Your SlideShare is downloading. ×
0
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
CANARIE Eduroam and Shibboleth Lessons & Areas of interest
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

CANARIE Eduroam and Shibboleth Lessons & Areas of interest

1,070

Published on

Shibboleth Eduroam and some of the key discussion points as it rolls out in Canada

Shibboleth Eduroam and some of the key discussion points as it rolls out in Canada

Published in: Education, Technology, Business
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
1,070
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
0
Comments
0
Likes
0
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide
  • Current as of May 2011
  • Key to our success- developing a streamlined, standardized approach for connecting schools. Additional ongoing support from participating institutions as part of Community of Practice.
  • Conscription of users
  • Conscription of users
  • Transcript

    • 1. Canadian Access Federation<br />Federated Application Building <br />&<br />eduroamlessons learned<br />May 2011<br />Chris Phillips –chris.phillips@canarie.ca<br />
    • 2. Agenda<br />Eduroam<br />Less content than Shib (less complexity)<br />Shibboleth<br />See my previous presentation!<br />http://bit.ly/fedapps(link to prezi)<br />There will be a test at the end….really!<br />2<br />
    • 3. Canadian eduRoam Participants<br />3<br />
    • 4. How does eduroam work?<br />802.1X - to authenticate clients before allowing access to the network<br />EAP framework – with secure EAP methods to protect user credentials<br />RADIUS - authentication server infrastructure<br />RADIUS proxying – to route authentication requests to a users home institution<br />Separate IP address space – treated as external to institution (compliance with service agreements, etc)<br />End Users have standard internet access with as few filters as possible (if any at all).<br />
    • 5. Sample Deployment: Queen’s<br />5<br />
    • 6. Cisco ACS Config<br />6<br />
    • 7. What NOT to do…<br />Invisibly allow your users to drop the scope of the sign in<br />Punishes everyone. The mobile user can’t login. Support is called and invoked. Mitigation: use <netid>@homeinst.ca<br />Filter connections<br />Reciprocity is a great thing. Treat eduroam mobile users on your infrastructure as you would want to be treated at their institution<br />Constrain/shape bandwidth<br />Again, the reciprocity principal holds here. If abuse is ocuring your netflow info should reveal or trigger alarms<br />7<br />
    • 8. Known Concerns<br />NAT <br />NATing is frowned upon centrally but is known to be a tenuous position given ipv4 conditions and wireless<br />Recommendations<br />Continue to treat users how you would like to be treated.<br />8<br />
    • 9. Stats & Some Thoughts<br />Day 1 eduRoam Stats first 6hrs for CANHEIT<br /># authN Domain <br />       1 mcgill.ca<br />       1 polymtl.ca<br />       1 ryerson.ca<br />       2 mtroyal.ca<br />       2 ucalgary.ca<br />       2 unb.ca<br />       3 bcnet.ca<br />       3 cunet.carleton.ca<br />       3 dal.ca<br />       4 sfu.ca<br />       4 ubc.ca<br />       4 uvic.ca<br />       6 brocku.ca<br />       6 canarie.ca<br />       6 mun.ca<br />       6 queensu.ca<br />       6 ualberta.ca<br />       6 uottawa.ca<br />       6 utoronto.ca<br />       8 usask.ca<br />      10 uwo.ca<br />      17 uoguelph.ca<br />      28 uwaterloo.ca<br />Average day @ Queen’s sees ~ 50 ppl on eduroam with about 5 from outside domains<br />Posit that institutions can broadcast only eduroam SSID<br />Still have chicken and egg problem how to get on, but same problem as WPA2…<br />Communication is key<br /> captive portal SSID and show the one page could work, but ideas welcome<br />9<br />
    • 10. eduRoam @ McMaster<br />10<br />
    • 11. Onboarding Process<br />Standard template for connecting new sites<br />Policy sign-off followed by technical implementation<br />Estimated time for Canada federation-level RADIUS server personnel:<br />on-board a new member site: a few hours to two person-days, depending on member site expertise<br />general maintenance: ~one person-day per month<br />Local implementation from 4 hours to 4 weeks<br />11<br />
