Trials and (Minor) Tribulations

Transcription

1 Leif Johansson Trials and (Minor) Tribulations Configuring SAKAI for Shibboleth 1

2 Shibbolizing Sakai... [pffft] How hard could it be? 2

3 Shibboleth Federated identity management Cross-domain auth and authz 3

4 Shibboleth SAML 2.x & 1.x web SSO profile Used in a number of HE federations in-common (.edu) switch-aai (.ch) swamid (.se) dk-aai (.dk) haka (.fi) cru-pilot (.fr) 4

5 Why federate identity? Keep identity management where the customer relation is (eg students at university). Avoid having a separate identity for each service. Avoid identity-lifecycle support requests. 5

6 Why federate access to SAKAI? Build shared service centers for LMS. Allow external users into project sites. University systems and mergers. 6

7 Why use Shibboleth? Its the reference implementation of the SAML 2.0 web SSO profile. Clean interface between application container (aka SP) and application. Very few actual dependencies on Shibboleth itself in the finished product. 7

8 Shibbolizing Apps 101: Delegate authentication to the application container using REMOTE_USER. Use information present in the attributeassertions to create/update the applicationinternal user-model upon each login. 8

9 Shibbolizing Apps 201 Authorization (authz) based on attributeassertions. 9

10 Now then... Shibbolizing SAKAI Seriously, how hard could it be? 10

11 Take 1: Its a UserDirectoryProvider No it isn't (well sortof) Attributes are available through the HttpServletRequest. There is no way to search for federated identities! You could do it this way but it would suck. 11

12 Take 2: Its a UserDirectoryService Nope (sortof) for mostly the same reasons... 12

13 Take 3: Its a login servlet! Sure why not. and a UserDirectoryService too (read on...) 13

14 ShibContainerLogin public class ShibContainerLogin extends ContainerLogin {... private class UserInfo {... public UserInfo(HttpServletRequest req, String eid) { // attributes from req are consumed here! } protected void doget(final HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException { } } runas(adminuser,req,new Runnable() { // create a UserInfo to grab attributes from req. // Using the rights of an adminuser create/update // the user info of the user whose EID is in // getuserprincipal (REMOTE_USER) } 14

15 Note well Nothing so far depends on Shibboleth. Any SSO that uses attribute-release through the request would work. runas runas was (almost) pilfered from su-tool completely general should go in separate component 15

16 Not quite done yet... We need a UserDirectoryService anyway Those users have to be stored somewhere! DbUserService is almost ok but... DbUserService assumes a UserDirectoryProvider There is no lookup/search in a federated setting The Answer:... (drumroll) 16

17 PromiscuousDbUserService public abstract class PromiscousDbUserService extends DbUserService { } public String getuserid(string eid) throws UserNotDefinedException { // Yeah sure whatever, I got your user right here! } 17

18 FAQ So anyone can do anything in your SAKAI? No! The ShibContainerLogin.UserInfo implements scopebased usertype assignement. Users not from trusted are of type 'guest'. How can I invite users? Directly using their federated identity as the EID (eg leifj@su.se). Looks like an adress but isn't! The PromiscuousDbUserService will create fake entries on demand so you can refer to users who haven't logged in. Can I invite using ? Yes but we haven't implemented it fully yet. It would be pretty easy but would depend on the user knowing which adress their IdP sends (whch is often the case). 18

19 Current Status and Credits In production on We're happy to add your federation to the list at the top. Patches against 2.3 (2.4 soon) Most of the work done by Leif Johansson & Klas Lindfors 19

20 Next Steps Documentation Fully support invites Federated CourseManagement eg Internet2 CourseID schema 20

21 Summary Life in a federated world is different! There is no global directory of users. Usernames will contain '@'. Information about the user follows the session. Users are unknown until they login (but we can fake it). Our simple approach works well enough. Most of the limitations have workarounds. Paradigm shifts always involve pain. 21

22 Sektionen för IT och media Stockholms universitet Frescati Hagväg Stockholm Tfn: