Overcoming Barriers to Federation and Making IdPs Easier

Transcription

1 Overcoming Barriers to Federation and Making IdPs Easier Paul Caskey, Internet2 Janemarie Duh, Lafayette College Chris Phillips, CANARIE David Walker, Internet2

2 Overview Barriers to Deploying an IdP and the InCommon Alternative IdPs Working Group IdP Installer: An Approach to Overcoming the Barriers Discussion

3 Barriers to Deploying Shibboleth Enterprise IT environment Lack of a Java platform Expertise not available Java and Linux Discomfort editing xml files directly Keystores Lack of staff resources Strategy for insourcing vs. outsourcing May affect flexibility and resource availability

4 Barriers to Deploying Shibboleth Other barriers, real and perceived Lack of business case/value statement Lack of resources (e.g., other higher priorities) Existing IAM infrastructure (technical and policy) not suitable Shibboleth and federation are hard

5 The Alternative IdPs Working Group Identity Provider Strategies for Common Campus Environments Final report examines alternative IdP strategies to running Shibboleth in-house While a locally- operated Shibboleth Identity Provider (IdP) continues to provide the greatest capability and flexibility for an institution s current and future federation needs, there are alternatives that may be better suited to a specific institution s: computing environment (e.g., Java, LAMP, Active Directory) available resources and expertise, and strategy with respect to insourcing or outsourcing of IT infrastructure.

6 Alternatives Assessed In-house Shibboleth SimpleSAMLphp ADFS Outsourced Shibboleth Vendor proprietary CAS with outsourced IdP Google Apps gateway Vendor supported on insourced infrastructure Hub and spoke

7 Assessment Criteria Technical InCommon s recommended technical basics Attribute release Entity categories AuthN contexts (MFA and assurance) ECP User consent Operational Expertise required Resources required Care and feeding required Applicable environments Pros Cons

8 Selecting a Strategy Choice of IdP software depends largely on your supported IT environment Java: Shibboleth LAMP: SimpleSAMLphp Active Directory: ADFS Carefully consider current and future needs Institutional preference for in-house or outsourced solutions

9 Selecting a Strategy However Shibboleth tends to be the most capable ADFS, particularly, is missing functionality for higher education Its focus is bilateral federation, as opposed to multilateral, so federation partners tend to require individual configuration crafting May want to consider outsourced support for AD environments

10 Prerequisites for Any Strategy Managing the service and/or vendor Operating an IAMS Developing and maintaining IdM policy IdM governance and alignment with institutional goals

11 Recommendations to Facilitate Deployment of IdPs in Higher Ed In the report are a number of recommendations for InCommon, TIER, and the community Create appliances for insourced operation including CANARIE/SWAMID IdP Installer tool with configurations pre-built for InCommon Conduct outreach to those institutions that are not engaged in federation and would not know that alternatives for an IdP exist

12 Recommendations to Facilitate Deployment of IdPs in Higher Ed Develop criteria for assessing service vendors and identify then assess them Author a cookbook, in collaboration with other federations, on deploying IdP strategies Develop a mentor program Identify and facilitate ways for members to get consultant help without administrative overhead

13 Easier Federated Identity: the CANARIE Perspective Chris Phillips Internet2 Technology Exchange October 6, 2015

14 What federated identity problems are we targeting? > Barriers to adoption > Operation complexity 14

15 The Approach > Enable sites to install a reference IdP implementation Quickly Low ongoing effort > Features: A tested set of software components The right aggregates for trust in the federation Support for multiple back-end authentication methods Appropriate base set of attribute mappings Base attribute release policies 15

16 IdP Installer > What does it do? Software that auto-installs and configures IdP server components Easier connection to identity servers Supports eduroam and Shibboleth > Benefits Shibboleth Identity Provider Software Servlet Container JDK eduroam FreeRADIUS software Operating System Fewer steps Hides technical complexity from operator IdP Installer 16

17 IdP Installer: Why this blend of tools? > Latest reference components > Simplifies everything: documentation, configuration, diagnosis, support IdP Installer V AuthN: LDAP, AD, CAS Client eduroam V V V. 1.8 V. 7 V LTS 17

18 Usual Deployment Profile > CANARIE recommends 2 servers: Test/pre-production Production > Sites usually deploy one service per server (eduroam, Shibboleth) Test/pre-production, then use this to go live Create test server and operate as needed > Installer also supports the Federation Operator Easier to ensure success for community - fewer install errors Fewer support calls One smarter tool supporting our services rather than multiple tools 18

19 IdP Server Update Options Are you running an up-to-date OS? Yes Upgrade. > Use Shibboleth tools No Clean Install. > Use CANARIE tools > Fastest method 19

20 Installation Process 1. Download installer 2. Plan & prepare installation 4. Postinstallation tailoring 3. Install 5. Local acceptance testing 6. Contact CANARIE to complete registration > Benefits: Fewer Steps Federation Preconfigured Rapidly Deployed Proven Interop Hides Complexity 20

21 Automation makes things faster. Baseline 2. Plan & prepare installation 1. Download installer 4. Postinstallation tailoring 3. Install 5. Local acceptance testing 6. Contact CANARIE to complete registration Planning ~ ½ to 1 person day effort Post installation: ~ ¼ to 2 person effort 1st time through installation (testing) Testing: ~ ½ to 2 person day effort Influencing factors: Complexity of customizations (i.e.more than a logo?) Readiness of resources (e.g. vm, firewall settings) Full time and attention or not nd 2 & subsequent times through installation (production) Produces portable configuration file Time reduction re-uses portable configuration Can run headless for automated install 21

22 Interview Style Configuration Builder Pick and choose components Branded interface Imports previous settings 1-click headless install Embedded context help Color cues for required fields 22

23 IdP Installer Uptake > 10+ production sites in first 90 days of availability > Helped key collaboration project bootstrap 4 sites in a few weeks > To be integral part of Shib v3 migration tools 23

24 Opportunities for Collaboration > Help enhance current iteration for Shibboleth v3.x > Help implement the incommon build 24

25

26 Detailed Software Matrix (Reference) Orange indicates change from previous Offers reference component combination Evolves as community evolves 26

27 In Closing... Everything s going to be wonderful. Image source: 27