    • 12. Rapid Growth<br />12<br />
    • 13. More Stats<br />Canada has ~28 of 92 universities on eduroam.<br />US has slightly less in number (25) but 3,000 plus insitutions<br />Hooray! We are leading the way in North America!<br />13<br />
    • 14. Eduroam Questions?<br />14<br />
    • 15. Shibboleth Federations Worldwide<br />15<br />
    • 16. Past Presentations<br />This presentation builds on CANHEIT 2011:<br />Prezi on Building federated applications:<br />http://bit.ly/fedapps<br />16<br />
    • 17. Rightsize Your Information Sharing<br />Log in, share NetID+attr.<br />Log in, share Opaque ID<br />Log in, share NetID<br />Log in, share nothing<br />Wireless<br />External<br />Website<br />personal-<br />ization<br />is desired<br />Internal<br />Website<br />personal-<br />ization<br />is desired<br />linkage<br />elsewhere<br />desired<br />Internal<br />Website<br />personal-<br />ization<br />is desired<br />linkage<br />elsewhere<br />desired<br />Data <br />needed<br />(ghosted)‏<br />SAML as conduit for Information release<br />
    • 18. Dispelling Some Myths<br />18<br />
    • 19. My App Can’t Be Federated in CAF Because…<br />It is limited to regionally/specific identities<br />Reply: No problem! This is a Virtual Organization<br />A Virtual Organization (VO) is any collective group that operates in a coordinated way to enable shared activities on one or more topics with common tools or governance.<br />VOs can exist within institutional boundaries but are most effective when constituted to operate across and to unify participants in different physical or institutional limits.<br />Primary purpose is to pursue the shared topic or topics.<br />19<br />
    • 20. Virtual Organization pt 2<br />CAF is an environment where VO’s flourish:<br />Virtual Organizations typically form around Service Provider(s) with IdPs providing consumers & complying to attribute profiles to participate<br />Autonomy is retained by the VO & it’s members to focus on the topic <br />-CAF focus is on the  ‘dialtone’ infrastructure for collaboration – IdP & Sp management practices and operations and middleware elements<br />–Examples in Canada are:<br />•Regional Learning Management Systems<br />•Transcript or Application management<br />Research 'desktops' that aggregate tools for researchers<br />Techniques to implement on SP end:<br />Use the Shib2.xml & other configurations to whitelist participants[1]<br />Consider using eduPersonEntitlement to express fine grain filtering at the application level:<br />eduPersonEntitlement: urn:mace:washington.edu:confocalMicroscope<br />eduPersonEntitlement: http://publisher.example.com/contract/GL12<br />[1] https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataFilter<br />20<br />
    • 21. My App Can’t Be Federated in CAF Because…<br />I need to exchange special attributes<br />Reply: No Problem!<br />CAF’s default is shared nothing<br />eduPerson is the default attributes set<br />Where insufficient, the SP should work out the details with it’s partners on what extra elements it needs<br />CAF recommends that the SP have proper OIDs (can be registered with IANA for free) for their attributes<br />OIDs provide uniqueness, but us humans like text names that are unique too.<br />21<br />
    • 22. Enhancing Attribute Exchanges<br />Shared nothing today, but uses eduPerson schema<br />Finding that this may be paradox of choice<br />Very interesting space to explore, but keep in mind principles:<br />Low friction to participate (ie, simplicity is good)<br />Scalable and high degree of relevancy and utility<br />Don’t punish the end user or IdP owner.<br />Interop across Canada and internationally<br />Many areas to explore<br />Use SHAC[1] technique for attributes?<br />"urn:schac:dom.ain:Attribute:value”<br />UseAustralian[2] approach for precise control and strong typing and vocabulary?<br />Require full participation in various attribute sets (ie MUST populate all fields) but in different categories of SPs (category 1, 2,3 etc)?<br />Hybrid??<br />[1] http://www.terena.org/mail-archives/schac/msg00371.html<br />[2] http://www.aaf.edu.au/technical/aaf-core-attributes/<br />22<br />
