IT Services Shibboleth Single Sign-On overview Overview What/where/why?
IT Services Shibboleth Single Sign-On overview Overview What/where/why? The UK-Federation/Registration Terminology Configuration
Protecting Content Benefits for Application Developers Setting up Shibboleth on a web server (demo) What/where/why Shibboleth? What? Web Single Sign-On system Separates authentication + authorisation Where? Websites/web applications (+ mobile applications) eJournals Why? Single University username and password Log in once, access everything Lightweight development of personalised content
The UK-Federation/Registration Central store for Shibboleth registrations Automatic integration Federated trust Institutions/organisations sign up Separate registration for each service Enables inter-institutional collaboration
(using University username and password) http://www.ukfederation.org.uk/library/uploads/Documents/overview.pdf Terminology: IdP/SP User types their password once per browser session (or not at all) SPs trust the IdPs assertion of user identity and other information Our gateway login server e.g. Website/webapp/eJournal Terminology: Single Sign-on
Accesses to other SPs go through the same flow but the user doesnt have to login to the IdP again Our gateway login server e.g. Website/webapp/eJournal Terminology: Attributes/SAML Attributes things about a person (forename/department etc.)
Most come from a database on the IdP updated nightly from IDFS Group memberships come from the Active Directory updated live from Grouper Some standard attributes, some custom to us release everything to Newcastle SPs, minimal to external SPs SAML Security Assertion Mark-up Language
https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language Terminology: EntityID/Metadata Unique identifier for servers running Shibboleth (IdP or SP) Also referred to as Relying Party Not a valid URL Newcastle standard: https://servicename.ncl.ac.uk/shibboleth/metadata e.g. https://blackboard.ncl.ac.uk/shibboleth/metadata
. . . Service Provider Configuration files shibboleth2.xml
Main Shibboleth service provider configuration file Mostly wont need updating once setup * attribute-map.xml Defines how attributes get turned into web server headers Probably never needs updating Protecting content (mod_shib)
Most web applications require authentication Service Provider software can control who can access the pages Programs/programmers (and users) can personalise content Protecting content: Linux/Apache shibd.conf Apache configuration file
Require (attribute from the attribute-map.xml file) Protecting content: Linux/Apache Any user AuthType shibboleth ShibRequireSession On Require valid-user
User group AuthType shibboleth ShibRequireSession On Require grouper_groups Applications:D-NUIT:Mailing_Lists:NUIT_All_Mailin Protecting content: Windows shibboleth2.xml
Protecting content: Windows Any user authType="shibboleth"/> User group Applications:DECLS:ECLS_Auto_StaffContact_Admin Application Developers No authentication code required
No user credentials stored Access to live accurate user information Server headers contain headers for personalisation Language and platform independent PHP $_SERVER['Shib-affiliation']; Java HttpServletRequest.getHeader("Shibaffiliation") ASP Request.ServerVariables("HTTP_SHIB_AFFILIATIO
N") Setting up a Shibboleth Service Provider 1. Download/install the Shibboleth SP software - instructions at https://wiki.shibboleth.net/confluence/display/SHIB2/Installation 2. Download the attribute-map.xml and shibboleth2.xml files from http://www.ncl.ac.uk/itservice/login-gateway/installing/ ---------------------------------
3. Edit shibboleth2.xml replace servicename.ncl.ac.uk (test at: https://.ncl.ac.uk/secure) 4. Open an NUService ticket telling us the service address you want us to register. Summary Authentication dealt with by the IdP Authorisation dealt with by SPs Removes need for apps to authenticate Passwords entered in one place
SP configuration in XML or Apache files Access based on user attributes/federated trust Personalised content Access to many resources without re-authentication Lightweight personalisation of content Minimal (none identifiable) information released off-campus, by default Any questions? Shibboleth Wiki: https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPGettingStarted Our service pages: http://www.ncl.ac.uk/itservice/login-gateway/
The Duration of Using ICT Table 2: Teachers' Duration of Using ICT Teachers and ICT Profiles 30,0 9 70,0 21 4,2 1 95,8 23 I took courses about ICT during my educational life 33,3 4 66,7 8 14,3 3 85,7...
For a minimum of two weeks time, keep the Four Agreements at the forefront of your awareness. Devise some way to continuously remind yourself of their wording and the intent of each. (A rubber band around your wrist, a note...
B. Philosophic view: tenure and academic freedom have social utility. "Academic freedom and tenure … exist in order that society may have the benefit of honest judgment and independent criticism which otherwise might be withheld because of fear of offending...
Physical Change - occurs when a physical property (size/shape) of a substance is changed; many physical changes can be undone. Ie, folding paper. Chemical Change - occurs when a one or more substances are changed into new substances with different...
Student Health and Counseling (SHAC) ... Tricare UHC. United Healthcare. Centennial Care Medicaid. ... From all of us at SHAC, we welcome you to the University of New Mexico and look forward to keeping your child healthy throughout their tenure...
Acknowledgement of Country. On behalf of the University of Newcastle I respectfully acknowledge the traditional custodians: the Pambalong clan of the Awabakal people on whose traditional land this Callaghan campus of The University of Newcastle is located and pay my...