Your SlideShare is downloading. ×
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
CANARIE - What Do I Need to Connect with eduroam and Shibboleth
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

CANARIE - What Do I Need to Connect with eduroam and Shibboleth

2,941

Published on

A brief discussion about what it means to connect with eduroam and Shibboleth. Technical slides are at the end of the slide deck

A brief discussion about what it means to connect with eduroam and Shibboleth. Technical slides are at the end of the slide deck

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
2,941
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
16
Comments
0
Likes
0
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide
  • Current as of May 2011
  • Key to our success- developing a streamlined, standardized approach for connecting schools. Additional ongoing support from participating institutions as part of Community of Practice.
  • Conscription of users
  • Conscription of users
  • Transcript

    • 1. Canadian Access Federation
      What Do I need to do on my campus to enable eduroam & Shibboleth?
      July 5,2011
      Chris Phillips –chris.phillips@canarie.ca
    • 2. Agenda
      Per Service
      Value proposition
      Technical profile
      Skills required
      Time required
      Eduroam
      detailed tech slides at the end
      Shibboleth
      Also detailed tech slides at the end
      More to be found at: http://bit.ly/fedapps (link to prezi)
      2
    • 3. Use Case – Wireless Access
      Without eduRoam
      User arrives, needs to get onto wireless
      Needs to talk to IT staff to get credential in system created and a password set
      User waits for account
      User uses known password, signs into wireless
      When user is complete, IT should be notified to delete account and terminate access (right?)
      IT deletes account(right?)
      Done
      With eduRoam
      User arrives, needs to get onto wireless, has eduRoam enabled ID
      Open laptop
      User is authenticated to home system and is online
      Done
      3
    • 4. Eduroam impact
      Reduces
      effort supporting guest network ids
      Support calls…How do I…?
      Guest account footprint in your systems
      Only available on wireless systems, not others
      4
    • 5. eduRoam @ CANHEIT2011 - McMaster
      5
    • 6. Canadian eduRoamCoverage
      6
    • 7. How does eduroam work?
      802.1X - to authenticate clients before allowing access to the network
      EAP framework – with secure EAP methods to protect user credentials
      RADIUS - authentication server infrastructure
      RADIUS proxying – to route authentication requests to a users home institution
      Separate IP address space – treated as external to institution (compliance with service agreements, etc)
      End Users have standard internet access with as few filters as possible (if any at all).
    • 8. Sample Deployment: Queen’s
      8
    • 9. Cisco ACS Config
      9
    • 10. Reciprocity
      Eduroam is about you treating guest credentials how you would like to be treated:
      Just think about what you would like when you travel:
      No filtered connections
      No traffic shaping
      Public IP address (where possible)
      NAT is not necessarily appropriate, but if you already private IP folks now, probably works out ok.
      10
    • 11. Onboarding Process
      Canada has ~28 of 92 universities on eduroam.
      US has slightly less in number (25) but 3,000 plus insitutions
      Eduroam operator:
      Standard template for connecting new sites
      Policy sign-off followed by technical implementation
      Estimated time for Canada federation-level RADIUS server personnel:
      on-board a new member site: a few hours to two person-days, depending on member site expertise
      general maintenance: ~one person-day per month
      Eduroam site:
      Local implementation from 4 hours to 4 weeks depending on capabilities
      Skill: operate/install RADIUS on your choice of platform (Cisco ACS, Microsoft NPS, FreeRADIUS)
      Operational maintenance: same as your AuthN server now
      11
    • 12. Rapid Growth
      12
    • 13. Eduroam Questions?
      13
    • 14. Shibboleth Federations Worldwide
      14
    • 15. Past Presentations
      This presentation builds on CANHEIT 2010:
      Prezi on Building federated applications:
      http://bit.ly/fedapps
      15
    • 16. Use Case – New Employee Access to Online Resources
      Without Shibboleth
      User arrives, needs to have access to web resource for
      Active Directory
      Twiki.canarie.ca
      Staff.canarie.ca
      Collaborate.canarie.ca
      Shared online resources in 3rd party wiki