    • 23. My App Can’t Be Federated in CAF Because…<br />I need a Higher Level of Assurance for a user<br />Reply: OK, we want this too, what are your requirements?<br />Challenge is how do you want to express it and what are your criteria for the higher level of assurance?<br />Part of a larger conversation<br />What is the yardstick? <br />NIST 800-63?<br />NSTIC, OIX, KANTARA audit requirements<br />Audit of SP against their own statements?<br />If you want to be part of this conversation see Chris Phillips & or join mailing list.<br />23<br />
    • 24. My App Can’t Be Federated in CAF Because…<br />I need to sign in on the command line<br />Reply: Ok, we want this too.<br />Already participating internationally with UK-JISC on project moonshot. Combo environment of eduroam RADIUS and SAML attribute assertions<br />Live CD’s of the sample dev environment available from Chris.<br />Again, if you want to be part of this conversation see Chris Phillips & or join mailing list.<br />24<br />
    • 25. My App Can’t Be Federated in CAF Because…<br />I need to sign in Social identities (Google, OpenID)<br />Reply: No problem, it can be done<br />Already participating internationally with REFEDS & inCommon on Social Identity risk assessment and gateway designs[1]<br />Certain gateways exist from uPenn & Sweden [2]<br />Many unquantified risks at this time, but does work<br />User behind keyboard is unknown<br />Attributes are self asserted<br />No knowledge of value of the account to the person<br />This is an active area of conversation.<br />[1] https://spaces.internet2.edu/display/socialid/Using+SAML+and+Social+Identities--Guidelines+and+Considerations+for+Managers+and+Developers<br />[2] https://tnc2011.terena.org/getfile/558<br />25<br />
    • 26. My App Can’t Be Federated in CAF Because…<br />I don’t think the CAF has as highly available as I want them to be<br />Reply: OK, did you know the following?<br />CAF services reside in 3 provinces (Ontario, BC, and Quebec), and have redundant DNS entrieswith live failover<br />What are your service criteria so we may understand them better?<br />26<br />
    • 27. FYI about availability<br />27<br />
    • 28. Your Turn…<br />Poll: What would be your priority ranking of the following activities? http://twtpoll.com/amdcc6<br />Looking for more conversation and discussion?<br />Join the CAF-Shib technical list to discuss the topics:<br />CAF-SHIBBOLETH-TECHNICAL-L-request@LISTSERV.UWINDSOR.CA<br />28<br />
    • 29. Extra Slides<br />29<br />
    • 30. 30<br />
    • 31. Secure Wireless – 802.1X<br />April 27th 2010<br />Canada eduroam<br />Slide 31<br />Wireless Encryption Established<br />secure.wireless.ubc.ca<br />ssid:ubcsecure<br />id:jdoe<br />1)Negotiate Authentication Method<br />EAP-PEAPv0-MSCHAPv2<br />2)Certificate Validation<br />Prevents “man-in-the-middle” attack<br />3)Establish Secure Tunnel<br />Prevents eavesdropping<br />Using MSCHAPv2<br />4)Perform authentication through tunnel<br />5)Authentication successful<br />Establish encryption, connect to net<br />6)Client acquires IP address (DHCP)<br />
    • 32. Eduroam - Roaming User<br />April 27th 2010<br />Canada eduroam<br />Slide 32<br />Federation Server<br />realm: ca<br />ssid:eduroam<br />Cert: eduroam.sfu.ca<br />Institution Servers<br />id: joe@sfu.ca<br />realm: ubc.ca<br />realm: sfu.ca<br />1) Negotiate EAP type<br />EAP-TTLS-PAP<br />2) Outer Request<br />Validate cert.<br />Establish TLS tunnel<br />PAP – through tunnel – secure!<br />3) Inner Request<br />4) Success<br />Connect to network<br />Establish encryption.<br />
    • 33. Eduroam – International Roaming<br />April 27th 2010<br />Canada eduroam<br />Slide 33<br />Confederation Server<br />Federation Server<br />realm: ca<br />realm: edu<br />id: pam@mit.edu<br />realm: ubc.ca<br />realm: sfu.ca<br />realm: mit.edu<br />realm: ucla.edu<br />

    ×