OpenAthens LA 2.0 – Connecting to the UK Federation Richard Annett – May 2009

UK Federation Join The Federation Registering the Identity Provider Single Sign Service endpoints X.509 Certificate Scope

Join The Federation

Registering the Identity Provider

Single Sign Service endpoints

X.509 Certificate

Scope

Core Attributes EduPerson TargetedID Opaque user id. EduPerson Scoped affiliation Member Staff Student ... EduPerson Entitlement When nothing else will do! EduPerson Principal Name Unique ID. E.g first.last@example.com

EduPerson TargetedID

Opaque user id.

EduPerson Scoped affiliation

Member

Staff

Student

...

EduPerson Entitlement

When nothing else will do!

EduPerson Principal Name

Unique ID. E.g first.last@example.com

Service Provider Specific Attribute requirements http:// www.ukfederation.org.uk/content/Documents/AttributeUsage Registering Being a federation member is not enough. You must have an agreement with the resource provider

Specific Attribute requirements

http:// www.ukfederation.org.uk/content/Documents/AttributeUsage

Registering

Being a federation member is not enough. You must have an agreement with the resource provider

Configuring the Runtime Tell the run time where to find the configuration http://example.com/OalaAdmin/Publish/ukfederation/0/Apache Enable the templates Protect the Login Location

Tell the run time where to find the configuration

http://example.com/OalaAdmin/Publish/ukfederation/0/Apache

Enable the templates

Protect the Login Location

Architecture Run time Admin Server Service Provider End User LDAP Database Data Stores

Configuration Admin Console Authentication LDAP Data stores LDAP Relational Database User categories Attributes Federation

Admin Console

Authentication

LDAP

Data stores

LDAP

Relational Database

User categories

Attributes

Federation

Lets do it! Service Providers (I can use!) JiscMail eduPersonTargetedID Internet2 Wiki eduPersonPrincipalName UK Federation Test SP 1 None . But lets assume the following eduPersonScopedAffiliation eduPersonEntitlement UK Federation Test SP 2

Service Providers (I can use!)

JiscMail

eduPersonTargetedID

Internet2 Wiki

eduPersonPrincipalName

UK Federation Test SP 1

None . But lets assume the following

eduPersonScopedAffiliation

eduPersonEntitlement

UK Federation Test SP 2

The visiting Lecturer You don’t want them in your directory But they require access to your online resources.

You don’t want them in your directory

But they require access to your online resources.