      Needs to talk to staff for each service to get credential in each system created and a password set
      User waits for account for each service
      User uses known password, signs into each service and sets a password
      When user leaves the organization, each service should be notified to delete account and terminate access everywhere (right?)
      Each service deletes account(right?)
      Done
      With Shibboleth
      User arrives, needs to have access to web resource for
      Active Directory
      Twiki.canarie.ca
      Staff.canarie.ca
      Collaborate.canarie.ca
      Shared online resources in 3rd party wiki
      IT staff creates central account and assigns privileges to access resources centrally.
      User waits for account
      User changes password and all services rely on this password.
      When user leaves the organization, this one account should be notified for deletion (right?)
      Done
      16
    • 17. Shib Value Proposition
      Game changer for integration effort with shib ready services
      Reduces integration from customization to configuration
      Avoid weeks of custom project integration and then maintenance until, well, forever 
      Lowers cost of doing business – do better with less.
      Establishes a centralized policy enforcement point and easier auditability
      For new work, establishes publicly accepted framework to implement to & not your own homegrown framework
      17
    • 18. Rightsize Your Information Sharing
      Log in, share NetID+attr.
      Log in, share Opaque ID
      Log in, share NetID
      Log in, share nothing
      Wireless
      External
      Website
      personal-
      ization
      is desired
      Internal
      Website
      personal-
      ization
      is desired
      linkage
      elsewhere
      desired
      Internal
      Website
      personal-
      ization
      is desired
      linkage
      elsewhere
      desired
      Data
      needed
      (ghosted)‏
      SAML as conduit for Information release
    • 19. Infrastructure & Skills
      Infrastructure is a single server for Identity provider (IdP) (preferably 2 for redundancy)
      IdP is java & runs in it’s own servlet container on Jetty, Tomcat, or JBOSS
      Can cohabitate with existing SSO or be the SSO service itself entirely
      Skills/Type of Person
      The same person managing your SSO environment would be be beneficial.
      Operational effort is log watching and XML configuration
      19
    • 20. Where would you like to go next?
      20
    • 21. Extra Slides
      21
    • 22. Secure Wireless – 802.1X
      April 27th 2010
      Canada eduroam
      Slide 22
      Wireless Encryption Established
      secure.wireless.ubc.ca
      ssid:ubcsecure
      id:jdoe
      1)Negotiate Authentication Method
      EAP-PEAPv0-MSCHAPv2
      2)Certificate Validation
      Prevents “man-in-the-middle” attack
      3)Establish Secure Tunnel
      Prevents eavesdropping
      Using MSCHAPv2
      4)Perform authentication through tunnel
      5)Authentication successful
      Establish encryption, connect to net
      6)Client acquires IP address (DHCP)
    • 23. Eduroam - Roaming User
      April 27th 2010
      Canada eduroam
      Slide 23
      Federation Server
      realm: ca
      ssid:eduroam
      Cert: eduroam.sfu.ca
      Institution Servers
      id: joe@sfu.ca
      realm: ubc.ca
      realm: sfu.ca
      1) Negotiate EAP type
      EAP-TTLS-PAP
      2) Outer Request
      Validate cert.
      Establish TLS tunnel
      PAP – through tunnel – secure!
      3) Inner Request
      4) Success
      Connect to network
      Establish encryption.
    • 24. Eduroam – International Roaming
      April 27th 2010
      Canada eduroam
      Slide 24
      Confederation Server
      Federation Server
      realm: ca
      realm: edu
      id: pam@mit.edu
      realm: ubc.ca
      realm: sfu.ca
      realm: mit.edu
      realm: ucla.edu
    • 25. Dispelling Some Shibboleth Myths
      25
    • 26. My App Can’t Be Federated in CAF Because…
      It is limited to regionally/specific identities
      Reply: No problem! This is a Virtual Organization
      A Virtual Organization (VO) is any collective group that operates in a coordinated way to enable shared activities on one or more topics with common tools or governance.
      VOs can exist within institutional boundaries but are most effective when constituted to operate across and to unify participants in different physical or institutional limits.
      Primary purpose is to pursue the shared topic or topics.
      26
    • 27. Virtual Organization pt 2
      CAF is an environment where VO’s flourish:
