1. Shibboleth 2.0 IdP Training: Authentication January, 2009

2. Terms: Authentication Mechanism A mechanism used to authenticate a user Shibboleth 2 supports the following authentication mechanisms: Remote User Username/Password (LDAP, Kerberos) IP Address

3. Terms: Login Handler An IdP component that configures authentication mechanisms

4. Terms: Session Contains State information about the user Active authentication methods Services the user is signed into Created when user authenticates Session termination = user must authenticate again Many different sessions in federated identity

5. Login Handler: Configuration Login handlers are defined in handler.xml Defined by Must have a type ( xsi:type ) and at least one authentication method Each type has its own set of configuration attributes

6. Login Handler: RemoteUser Login handler that relies on the web server or servlet container for authentication REMOTE_USER is set as the user’s principal name Type: RemoteUser Configuration attributes: (none)

7. Login Handler: UsernamePassword Login handler that prompts for a username and password Validates against a JAAS module LDAP & Kerberos 5 supported Type: UsernamePassword Configuration attributes jaasConfigurationLocation

8. Login Handler: UsernamePassword A login page is provided and will be presented to the user /var/setup/identityprovider/resources/webpages/login.js p Multiple UsernamePassword login handlers can be defined Different authentication methods Failover in case a provider is down

9. Lab: Login Handlers Modify handler.xml to enable the UsernamePassword login handler Configure login.config to use the training LDAP server

10. Login Handler: Authentication Duration Each authentication mechanism supports an inactivity timeout After this timeout expires the mechanism is considered inactive for that user If the user attempts to access a new service provider that requires that authentication mechanism they must re- authenticate

11. Login Handler: Authentication Duration The activity timeout is configured by setting a value for the authenticationDuration attribute for the element The value is the number of minutes of inactivity; the default value is 30

12. Forced Authentication SAML 2 allows a service provider to force authentication of the user, even if the user has an existing session. This is supported in mechanisms that can re- authenticate a user UsernamePassword – yes REMOTE_USER – no The service provider will receive an error if the IdP cannot support forced authentication

13. References More information on IdP authentication can be found at: https://spaces.internet2.edu/display/SHIB2/IdPU serAuthn