has anyone used shibproxy?

[Scott Koranda]

> On Tue, 2011-08-09 at 11:21 -0500, Scott Koranda wrote:
> > > >Has anyone ever found a way to serve version control repositories using
> > > >shibboleth for authentication? 
> 
> > We use a simple command line script to leverage the ECP
> > functionality available from the Shib IdP and SPs. See
> > 
> > https://wiki.shibboleth.net/confluence/display/SHIB2/ECP
> 
> Hey thanks. This looks very useful. Unfortunately, I still don't
> understand all of this Shibboleth thing, so I'm trying to read my way
> out of ignorance... but perhaps you can let me know if I understand this
> correctly:
> 
> The ecp script (I assume you're using the bash script from that link,

We prefer Python and so are using a modified version of the
Python script from that link.

> I'll probably use the perl one since I'm more comfortable with perl, but
> either way) handles the process of doing the authentication, 

The Python script is an ECP client. It

- connects to the service provider (SP), in this case the
  Apache httpd serving up the Git repository, and includes
  special headers in the GET request to signal it is an ECP
  client

- receives an XML package from the SP and "massages" it

- sends the massaged XML package to the ECP endpoint for the
  IdP. That endpoint is protected and the script must know how
  to authenticate to it. In our case we protect it with
  mod_auth_kerb and use Kerberos credentials to authenticate.
  You could use other approaches. 

- receives an  XML package from the IdP and "massages" it

- compares the XML package from the IdP to that from the SP
  and checks to make sure certain conditions are met (for
  security)

- sends the massaged XML packet from the IdP to the SP

- receives the session cookie from the SP and stores it

The ECP profile is defined in detail at

http://www.oasis-open.org/committees/download.php/41209/sstc-saml-ecp-v2.0-wd02.pdf

and I highly recommend reading that document. It only takes 30
minutes.

> and the
> writes the resulting credential to a file which contains a cookie, which
> the curl libraries then put in their headers for all subsequent https
> requests (given that they know about the file, per your patch to git). 

Correct.

> 
> So to use such a thing, you first would call the ecp script to
> authenticate, creating a session (identified by the cookie), and then
> you would call git, is that correct? 
> 

Yes.

The details of the user experience will depend on the script
you use and the decision you make about the lifetime of the
SP session (as well as how the user authenticates to the ECP
endpoint at the IdP).

It is important to understand that in a federated context you
would need all of the IdPs that your users might leverage to
enable and support ECP. We have the luxury at this time of not
being federated and we know our users will hit just our IdP.
As we begin to federate we will have to negotiate with IdPs to
support ECP in user friendly ways, and then evolve our script
to interact with the IdPs appropriately.

It is my (naive?) hope that over time InCommon and similar
federations will consider ECP support a "best practice".

Scott K