhat similar.
OpenID
Does not require any configuration for the service provider on the identity provider.
Service provider decides which identity providers to trust.
Most identity providers have either been discontinued (e.g. MyOpenID) or deprecated in preference to OpenID Connect (e.g. Google)
OpenID Connect
Uses OAuth 2.0 to register service as an application on the identity provider.

5. OpenID

6. OpenID Providers

7. OpenID Connect

8. Shibboleth Commonly used by higher education institutions.
Requires greater co-operation between service provider and identity provider stakeholders to setup.
Provides a shim on top of existing user and authentication services.
Explicitly designed to support third party discovery services.
Access to user attributes controlled by the identity provider rather than the user

9. Setting up a Shibboleth Service Provider
1. Download IdP metadata including certificate
Shibboleth Service Provider
(SP)
Shibboleth Identity Provider
(IdP)
4. Get IdP to download SP
metadata including certificate
2. Edit SP configuration to reference IdP metadata
5. Edit IdP configuration to reference SP metadata
3. Generate key and certificate for SP and reference in configuration

10. Shibboleth Authentication
User
4. User requests IdP login service
3. SP tell user to authenticate on the IdP
1. User requests restricted resource
9. Service
returns
resource or forbidden
6. User provides login credentials
5. IdP provides login page
2. Service detects login required
Shibboleth Service Provider
(SP)
Service
Shibboleth Identity Provider
(IdP)
8. SP tells Service whether user can access resource
7. IdP provides authentication results and user attributes to SP
(via User)

11. Sharing User Attributes with Shibboleth
Shibboleth Service Provider
(SP)
Shibboleth Identity Provider
(IdP)
2. IdP checks which attributes SP can be given
3. SP maps the attributes
of interest and passes
them onto the service
1. LDAP attributes
mapped to SAML
Service
LDAP
Server

12. Shibboleth with Discovery

13. Eduroam International Wi-Fi roaming service
Predominantly available at higher education institutions
Users can login using their institutional username and password
Easily configurable on Windows, Linux, MacOS, Android and iOS
Uses RADIUS to enable 802.1x authentication

14. How RADIUS Works

15. RADIUS Peering Allows authentications beyond your domain.
Peer directly with another RADIUS server using a “shared secret”
This RADIUS server can then peer with others
Rules in RADIUS configuration determine whether to attempt local authentication or to which server to relay.

16. How Eduroam Works

17. SOWN’s RADIUS Peering
ECS
SOWN
Soton
Jisc
(Janet)
GEANT
DFN
Münster

18. SOWN’s RadMatrix

19. Further Reading OpenID Shibboleth Eduroam/RADIUS
Shibboleth
tall
Eduroam/RADIUS
nt_v1_0.pdf

20. Administering the SOWN Network – David Newman and Chris Malton
Next SOWN Talk
Administering the SOWN Network – David Newman and Chris Malton
Probably 2nd March

21. Questions?