<p>Another point of help might be to approach your local IT department at coventry university. They use <a href="http://shibboleth.to">shibboleth.to</a> authenticate to resources via the UK federation so may have local in house expertise.</p>
<div class="gmail_quote">On Mar 7, 2013 5:15 PM, "Gilles Badouet" <<a href="mailto:badouetg@uni.coventry.ac.uk">badouetg@uni.coventry.ac.uk</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi all,<br>
<br>
Thanks for your assistance.<br>
<br>
Peter, your recent description is really helpful, I am getting used to the whole concept quicker by reading you wordings and hope 5 months will be sufficiant to complete that project. It looks like I will have a lot of things to do. However, I think I could with your help and the help of all the forum because I am really committed to that project.<br>
<br>
Obviously I am not goinna modify Shibboleth code as I am far to be a professional programmer.<br>
<br>
<br>
1- Do you think the final title of the project as I modified is suitable regarding the deliverables and objectives? If not please I would like your suggestions. I am asking because I must submit to my University the project brief report with the right title and the project details.<br>
<br>
2-Once all will be clear in my head, I will further learning about SAML,/XML, stressing on the SSO mechanism.<br>
I will then look in depth at Shibboleth SP, IdP.<br>
<br>
3- Accroding to what you said, I wont need to install other Shibboleth products ( Embedded& centralised Discovery servicice, meta data aggregator...). I should most stress on SP and IdP, am I right?<br>
<br>
4- Please what webserver (Apache or Microsoft IIS Server...) will you advice me for more compatibility and what version ?<br>
<br>
<br>
Kind regards<br>
<br>
<br>
<br>
Gilles Rubens Badouet<br>
Student ID: 3940347<br>
Faculty of Engineering and Computng<br>
MSc Network Computing Course<br>
Mobile: 07424486426<br>
<br>
________________________________________<br>
From: Peter Schober [<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>]<br>
Sent: 07 March 2013 09:07<br>
To: Gilles Badouet<br>
Subject: Re: Shibboleth<br>
<br>
Please keep replies to the list.<br>
I'll Cc: any further replies there myself.<br>
<br>
* Gilles Badouet <<a href="mailto:badouetg@uni.coventry.ac.uk">badouetg@uni.coventry.ac.uk</a>> [2013-03-06 23:48]:<br>
> I would highly like you to have a look on that deliverables and help<br>
> me to set a final suitable title for the project if you dont<br>
> mind.<br>
<br>
The title is mostly irrelevant, I suppose.<br>
<br>
> The company has applications which need to authenticate against Shibboleth when someone logs in.<br>
> Objectives:<br>
><br>
> 1. Review Shibboleth as a single sign-on mechanism<br>
> 2. Download Shibboleth and document its architecture<br>
> 3. Produce small application to test out single sign-on in java.<br>
> 4. Produce small application to test out single sign-on in C#.Net.<br>
> 5. Install our library solution which is an ASP.Net solution and implement Shibboleth single sign-on if you have time.<br>
> 6. Review alternative technologies and ways to extend this for the future<br>
<br>
That suffers from a slight confusion as "Shibboleth" is not one<br>
thing. It's a project that produces several software components which<br>
support several protocols. Guessing the intention, it's probably safe<br>
to replace "Shibboleth" with "SAML 2.0 WebSSO Profile" in all uses,<br>
except where software installation and configuration is concerned.<br>
<br>
Think about this like the web: We have standard protocols (HTTP),<br>
software implementations (e.g. Apache httpd web server, Mozilla<br>
Firefox web browser, etc.), consortia (the Apache Foundation), etc.<br>
<br>
Shibboleth is a Consortium <a href="http://shibboleth.net/" target="_blank">http://shibboleth.net/</a> a bit like the<br>
Apache Foundation and produces software that implements (among other<br>
things) much of the available SAML specs (or Profiles).<br>
(You should read up on the SAML spec ad what it is you implement.)<br>
<br>
So 1. means reading up on SAML (the spec has technical and nontechical<br>
introduction documents) and probably all of<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/UnderstandingShibboleth" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/UnderstandingShibboleth</a><br>
(several times, as it will take some time to grasp the more advanced<br>
topics). The Shib wiki has lots of conceptual material, use it.<br>
<br>
2. would probably mean to install a Shib SP (the thing that protects<br>
resources on a webserver) and the Shib IDP (the thing that handles<br>
authentication and provides Web Single Sign-On to all SPs its<br>
connected to). Both parts can take a long time to wrap your head<br>
around, so for the sake of limiting the scope of your work I'd say<br>
stick to the SP and use an already existing IDP (e.g. testshib or from<br>
your own University). Going into the details of an IdP create no value<br>
for the client as they're all about their resources (so SP usage).<br>
<br>
3. and 4. are then reduced to a properly configured webserver<br>
(probably MS-IIS, if you have to support C# ?) configured with the<br>
Shibboleth SP. The application code can be trivial and examples are in<br>
the Shib wiki:<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeAccess#NativeSPAttributeAccess-Tool-SpecificExamples" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeAccess#NativeSPAttributeAccess-Tool-SpecificExamples</a><br>
