Shibboleth

1. Shibboleth A Federated Approach to Authentication and Authorization Fed/Ed PKI Meeting June 16, 2004

2. Agenda • Shibboleth - Shibboleth Background and Status • Technical Review -- how does it work? • Shibboleth - Why? • Who is Using Shibboleth? • Federations

3. What is Shibboleth? • An initiative to develop an architecture and policyframework supporting the sharing – between domains -- of secured web resources and services • Built on a “Federated” Model • A project delivering an open source implementation of the architecture and framework • Deliverables: • Software for Identity Providers (campuses) • Software for Service Providers (vendors) • Operational Federations (scalable trust)

4. Shibboleth Goals • Use federated administration as the lever; have the enterprise broker most services (authentication, authorization, resource discovery, etc.) in inter-realm interactions • Provide security while not degrading privacy. • Attribute-based Access Control • Foster interrealm trust fabrics: federations and virtual organizations • Leverage campus expertise and build rough consensus • Influence the marketplace; develop where necessary • Support for heterogenity and open standards

5. Attribute-based Authorization • Identity-based approach • The identity of a prospective user is passed to the controlled resource and is used to determine (perhaps with requests for additional attributes about the user) whether to permit access. • This approach requires the user to trust the target to protect privacy. • Attribute-based approach • Attributes are exchanged about a prospective user until the controlled resource has sufficient information to make a decision. • Identity can be an Attribute value • This approach does not degrade privacy.

6. Stage 1 - Addressing Four Scenario’s • Member of campus community accessing licensed resource • Anonymity required • Member of a course accessing remotely controlled resource • Anonymity required • Member of a workgroup accessing controlled resources • Controlled by unique identifiers (e.g. name) • Intra-university information access • Controlled by a variety of identifiers • Taken individually, each of these situations can be solved in a variety of straightforward ways. • Taken together, they present the challenge of meeting the user's reasonable expectations for protection of their personal privacy.

7. Shibboleth Status • Software Availability • Version 1.1 available August, 2003 • Version 1.2 available June, 2004 • Version 1.3 available Fall, 2003 • Service Provider implementation - works with Apache and IIS targets • Multi-Federation support • Campus Adoption accelerating… • Growing number, variety of vendors providing support • Used by several federations today – NSDL, InQueue, • Work underway on some of the essential management tools such as attribute release managers, target resource management, etc.

8. Shibboleth Soon… • V2.0 will support SAML 2.0 specification, which incorporates much of the Liberty Alliance work • Microsoft - WS-Sec Product Mgr - “very aware of Shibboleth and that Shibboleth and what they are doing should play together just fine” • Exploring non-web use cases (eg SOAP, GRIDs, P2P, etc) • Growing development interest in several countries, providing resource manager tools, digital rights SWITCH and several more soon (JISC, Australia, etc.)

9. How Does Shibboleth Work?

10. High Level Architecture • Federations provide common Policy and Trust • Destination and origin site collaborate to provide a privacy-preserving “context” for Shibboleth users • Origin site authenticates user, asserts Attributes • Destination site requests attributes about user directly from origin site • Destination site makes an Access Control Decision • Users (and origin organizations) can control what attributes are released

11. Technical Components • Identity Provider Site – Required Enterprise Infrastructure • Authentication • Attribute Repository • Identity Provider Site – Shib Components • Handle Server • Attribute Authority • Service Provider Site - Required Enterprise Infrastructure • Web Server (Apache or IIS) • Service Provider Site – Shib Components • SHIRE • SHAR • WAYF • Resource Manager

12. Managing Authorization • Federations will NOT require members to do business with each other • Target manages Access Control Policy specifying • what attributes must be supplied • and from which origins • in order to gain access to specific resources • Rules are attribute based

13. Shibboleth -- WHY? • Higher Ed is a collaborative enterprise • Research is a collaborative enterprise • Federated Administration Simplifies Management and Use of Distributed Systems • Federated Approach Improves Security • Use of attributes allows fine-grained access control

14. Who is Using Shibboleth? • 50+ campuses currently members of InQueue • EduCause-sponsored “Shibboleth CAMP” in June • 130+ registered attendees • First day features an Install Fest…. • There is momentum…….