      Virtual Organizations typically form around Service Provider(s) with IdPs providing consumers & complying to attribute profiles to participate
      Autonomy is retained by the VO & it’s members to focus on the topic 
      -CAF focus is on the  ‘dialtone’ infrastructure for collaboration – IdP & Sp management practices and operations and middleware elements
      –Examples in Canada are:
      •Regional Learning Management Systems
      •Transcript or Application management
      Research 'desktops' that aggregate tools for researchers
      Techniques to implement on SP end:
      Use the Shib2.xml & other configurations to whitelist participants[1]
      Consider using eduPersonEntitlement to express fine grain filtering at the application level:
      eduPersonEntitlement: urn:mace:washington.edu:confocalMicroscope
      eduPersonEntitlement: http://publisher.example.com/contract/GL12
      [1] https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataFilter
      27
    • 28. My App Can’t Be Federated in CAF Because…
      I need to exchange special attributes
      Reply: No Problem!
      CAF’s default is shared nothing
      eduPerson is the default attributes set
      Where insufficient, the SP should work out the details with it’s partners on what extra elements it needs
      CAF recommends that the SP have proper OIDs (can be registered with IANA for free) for their attributes
      OIDs provide uniqueness, but us humans like text names that are unique too.
      28
    • 29. Enhancing Attribute Exchanges
      Shared nothing today, but uses eduPerson schema
      Finding that this may be paradox of choice
      Very interesting space to explore, but keep in mind principles:
      Low friction to participate (ie, simplicity is good)
      Scalable and high degree of relevancy and utility
      Don’t punish the end user or IdP owner.
      Interop across Canada and internationally
      Many areas to explore
      Use SHAC[1] technique for attributes?
      "urn:schac:dom.ain:Attribute:value”
      UseAustralian[2] approach for precise control and strong typing and vocabulary?
      Require full participation in various attribute sets (ie MUST populate all fields) but in different categories of SPs (category 1, 2,3 etc)?
      Hybrid??
      [1] http://www.terena.org/mail-archives/schac/msg00371.html
      [2] http://www.aaf.edu.au/technical/aaf-core-attributes/
      29
    • 30. My App Can’t Be Federated in CAF Because…
      I need a Higher Level of Assurance for a user
      Reply: OK, we want this too, what are your requirements?
      Challenge is how do you want to express it and what are your criteria for the higher level of assurance?
      Part of a larger conversation
      What is the yardstick?
      NIST 800-63?
      NSTIC, OIX, KANTARA audit requirements
      Audit of SP against their own statements?
      If you want to be part of this conversation see Chris Phillips & or join mailing list.
      30
    • 31. My App Can’t Be Federated in CAF Because…
      I need to sign in on the command line
      Reply: Ok, we want this too.
      Already participating internationally with UK-JISC on project moonshot. Combo environment of eduroam RADIUS and SAML attribute assertions
      Live CD’s of the sample dev environment available from Chris.
      Again, if you want to be part of this conversation see Chris Phillips & or join mailing list.
      31
    • 32. My App Can’t Be Federated in CAF Because…
      I need to sign in Social identities (Google, OpenID)
      Reply: No problem, it can be done
      Already participating internationally with REFEDS & inCommon on Social Identity risk assessment and gateway designs[1]
      Certain gateways exist from uPenn & Sweden [2]
      Many unquantified risks at this time, but does work
      User behind keyboard is unknown
      Attributes are self asserted
      No knowledge of value of the account to the person
      This is an active area of conversation.
      [1] https://spaces.internet2.edu/display/socialid/Using+SAML+and+Social+Identities--Guidelines+and+Considerations+for+Managers+and+Developers
      [2] https://tnc2011.terena.org/getfile/558
      32
    • 33. My App Can’t Be Federated in CAF Because…
      I don’t think the CAF has as highly available as I want them to be
      Reply: OK, did you know the following?
      CAF services reside in 3 provinces (Ontario, BC, and Quebec), and have redundant DNS entrieswith live failover
      What are your service criteria so we may understand them better?
      33
    • 34. FYI about availability
      34
    • 35. Your Turn…
      Looking for more conversation and discussion?
      Join the CAF-Shib technical list to discuss the topics:
      CAF-SHIBBOLETH-TECHNICAL-L-request@LISTSERV.UWINDSOR.CA
      35
    • 36. 36

    ×