Shibboleth (Internet2)

From Wikipedia, the free encyclopedia

Please help improve this article or section by expanding it.
Further information might be found on the talk page or at requests for expansion. (April 2007)

For other uses, see Shibboleth (disambiguation).

Shibboleth is an Internet2 Middleware Initiative project that has created an architecture and open-source implementation for federated identity-based authentication and authorization infrastructure based on SAML. Federated identity allows for information about users in one security domain to be provided to other organizations in a federation. This allows for cross-domain single sign-on and removes the need for content providers to maintain user names and passwords. Identity providers (IdPs) supply user information, while service providers (SPs) consume this information and gate access to secure content.

JISC has developed a video introduction to federated identity that references Shibboleth and covers many concepts central to its understanding.

1 History
2 Shibboleth 1.3 Architecture
3 Attributes
4 Trust
5 Development
6 Adoption
7 References
8 External links
- 8.1 Federations
- 8.2 Content Providers

[edit] History

The Shibboleth project was started in 2000 under the MACE working group to address problems in sharing resources between organizations with often wildly different authentication and authorization infrastructures. Architectural work was performed for over a year prior to any development. After an alpha, two betas, and two point releases were distributed to testing communities, Shibboleth 1.0 was released on July 1, 2003^[1]. Shibboleth 1.3 was released on August 26, 2005, with several point releases since then. Shibboleth 2.0 was released on March 19, 2008^[2].

[edit] Shibboleth 1.3 Architecture

Shibboleth is a web-based technology that implements the HTTP/POST, artifact, and attribute push profiles of SAML, including both Identity Provider (IdP) and Service Provider (SP) components. Shibboleth 1.3 has its own technical overview^[3], architectural document^[4], and conformance document^[5] that build on top of the SAML 1.1 specifications.

In the canonical use case:

A user first accesses a resource hosted by a web server that has Shibboleth content protection enabled.
The SP crafts a proprietary authentication request that is passed through the browser using URL query parameters to supply the requester's SAML entityID, the assertion consumption location, and optionally the end page to return the user to.
The user is redirected to either their home IdP or a WAYF service, where they select their home IdP for further redirection.
The user authenticates to an access control mechanism external to Shibboleth.
Shibboleth generates a SAML 1.1 authentication assertion with a temporary "handle" contained within it. This handle allows the IdP to recognize a request about a particular browser user as corresponding to the principal that authenticated earlier.
The user is POST'ed to the assertion consumer service of the SP. The SP consumes the assertion and issues an AttributeQuery to the IdP's attribute service for attributes about that user, which may or may not include the user's identity.
The IdP sends an attribute assertion containing trusted information about the user to the SP.
The SP either makes an access control decision based on the attributes or supplies information to applications to make decisions themselves.

Shibboleth supports a number of variations on this base case, including portal-style flows whereby the IdP mints an unsolicited assertion to be delivered in the initial access to the SP, and lazy session initiation, which allows an application to trigger content protection through a method of its choice as required.

Shibboleth 1.3 and earlier do not provide a built-in authentication mechanism, but any web-based authentication mechanism can be used to supply user data for Shibboleth to use. Common systems for this purpose include CAS or Pubcookie. The authentication/SSO features of the Java container in which the IdP runs (Tomcat, for example), can also be used.

[edit] Attributes

Shibboleth's access control is performed by matching attributes supplied by IdPs against rules defined by SPs. An attribute is any atom of information about a user, such as "member of this community", "Alice Smith", or "licensed under contract A". User identity is considered an attribute, and is only passed when explicitly required, which preserves user privacy. Attributes can be written in Java or pulled from directories and databases. Standard X.520 attributes are most commonly used, but new attributes can be arbitrarily defined as long as they are understood and interpreted similarly by the IdP and SP in a transaction.

[edit] Trust

Trust between domains is implemented using public key cryptography (often simply SSL server certificates) and metadata that describes providers. The use of information passed is controlled through agreements. Federations are often used to simplify these relationships by aggregating large numbers of providers that agree to use common rules and contracts.

[edit] Development

Shibboleth is open-source and provided under the Apache 2 license. Many extensions such as SHARPE and GridShib have been contributed by other groups.

[edit] Adoption

Federations have been formed in many countries around the world to build trust structures for the exchange of information using SAML and Shibboleth software. Many major content providers support Shibboleth-based access. Together, it is estimated that there are over 4 million students, staff, and faculty in the federations.

In February 2006 the Joint Information Systems Committee (JISC) of the Higher Education Funding Council for England announced that they will be moving from the Athens authentication system to an access-management system based on Shibboleth technology.^[6] Since then they have updated their position and are endorsing a federated access management solution rather than Shibboleth itself.