15. Federal E-Authentication Initiative • Pursuing a Federated Identity Architecture • Shibboleth Pilot/Interoperability testing later this summer

16. Shibboleth Outside the US • UK - JISC - recent Middleware initiative • http://www.jisc.ac.uk/c01_04.html • Supporting eight Shibboleth-related projects • One project is managing a country-wide deploy • UK- - BECTA (K12) • Has adopted Shibboleth as a countrywide standard • Switzerland • http://www.switch.ch/aai/shibboleth.html • Finland • Australia…..

17. Currently participating publishers, aggregators, technology partners • Round 1 • OCLC • JSTOR • EBSCO • Elsevier • Ex-Libris (sfx) • Round 2 (being approached now) • CSA (Cambridge Scientific Abstracts) • ISI • Ovid • Proquest • Gale Group • Lexis-Nexis

18. Other Technology Partners • LMS Systems • Blackboard • WebCT • WebAssign • Syquest/ Higher Markets • Student Charge Card vendors • Napster • EZProxy • ArtSTOR

19. Other Pilot Projects • American Association of Medical Colleges • NSDL (National Science Digital Library) • SWITCH - The Swiss National Academic Community • UK/JISC - Controlled Access to Licensed Resources • Becta (British Educational Communications and Technology Agency) • Univ Texas, Medical Center and instruction • Washington Research Library Consortium (WRLC)

20. Shib Academic SIG • Lots of interesting design issues for use of Shib, e.g • Passing attributes during deep-linked text • Handling meta-search engines • Managing persistent identifiers where needed • Dealing with proxies in a semi-Shibbed world • The issues so far have all been solvable; the challenge is in picking the right solution. • Subscribe and participate via the I2 listserv at http://www.internet2.edu/about/lists.html (sigh, soon to be Shibbed…)

21. Federations

22. What are federations? • Associations of enterprises that come together to exchange information about their users and resources in order to enable collaborations and transactions • Built on the premise of • Initially “Authenticate locally, act globally” • Now, “Enroll and authenticate and attribute locally, act federally.” • Federation provides only modest operational support and consistency in how members communicate with each other • Enterprises (and users) retain control over what attributes are released to a resource; the resources retain control (though they may delegate) over the authorization decision. • Over time, this will all change…

23. Requirements for federations • Federation operations • Federating software • Exchange assertions • Link and unlink identities • Federation data schema • Federation privacy and security requirements

24. Shibboleth-based federations • InQueue • InCommon • Club Shib • Swiss Education and Research Network (SWITCH) • National Science, etc. Digital Library (NSDL) ------------------------------------ • State networks • Medical networks • Financial aid networks • Life-long learning communities

25. InQueue • The “holding pond” • Is a persistent federation with “passing-through” membership… • Operational today. Can apply for membership via http://shibboleth.internet2.edu/ InQueue Federation guidelines • Requires eduPerson attributes • Operated by Internet2; open to almost anyone using Shibboleth in an R&E setting or not… • Fees and service profile to be established shortly: cost-recovery basis

26. InCommon basics • Carrie will describe….

27. Global Federations • Oct meeting in the Cotswalds of representatives from TEN national Federations • Identify and begin to work through policy mapping, trust mapping, usage and operational issues • Some vendors interested in attending

28. So… What is Shibboleth? • A Web Single-Signon System (SSO)? • An Access Control Mechanism for Attributes? • A Standard Interface and Vocabulary for Attributes? • A Standard for Adding Authn and Authz to Applications?

29. THE END • Acknowledgements: • Design Team: David Wasley (U of C); RL ‘Bob’ Morgan (U of Washington); Keith Hazelton (U of Wisconsin (Madison));Marlena Erdos (IBM/Tivoli); Steven Carmody (Brown); Scott Cantor (Ohio State) • Important Contributions from: Ken Klingenstein (I2); Michael Gettes (Duke), Scott Fullerton (Madison) • Coding: Derek Atkins (MIT), Parviz Dousti (CMU), Scott Cantor (OSU), Walter Hoehn (Columbia)