Shibboleth has *no* API for programming languages, it runs in the<br>
webserver and so is tools-agnostic. From your program to interface to<br>
"it" by reading HTTP request headers or environment variables.<br>
<br>
Which is why I said there is nothing to programm for Shibboleth<br>
(unless you wanted to change the software itself, which is written in<br>
object oriented C++). So the task may sound like it's about<br>
programming, but to do what they ask for it's all about the details of<br>
configuring the Shibboleth SP software. It can do all you need (and<br>
much more) but that makes it rather complicated as a whole.<br>
<br>
How to do 5. is described in the wiki:<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPEnableApplication" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPEnableApplication</a><br>
so that's a classical case of trying to make an application available<br>
via SAML2 WebSSO. Whether that's possible at all or how difficult or<br>
easy this is depends completely on the application (the "library<br>
solution"). It the "solution" allows for externalizing some of its<br>
authentication and authorization stuf, it will be easy. Most insist on<br>
doing everything themselfs (hard-coded) and it will be impossibke<br>
without code changes to the applicatoon software itself.<br>
So that may very well be too hard and too much work.<br>
(Also doing such an integration *properly*, without introducing too<br>
many security holes, and allowing for easy logout later on,<br>
etc. requires quite a bit of understanding of the whole Shibboleth<br>
thing.)<br>
<br>
6. would probably mean to look at other protocols than SAML2 (the<br>
obvious upcoming contender is "OpenID COnnect") and/or other<br>
SAML2-implementations, as are available from commercial vendors -- and<br>
most of them are crap compared to Shibboleth -- or available<br>
open-source, like SimpleSAMLphp, which by itself can only be used for<br>
PHP-applications, so won't help with Java or C#. For those two cases<br>
there are OIOSAML.Java and <a href="http://OIOSAML.NET" target="_blank">OIOSAML.NET</a>, which are SAML-implementations<br>
based on APIs and tooltkits. I.e., not the Shibboleth way of<br>
integrating with the webserver (once) and use all languages and APIs,<br>
but code your application to the API of the OIOSAML toolkit. That<br>
impies you can write or change the application code yourself (which<br>
often is neither possible nor desireable) and that you will have to<br>
maintain that code over the life of the application (with updates, API<br>
changes, etc.). Also none of those toolkits offer the rich<br>
functionality of the Shibboleth SP, so there are many reasons not to<br>
use such a thing in production.<br>
Also, using an OIOSAML (or other, like Spring Security SAML extension)<br>
tookit is not "implementing Shibboleth", it's replacing the Shibboleth<br>
implementation with a different implementation. But if you'd rather<br>
learn one of those APIs and try to actually implement your own SAML SP<br>
based on that (which will be problematic throw-away code and no use to<br>
anyone, except as a lerning experience for you) you could interpret<br>
the requirement that way and use OIOSAML instead of Shibboleth.<br>
(That is, of you'd rather program than configure preexisting software.)<br>
<br>
> Major deliverables:<br>
><br>
> 1. Reviews of existing approaches and alternative approaches<br>
<br>
Could mean Intra- vs. Inter-Institutional SSO systems (e.g. Kerberos<br>
is intra-institutional and also for non-web stuff; SAML2 is<br>
inter-institutional but with current profiles mostly for web).<br>
Could also mean what I wrote above about SAML implementations based on<br>
integration via APIs (SimpleSAMLphp, OIOSAML, etc.) or based on the<br>
avoidance of APIs for integration (Shibboleth).<br>
<br>
> 2. Review of deployment strategy<br>
<br>
Seems to tie in to many things I've already said. E.g. with API-level<br>
integration there's a high cost involved in the long run (to maintain<br>
the code). HTTP request headers on the other hand don't change when<br>
any software component changes.<br>
<br>
> 3. System Design Specification<br>
<br>
No idea. I'm not an Engineering Student ;)<br>
But there's probably material available in the wiki, or you can always<br>
ask on the user or developer mailing list.<br>
<br>
> 4. Deployment in a working prototype<br>
<br>
Just the SP, as I suggested above.<br>
<br>
> 5. Entity relationship model and SQL script for demonstration if required<br>
<br>
ER is a bit antiquated, I think, since we have the relational model.<br>
(Any entity can also be modelled as a relation between other things, so<br>
what's the difference between entities and relations? But I am not a<br>
Computer Science student either :)<br>
<br>
You've read your Codd, right?<br>
<br>
> 6. Test data and test schedule<br>
<br>
Hm. What to test? Your trivial code showing that someone is<br>
succesfully logged in to a Shibboleth protected webserver?<br>
<br>
> 7. Short ‘Getting Started’ Guide<br>
<br>
That (short!) sounds like fun :)<br>
I've written a deployment guide for a Shib-integrated service we<br>
shipped as a VMware image to the customer. But it's in German.<br>
<br>
> 8. Suggestions as to where to go from here<br>
<br>
Could mean anything. Adding more features to the integration, adding<br>
other protocols, moving it into a cloud-based data center, adding<br>
high-availability, etc.<br>
<br>
All the best,<br>
-peter<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>