1 / 17

Implementing FAM

Implementing FAM. Coulsdon College. The Background. Very Small Further Education College 1300 Students Accessing 8ish online resources. Why Federated Access Management ?. “An opportunity to bring Athens authentication under the curriculum IT” COST Hardware: minimal - a virtual server

maxime
Download Presentation

Implementing FAM

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Implementing FAM Coulsdon College

  2. The Background Very Small Further Education College 1300 Students Accessing 8ish online resources

  3. Why Federated Access Management ? “An opportunity to bring Athens authentication under the curriculum IT” COST Hardware: minimal - a virtual server Time: but we were going to have to do something radical anyway! Expertise:We had it! and a netskills course Black box in the corner Amount of support and documentation available – at least on linux. https://spaces.internet2.edu/display/SHIB/WebHome

  4. The Setup Suse Linux Enterprise Server 10.1 Tomcat 5.0 Apache 2.2.3 (including mod_proxy_ajp)‏ Shibboleth (1.3.3)‏

  5. Next Steps .. Join UK Federation Setup SSL virtual host with standard self generated certificates [or skip a stage and use the testshib certificates] Setup LDAP authentication in apache Proxy Pass in apache config ProxyPass /shibboleth-idp/ ajp://localhost:8009/shibboleth-idp/ Open ports 443 and 8443 in the firewall.

  6. Shibboleth Download Shibboleth Copy the endorsed directory to tomcats endorsed directory Run ant from the install directory and fill in the paths Restart Tomcat

  7. IDP Configuration 3 files: • Idp.xml – describes your idp • Resolver.xml – generates attributes • Arp.site.xml – Attribute Resolver Policy –decides which to release.

  8. IDP.XML <IdPConfig xmlns="urn:mace:shibboleth:idp:config:1.0" xmlns:cred="urn:mace:shibboleth:credentials:1.0" xmlns:name="urn:mace:shibboleth:namemapper:1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:mace:shibboleth:idp:config:1.0 ../schemas/shibboleth-idpconfig-1.0.xsd" AAUrl="https://idp.coulsdon.ac.uk/shibboleth-idp/testshib/AA" resolverConfig="file:/opt/shibboleth-idp/etc/resolver.ldap.xml" defaultRelyingParty="urn:mace:shibboleth:testshib" providerId="https://idp.coulsdon.ac.uk/shibboleth/testshib/idp"

  9. UK Federation Core Attributes Attributes are required by SPs for Authorisation decisions To facilitate interaction between IdPs and SPs, UK Federation has defined set of 4 Core Attributes (from eduPerson Schema): eduPersonScopedAffiliation [student@coulsdon.ac.uk] The user’s relationship with the organisation eduPersonTargetedID [Pseudonym for personalisation] Persistent user pseudonym, distinct for each Service Provider eduPersonPrincipalName [username@coulsdon.ac.uk] Persistent user identifier, consistent across different Service Providers. Not generally released. eduPersonEntitlement For asserting additional specific conditions that apply to a particular resource eg medical students

  10. Resolver.xml <AttributeResolver xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="urn:mace:shibboleth:resolver:1.0" xsi:schemaLocation="urn:mace:shibboleth:resolver:1.0 shibboleth-resolver-1.0.xsd"> <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:employeeType"> <DataConnectorDependency requires="directory" /> </SimpleAttributeDefinition>

  11. eduPersonPrincipalName <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonPrincipalName" sourceName="cn" smartScope="coulsdon.ac.uk"> <DataConnectorDependency requires="directory"/> </SimpleAttributeDefinition>

  12. eduPersonTargetID <PersistentIDAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonTargetedID" scope="coulsdon.ac.uk" sourceName="eduPersonPrincipalName"> <DataConnectorDependency requires="echo"/> <Salt>XXXXXXXXXXXXXXXXXXXXXXX</Salt> </PersistentIDAttributeDefinition>

  13. eduPersonScopedAffiliation First :eduPersonAffiliation <ScriptletAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonAffiliation"> <DataConnectorDependency requires="directory"/> <Scriptlet><![CDATA[ Attributes attributes = dependencies.getConnectorResolution("directory"); Attribute memberOf = attributes.get("groupmembership"); // add values from directory String value = "none"; boolean student = false; boolean staff = false; boolean member = false; for (int i = 0; memberOf != null && i < memberOf.size(); i++)‏ { value = memberOf.get(i); if (value.indexOf("FAM_STUD") > 0){ student = true;} if (value.indexOf("FAM_STAFF") > 0){staff = true; } }

  14. eduPersonScopedAffiliation First :eduPersonAffiliation -continued if (student){ resolverAttribute.addValue("student"); } if (staff){ resolverAttribute.addValue("staff"); } if (student || staff){ resolverAttribute.addValue("affiliate"); } ]]> </Scriptlet> </ScriptletAttributeDefinition> Then :eduPersonScopedAffiliation <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" smartScope="coulsdon.ac.uk"> <AttributeDependency requires="urn:mace:dir:attribute-def:eduPersonAffiliation"/> </SimpleAttributeDefinition>

  15. Attribute Release Policy <Attribute name="urn:mace:dir:attribute-def:eduPersonAffiliation"> <AnyValue release="permit" /> </Attribute> - <Attribute name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"> <AnyValue release="permit" /> </Attribute>

  16. Testshib To test the initial implementation http://testshib.org/

  17. Things I wish I'd known Time Log files Directory listing Resolvertest $ export IDP_HOME=/usr/local/shibboleth-idp $IDP_HOME/bin/resolvertest --user=gridshib \ --responder=https://idp.example.org/shibboleth \ --resolverxml=file:///user/local/shibboleth-idp/etc/resolver.xml

More Related