Shibboleth On-line Authentication System

Transcription

1 Shibboleth On-line Authentication System Jon Browne Senior Consultant Drew Heald BSc (Hons), MPhil, MCP Systems Developer IBIS Business Consultants Ltd

2 Accessing a Web Resource Request Client W W W Server Response Client user accesses a free resource Client user is authenticated via a username and password to access a protected resource Client user is responsible for setting up that account

3 Web Resources for Education Educational establishments subscribe to resources on behalf of many users Parts of a given resource may only be accessible by some of the users in a given educational establishment The resources to which a given user has access change periodically

4 Authentication School Resource Students Directory/Database Student data Authentication Authorisation Directory/Database Student data Available to all Available to year 3 and above Available to year 6 and above

5 Authentication Common Issues Exposure of personal information High administrative burden Lack of traceability Password leakage Many passwords problem Resource accessibility is restricted Complicated to use

6 Shibboleth Aims to: Ensure no personal information is exposed unless necessary Minimise the number of passwords a user needs to remember Minimise the administrative burden Enable user traceability Be transparent to the user Enable access from any location

7 Shibboleth User Authentication Request LEA/RBC (Origin) Handle Service Resource (Target) SHIRE User Authentication User Attributes (LDAP/SQL) WAYF Bash Street St Trinians Hogwarts LGfL Oxford Resource(s) Attribute Authority SHAR

8 Shibboleth User Authentication 1.Request URL LEA/RBC (Origin) Resource (Target) Handle Service 5. Request URL + Handle + AA URL SHIRE 4. Username + password User Authentication User Attributes (LDAP/SQL) 9. User Attributes Attribute Authority 8. Handle returns User ID 3. Request URL + SHIRE URL WAYF Bash Street St Trinians Hogwarts LGfL Oxford 7. Request URL + Handle 10. Request URL + User Attributes 2. Request URL + SHIRE URL 6. Request URL + Handle + AA URL Resource(s) 11. User Attributes SHAR

9 Shibboleth User Authentication 1.Subsequent Request URL (Same Domain) LEA/RBC (Origin) Resource (Target) Handle Service User Authentication User Attributes (LDAP/SQL) WAYF Bash Street St Trinians Hogwarts LGfL Oxford SHIRE SHIRE has Cached Session & Handle = OK Resource(s) Attribute Authority SHAR SHAR has Cached Attributes = OK

10 Shibboleth User Authentication 1.Subsequent Request URL (Different Domain) LEA/RBC (Origin) Handle Service Resource (Target) SHIRE User Authentication User Attributes (LDAP/SQL) Handle returns User ID WAYF Bash Street St Trinians Hogwarts LGfL Oxford SHIRE has Cached Session & Handle = OK Resource(s) Attribute Authority Request New Domain Attributes Return New Domain Attributes SHAR SHAR has no Cached Attributes for the new Domain so ask AA

11 Shibboleth User Authentication LEA/RBC (Origin) Resource (Target) Handle Service SHIRE P o r t a l User Authentication User Attributes (LDAP/SQL) Resource(s) Attribute Authority SHAR

12 Shibboleth User Authentication Pros Low administrative burden Exposure of personal information under user s control Same identity for all resources User traceability Resources can be accessed from any location Cons (Possible) multi-stage authentication

13 Shibboleth Demonstration 1 7 Shibboleth Target Windows 2003 Server IIS 6.0 Browser WAYF Service Windows 2003 Server IIS 6.0 Shibboleth Origin Windows XP Pro Apache Server LDAP Directory (Active Directory) Windows 2003 Server

14 Shibboleth Demonstration Browser 1 7 Shibboleth Target Windows 2003 Server IIS 6.0 WAYF Service Shibboleth Origin Windows 2003 Server Apache Server LDAP Directory (Active Directory)

15 Shibboleth Then said they unto him, Say now Shibboleth: and he said Sibboleth: for he could not frame to pronounce it right. Then they took him, and slew him at the passages of Jordan: and there fell at that time of the Ephraimites forty and two thousand. Judges 12:6