Franchise access being authenticated by our Shibboleth IdP

[Keith Carr]

Hi there,

Hoping somebody can "sanity check" something I'm thinking about (or to suggest a better way of doing it if it has been done a different way)....

It has come to pass that our institution has franchised courses to another institution. We shall call this "franchise-b" for reference and ourselves "franchise_a". In this we are also running some of the back-end services for franchise_b including ldap and shibboleth IdP authentication for it's users.

The complication has come in that as the students are not "on-site" and not strictly part of our University and some resource providers are requesting different licensing. This has meant that franchise_b has chosen to pay only for some of the resources we (franchise_a) license.

Therefore I am required to devise a mechanism by which our shibboleth IdP will provide the required attributes for the user (franchise_a or
franchise_b) depending upon if we have licensed the resource for that group of users.

At the moment I am imagining using a MySQL database (called say "Franchises") to hold a list of resources and whether it is licensed for that franchise something like this:

+----------+-------------+-------------+
| resource | franchise_a | franchise_b |
+----------+-------------+-------------+
| ent_1    | TRUE        | TRUE        |
| ent_2    | TRUE        | FALSE       |
+----------+-------------+-------------+

Then I am proposing that the following could be added to our attribute-resolver.xml file:

    <resolver:AttributeDefinition id="shibbolethset"
                                  xsi:type="Simple"
                                  xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                                  sourceAttributeID="shibbolethset"
                                  dependencyOnly="true">

        <resolver:Dependency ref="myLDAP" />

        <resolver:AttributeEncoder xsi:type="SAML1String"
                                   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                   name="shibbolethset" />
        <resolver:AttributeEncoder xsi:type="SAML2String"
                                   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                   name="shibbolethset"
                                   friendlyName="shibbolethset" />
    </resolver:AttributeDefinition>


    <resolver:AttributeDefinition id="requestEnt"
                                  xsi:type="Simple"
                                  xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                                  sourceAttributeID="requestEnt"
                                  dependencyOnly="true">

        <resolver:AttributeEncoder xsi:type="SAML1String"
                                   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                   name="requestEnt" />
        <resolver:AttributeEncoder xsi:type="SAML2String"
                                   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                   name="requestEnt"
                                   friendlyName="requestEnt" />

        <Script>
        <![CDATA[
            importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
            if (requestEnt == null) {
                requestEnt = new BasicAttribute("requestEnt");
            }

            requester = requestContext.inboundMessageIssuer;
            requestEnt.getValues().add(requester);
        ]]>
        </Script>
    </resolver:AttributeDefinition>


    <resolver: AttributeDefinition xsi:type="ad:Simple"
                                   id="FRANA_GRANTED"
                                   sourceAttributeID="franchise_a">
        <resolver:AttributeEncoder xsi:type="SAML2String"
                                   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                   name="FRANA_GRANTED"
                                   friendlyName="FRANA_GRANTED" />

        <resolver:Dependency ref="AllowedFranchise" />
    </resolver:AttributeDefinition>

    <resolver: AttributeDefinition xsi:type="ad:Simple"
                                   id="FRANB_GRANTED"
                                   sourceAttributeID="franchise_b">
        <resolver:AttributeEncoder xsi:type="SAML2String"
                                   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                   name="FRANB_GRANTED"
                                   friendlyName="FRANB_GRANTED" />

        <resolver:Dependency ref="AllowedFranchise" />
    </resolver:AttributeDefinition>


    <resolver:AttributeDefinition xsi:type="Script"
                                  xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                                  id="eduPersonAffiliation">

        <resolver:Dependency ref="shibbolethset" />
        <resolver:Dependency ref="FRANA_GRANTED" />
        <resolver:Dependency ref="FRANB_GRANTED" />

        <resolver:AttributeEncoder xsi:type="SAML1String"
                                   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                   name="urn:mace:dir:attribute-def:eduPersonAffiliation" />
        <resolver:AttributeEncoder xsi:type="SAML2String"
                                   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                   name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
                                   friendlyName="eduPersonAffiliation" />

	      <Script>
        <![CDATA[
            importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
            if (eduPersonAffiliation == null) {
                eduPersonAffiliation = new BasicAttribute("eduPersonAffiliation");
            }

            if (shibbolethset.getValues().contains("Student") && FRANA_GRANTED.getValues().contains("TRUE")) {
                eduPersonAffiliation.getValues().add("student");
            } else if (shibbolethset.getValues().contains("Student") &&  FRANB_GRANTED.getValues().contains("TRUE")) {
                eduPersonAffiliation.getValues().add("student");
            }
        ]]>
        </Script>
    </resolver:AttributeDefinition>


    <resolver:DataConnector xsi:type="dc:RelationalDatabase"
                            xmlns="urn:mace:shibboleth:2.0:resolver:dc"
                            id="Franchises">

        <resolver:Dependency ref="requestEnt" />

        <ApplicationManagedConnection jdbcDriver="com.mysql.jdbc.Driver"
                                      jdbcURL="jdbc:mysql://server.ac.uk/shibdb"
                                      jdbcUserName="user"
                                      jdbcPassword="password" />

        <QueryTemplate>
          <![CDATA[
            SELECT * FROM Resources WHERE resource='$requestEnt'
          ]]>
        </QueryTemplate>
    </resolver:DataConnector>

"shibbolethset" is merely an attribute we hold in ldap to determine whether a user is a student/staff/etc

A Query would be performed on the database using a data connector for the requesting resource and values returned for all the franchises. Each
franchise "field" returned from the query would be put into an attribute (FRANA_GRANTED and FRANB_GRANTED). This would then be assessed along with the "shibbolethset" attribute to determine whether the user should be given a eduPersonAffiliation attribute value which will grant access to the resource.

Does this sound logical? Please let me know if you want any further information.

Thank you in advance for any help/suggestions you may have.

Best regards,
Keith

-- 
Keith Carr
Senior Developer
Computing Services
Information Services
St. George's, University Of London
Cranmer Terrace
London SW17 0RE

Email: kecarr at sgul.ac.uk
Fax: +44 20 8725 3583