External Authentication with WebCT. What We ll Discuss

Transcription

1 External Authentication with WebCT WebCT, Inc What We ll Discuss Introductions Terminology Authentication in WebCT External Authentication Custom Authentication Authorization in WebCT Questions 1

2 Introductions Audience demographics General comments How many are using 3.5 Campus Edition How many are contemplating 3.5 Campus Edition How many are continuing to use Standard Edition or older versions Authentication Associate a network connection with a known entity Entity could be: user application or system SSL 2

3 Why Do We Authenticate? To identify a user Authorization Process to determine if the known entity has access to perform a specific function The role entity plays 3

4 Why Do We Authorize? To assign appropriate user access WebCT and Authorization Admin Admin interface only Designer Shared Designer Student Helpdesk mywebct 4

5 Types of Authentication Password Digital Certificate Biometrics WWW Authentication HTTP Basic The only standard for all browsers Password is always transferred across network No logout or timeout Ticket -based Use cookies to store ticket Timeout Logout 5

6 HTTP Basic Pros Standard Con Always passes password No timeout/logout No support for automatic signon Ticket Authentication Pros Easier to configure More secure Timeout/Logout possible Cons Requires cookies Non-standardized 6

7 WebCT and Authentication Associate a browser/client connection to a specific user in the WebCT database History of WebCT Authentication 1.0 HTTP Basic, per course 2.0 HTTP Basic, global HTTP Basic, global CE HTTP Basic, Ticket, Portal integration Vista (Cobalt) HTTP Basic, Ticket, Portal, network learning 7

8 WebCT Authentication Flavors Basic vs. Ticket Standard Kerberos LDAP Automatic signon WebCT Open Authentication Kit (WOAK) HTTP Basic and WebCT User Username:password WebCT Content WebCT Web Service Authenticated Username:password Internal User Database 8

9 CE Ticket Authentication User 1 4 username:password WebCT Content + Cookie WebCT Web Service 2 3 Authenticated user Username:password Internal User Database External Authentication User 1 username:password 6 WebCT Content + Cookie WebCT Web Service 4 username:password 5 Authenticated External User Database 2 user exists 3 username Internal User Database 9

10 WebCT Standard Authentication Password stored in WebCT Global database Berkeley DBM flavor for database NDBM GDBM Sleepycat BDM Password stored in DES Crypt External Authentication External authentication out of the box Kerberos v 5 LDAP Windows 2000 Domain Controllers Customized Authentication Automatic signon WOAK 10

11 External Authentication with WebCT WebCT defers to external system for authentication Authorization is handled by WebCT Authentication system and WebCT must be synchronized at username level Reasons for Using External Authentication Standardize Improve usability Reduce management costs Implement a single signon policy Implement an auto signon system Integrate a portal 11

12 Kerberos Standard Network Authentication Protocol RFC Developed at MIT Used in Windows 2000 Domain Controllers Most secure authentication protocol Should use SSL with WebCT LDAP Lightweight Directory Access Protocol What a directory is and why LDAP is used RFC 2251 ( ) How LDAP authentication works Windows 2000 and Active Directory 12

13 Single Signon Policy that defines which systems should have shared authentication Automatic Signon Originally intended for portal integration Only used with ticket authentication Can be written in any programming language Requires WebCT Standard and auto signon API Application bugs don t bother WebCT 13

14 Automatic Signon One system accepts the authentication of another Kerberos Portals Internet 2 Shibboleth Automatic Signon Process 1. Application authenticates user 2. User chooses to enter WebCT Course, MyWebCT or Tool 3. Application finds IMS ID (WUUI in 3.5) 4. Application generates timestamp and MD5 MAC 5. Call auto signon URL with required data 14

15 WebCT Open Authentication Kit (WOAK) Rewrites the authentication libraries in WebCT Only written in C Ticket or Basic Application bugs can cripple WebCT Requires consulting services Synchronization Authentication is relatively simple Authorization must be managed by WebCT Authentication and WebCT database must be synchronized How Master Everyone must be in both systems 15

16 WebCT Professional Services Experts with in depth knowledge of WebCT Assistance with implementation, scalability and installation Example code Java, Perl or WOAK Testing parameters to facilitate support calls Questions? 16