Presentation as pdf<\/a><\/p>\nWe’ll get on to exactly what Shibboleth is later, but lets just start by saying it is a method for authentication\/authorisation.<\/p>\n
Currently the closest we have to a nationwide authentication\/authorisation system is Athens. This has been developed and recently seen Single Sign On and Devolved Authentication. Also done proof of concept on alternative ways of authentication\/authorisation – e.g. digital certificates.<\/p>\n
However, now facing new challenges. Need to look at not just institutions to publisher authentication, but also cross-institutional working, ‘virtual organisations’ with complex authorisation needs (driven by growth in e-research, GRID etc.)<\/p>\n
Also external developments – emergence of new standards e.g. SAML<\/p>\n
So – next generation AAA infrastrucutre must support scenarios such as:<\/p>\n
Internal (intra-institutional) applications
\nManagement of access to 3rd party digital library-type resources
\nInter-institutional use – e.g. shared e-learning scenarios
\nInter-institutional use – ad hoc sharing of resources<\/p>\n
We are now seeing Virtual Organisations emerging – where people distributed across the world want to work together and share resources.<\/p>\n
There is also a link-up with UKERNA location-independent networking project – authenticated guest access to a network. Being called ‘eduroam’ – implications of running a RADIUS infrastructure on participating campuses.<\/p>\n
Finally, there is work going on with Internet2 and the NMI-EDIT programme – this is run by the US National Science Foundation, and is looking at development of middleware, and is taking a joint approach with JISC with some of the work in this area.<\/p>\n
Some Principles:
\nAuthentication is the responsibility of the user’s home site
\nAuthorisation is the responsibility of the resource owner<\/p>\n
So – what is Shibboleth?
\nAn architecture developed by the Internet2 middleware community.
\nIt is NOT an authentication scheme – expects the home institution to do this
\nIt is NOT an authorisation scheme – expects this to be done by the resource owners
\nIt is an architecture, and open source implementation<\/p>\n
How does it work? Need a diagram for this, and still isn’t incredibly clear, but some key points:
\nWAYF – Where Are You From? This is a key part of the architecture – it is only by this that you can tell where they are going to authenticate (home institution).
\nARP – attribute release policy – only gives out the information needed at any point for authorisation – for example, don’t need to give out your name if all the resource needs to know that you come from a specific campus.<\/p>\n
Shibboleth is getting good international acceptance (US, Australia, Finland, Switzerland, France – and UK of course)
\nBasic software now well tested – around 30 US universities working with it seriously, plus several content vendors – Swiss national HE system deployment
\nSatisfies the main requirements ‘out of the box’ – digital library, shared e-learning and internal use scenarios – doesn’t yet do the VO stuff very well.<\/p>\n
However – still not very user friendly, lacks management tools, demanding to installa nd run, might require outsourced or packaged service for smaller institutions. Also still a relatively unsophisticated authorisation model – single attribute authority (who manage the ARP mentioned above), decision engine not very sophisticated – this is currently being addresses in JISC development projects.<\/p>\n
So – what needs to be done?
\nImplement Shibboleth on JISC services – provide critical mass of shibboleth-enabled resources
\nGain experience on campuses – in a variety of institutions
\nBuild the national components – which are relatively few
\n‘Charm offensive’ with publishers<\/p>\n
JISC is providing an ‘assisted take-up service’ – contract announcement is imminent, and expected to be available this month (March 2005). This should provide documentation, tools and support.<\/p>\n
Some projects are being funded to get institutions to trial Shibboleth on their campuses. JISC are looking for outcomes by Summer 2006 – this coincides with a break in the Eduserve\/Athens service contract.<\/p>\n
In the short-term, Athens and Shibboleth will coexist – no current plan to remove Athens. In fact Athens is being developed to work in a Shibboleth environment. A two way gateway is being developed so that Athens campuses can reach Shibboleth resources and vice versa.<\/p>\n
Campuses will need to review strategy – Shibboleth, Athens DA and EduRoam all pose similar questions. Need to have robust Identity Management solution which sits at the heart of any of these technologies.<\/p>\n
In the longer term – currently speculate that:
\nSome institutions (perhaps especially smaller ones) may want to stay with Athens. As may small publishers.
\nOR – if Shibboleth becomes pervasive, support or tailoring for particular situations may be the answer
\nJISC will need to keep national service requirements under review
\nNo question of forcing institutions to migrate on any specific timescale<\/p>\n","protected":false},"excerpt":{"rendered":"
Presented by Alan Robiette from JISC Presentation as pdf We’ll get on to exactly what Shibboleth is later, but lets just start by saying it is a method for authentication\/authorisation. Currently the closest we have to a nationwide authentication\/authorisation system is Athens. This has been developed and recently seen Single Sign On and Devolved Authentication. […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-410","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/posts\/410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/comments?post=410"}],"version-history":[{"count":0,"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/posts\/410\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/media?parent=410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/categories?post=410"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/tags?post=410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}