Shibboleth Federated Authentication Service for Stanford, High-Level Briefing

1
Shibboleth Federated Authentication Service for
Stanford, High-Level Briefing

• Bruce Vincent,
• Strategy and Architecture
• IT Services
• February 16, 2006

2
Judges 126

• And it was so, that, when any of the fugitives of
  Ephraim said, Let me go over, the men of Gilead
  said unto him, Art thou an Ephraimite? If he
  said, Nay then said they unto him, Say now
  Shibboleth and he said Sibboleth for he could
  not frame to pronounce it right then they laid
  hold on him, and slew him at the fords of the
  Jordan. And there fell at that time of Ephraim
  forty and two thousand.

3
Internet 2 Middleware Initiative

• The Trinity of Internet Architecture
• Big Juicy Brains
• Seed Money
• The Back of a Napkin

4
What Can Shibboleth Do?

• Supports secure user access to Web-based
  resources
• Enables independent organizations to federate to
  extend the capabilities of their existing
  identity-management services
• Supports multi-organizational federations to
  enable scalable use of the technology
• Encourages attribute-based authorization

5
(cont.) What Can Shibboleth Do?

• Provides controls to protect the privacy of
  personal information
• Is standards-based and open-source
• Has entered production use and
• Is evolving to support new uses and new
  communities

6
How Does Shibboleth Work? (Stanford-centric)
Local Authentication Service
Web Server with WebAuth-like Service
1
Weblogin
4
Where Are You From?
2
Institution A Institution B Institution C
3
Content
7
How Does Shibboleth Work?
Identity Provider (IdP)
Service Provider (SP)
1
SSO
Assertion Consumer
5
Where Are You From?
2
Institution A Institution B Institution C
4
3
User AuthN
Resources
8
6
User Attributes
11
9
7
Attribute Requestor
Attribute Authority
10
8
Why Do Shibboleth?

• Enables inter-institutional collaboration
• Leverages existing infrastructure
• Self-determination of institutional identity and
  privacy
• Promotes secure web application interoperability
• Provides LDAP attributes for IIS web apps
• Because we love R.L. Bob Morgan

9
What does it take to get Shibboleth running?

• IdM and authentication infrastructure
• Web application support staff
• Basic Java knowledge
• Small production database
• Relevant institutional policies

10
Where is Stanfords Shibboleth Project?

• Built several small test federations using
  Shibboleth v1.2 and v1.3
• Running a v1.3 IdP in the InQueue Federation
• PoC eduPerson attributes expressed
• PoC implementation of user ARP leveraging
  StanfordYou visibility settings (woohoo!)
• Developing relevant institutional policies
• Doing paperwork for InCommon Federation
• On target for summer production service
• https//wayf.internet2.edu/InQueue/sample.jsp
  https//authdev.it.ohio-state.edu/twiki/bin/view/S
  hibboleth/WebHome

11
Whos Running Shibboleth?

• Case Western Reserve University
• Cornell University
• Dartmouth
• Elsevier ScienceDirect
• Georgetown University
• Houston Academy of Medicine - Texas Medical
  Center Library
• Internet2
• OCLC
• Ohio University
• OhioLink - The Ohio Library Information Network
• Penn State
• SUNY Buffalo
• The Ohio State University
• The University of Chicago
• University of California, Irvine
• University of California, Los Angeles
• University of California, Office of the President
• University of California, San Diego
• University of Rochester

• Acceleration
• AgileCO
• (The) Alfred Wegener Institute (Germany)
• Aristotle University of Thessaloniki (Greece)
• Arkansas State University
• ARTstor
• Baylor College of Medicine
• Belfast e-Science Centre (Ireland)
• Blackboard
• Brown University
• Bureau van Dijk Electronic Publishing (BvDEP)
  (Netherlands)
• California State Polytechnic University, Pomona
• California State University, Stanislaus
• California Polytechnic State University, San Luis
  Obispo
• Cardiff University (Wales)
• Canada Institute for Scientific and Technical
  Information (CISTI)
• Carnegie Mellon University
• Case Western Reserve University
• Cdigix

12
(cont.)Whos Running Shibboleth?

