Shibboleth at Cardiff University

Lindsay RobertsProject Manager –

Shibboleth Implementation Phase 2

Outline

What’s the problem?What is Shibboleth?What have we done in Cardiff?Where are we now?For the future…

What's the problem?

Users accessing many different systems/resources : User problems

• Lots of usernames/passwords to remember!

Admin Problems• Account creation and administration overhead• Forgotten passwords

Security Problems • Security & Integrity compromised (e.g. “abc123”)

What is Shibboleth?

Shibboleth: Offers single sign-on access to multiple web-

based services Usernames and password at our end –

standard network username/password Based on trust (and legal documents) within

a federation

Shibboleth and FederationsFederation

... WAYF

Shibboleth-Athens

AthensResources

Shib-Athens

Federation

...WAYF

How does Shibboleth work?

WAYF

AA

User DB AA

SSO

Res

ou

rce

ACS

AR

Res

ou

rce

Man

ag

er

I don’t know who you are or where you are

from… redirecting you to the home locator

1

2

So, where are you from?

34

CFU

5

Ok, redirecting you to your organisation

6

Don’t know who you are: please login

7Credentials

9Handle

I need to know attributes... Ask AA

8Handle

Ok, I know you! Redirecting you to the resource, with a handle

Handle

Service ProviderIdentity Provider

Attributes 10

These are the attributes you’re allowed to see:

11

11

Ok, you’re allowed to see this. Here

you go!

Athens

What have we done in Cardiff?

Early adopter funded by JISCPhase 1 – completeLed to entitlements groupPhase 2 – in progress Extensive testing on resources

Still 4 resources not Shibboleth compliantIn the process of rewriting relevant

documentation

Where are we now?

Going live 1st August for: New training grade doctors 1st year undergrads, postgrads, new staff Existing users with expired passwords and

problems

For the future

Next summer Rest of Athens users in University

2008 Athens accounts turned off before we have to

pay

Conclusion

For users Shibboleth offers easier access to resources

– don’t have to remember yet another username/password

This isn’t the end Native Shibboleth…

an aside: “Shibboleth”?

old testament (judges 12:1-6). ephraimites lived to the west of river jordan invaded gilead over river, defeated retreating, way blocked by the gileadites ephraimites/gileadites had different accents pronounced the ‘sh’ sound as ‘sh’/‘si’ those crossing river asked to pronounce ‘shibboleth’

(it means an ear of corn) 42,000 who pronounced it ‘sibboleth’ were killed