• Cornell University
• Dartmouth College
• De Montfort University (UK)
• Denis Diderot University (France)
• Denison University
• Duke University
• Durham University (UK)
• Eastern Michigan University
• EBSCO
• EDINA (Scotland)
• o SDSS Development Federation
• Eduserv Athens (UK)
• Elsevier
• o ScienceDirect
• Emory University
• eMeta Corporation
• Five Sticks, Inc.
• Florida State University
• FreshTracksMusic

• High Performance Computing Center Stuttgart
  (Germany)
• III (Innovative Interfaces Inc.)
• Indiana University
• Internet2
• JSTOR
• Johns Hopkins University
• Katholieke Universiteit Leuven (Belgium)
• Kent State University
• Kentucky Higher Education Assistance Authority
• Kidderminster College (UK)
• Leibniz Computing Centre (Leibniz-Rechenzentrum,
  LRZ), Germany
• LexisNexis
• London School of Economics and Political Science
• Ludwig Maximilian University of Munich (Germany)
• Macquarie University (Australia)
• Maharashtra Academy of Engineering Education
  Research (MAEER) (India)
• McGill University (Canada)
• Miami University
• Michigan State University

13
(cont.)Whos Running Shibboleth?

• MTA SZTAKI - Computer and Automation Research
  Institute of the Hungarian Academy of Sciences
  (Hungary)
• New York University
• North Dakota University System
• North Seattle Community College
• Northwestern University
• Nottingham Trent University (UK)
• OCLC (Online Computer Library Center)
• OhioLink (The Ohio Library and Information
  Network)
• (The) Ohio State University
• Ohio Supercomputer Center (OSC)
• Ohio University
• openidp.org The Open Identity Provider
• Oxford University (UK)
• Oxys (Belgium)
• Peking University (China)
• (The) Pennsylvania State University
• Pitney Bowes
• Princeton University
• ProQuest

• Stanford University
• St George's University of London (UK)
• Stockholm University
• SURFnet
• South Dakota State University
• Staffordshire University (UK)
• Telematica Instituut (Netherlands)
• Texas Medical Center
• Thomson Gale
• Tufts University
• Turnitin
• UKERNA (UK)
• UNIFACS (Brazil)
• University of Alabama at Birmingham
• University of Alaska
• University of Alaska Fairbanks
• University of Arkansas
• University of Arkansas at Little Rock
• University of Art and Design Helsinki (Finland)

14
(cont.)Whos Running Shibboleth?

• Universität Bremen (Germany)
• University of Bristol (UK)
• University of Calgary (Canada)
• University of California, Davis
• University of California, Irvine
• University of California, Los Angeles
• University of California, San Diego
• University of California Office of the President
• (The) University of Chicago
• University of Colorado - Boulder
• University of Exeter (UK)
• University of Freiburg (Germany)
• University of Glasgow (Scotland)
• University of Illinois at Urbana-Champaign
• University of Iowa
• University of Joensuu (Finland)
• (The) University of Kansas
• The University of Kent (UK)
• University of Konstanz (Germany)

• University of Mississippi
• University of Missouri-Columbia
• University of Murcia (Spain)
• University of Nebraska-Lincoln
• University of Newcastle upon Tyne (UK)
• University of North Carolina at Chapel Hill
• University of Oulu (Finland)
• University of Patras (Greece)
• (The) University of Queensland (Australia)
• University of Rochester
• (The) University of South Dakota
• University of South Florida
• University of Southern California
• University of Southampton (UK)
• (The) University of Tennessee, Knoxville
• University of Texas at Arlington
• University of Texas Health Science Center at
  Houston
• (The) University of Texas System Administration
• (The) University of Texas Southwestern Medical
  Center at Dallas

15
and from Marketing
16
What happened to the old logo?
17
Exit, Stage Left