Toward campus portal withshibboleth middleware
Eisuke Ito and Masanori Nakakuni
itou@cc.kyushu‐u.ac.jp, Kyushu University
nak@fukuoka‐u.ac.jp, Fukuoka University

1Outline
1. Background2. Shibboleth
3. Campus portal
4. SoluMon
5. Conclusion

2

1. Background• Closed/Private web services increase in University– WebCT, e‐Syllabus, researcher & resources, student portal, etc…
– Those systems are independently implemented.

• Single ID/PW and SSO (Single Sign‐on)– Unify ID&PW (Single ID/PW)– SSO• Reverse proxy type SSO system will be installed.
• Shibboleth SSO system is installing.

• But, InformaMon sources are sMll distributed.
– Campus portal is required to realize one stop service3Microsoft Office
SharePoint Server

Researcher’s Results

Blackboard Learning
System (WebCT)

Mirapoint Web Mail
Campusmate/Portal
Netacademy2(Language Learning)

Institutional Repository(Library)Campusmate-J(Grade point system)
Syllabus system4

1. Background (Cont.)• Problem: it is diﬃcult to gather informaMon from private
services• Distributed web SSO (single sign on) systems are developed– such as OpenID and Shibboleth– NII of Japan deploys Shibboleth SSO• Common (Uniformed/standardized) SSO pla^orm may appear.

– Kyushu university is installing Shibboleth IdP• Common pla^orm makes easy to exchange data betweensystems.

5Goal• We are construcMng common SSO pla^orm withShibboleth.
• On the pla^orm, we may establish something
method for informaMon exchange between privateservices.
• And make a university portal

6

Outline
1. Background2. Shibboleth
3. Campus Portal
4. SoluMon
5. Conclusion

7

SAML
• SAML (Security AsserMon Markup Language)– XML based data exchange protocol deﬁned by OASIS– hdp://docs.oasis‐open.org/security/saml/v2.0/• 3 players

SAML AsserMon– User and browser– IdP（IdenMty Provider）• User account, authenMcaMon– SP（Service Provider）• SAML asserMon– AuthenMcaMon– Adribute– AuthorizaMon Decision

・Issue date・AsserMon provider
・Expire date・Digital signature
・AuthenMcaMon
・AuthorizaMon
・Adributes– SAML over HTTP
– SAML over SOAP

8

SAML
IdP

User(Security Assertion Markup Language)

SP

1.
2.

1. Access
2. AuthenMcated?
3. Redirect4.

4. AuthenMcaMon

5. Response (Redirect)

3.

6. Check &decision

5.
6.
7.

A user accesses to an SP.
SP checks authenMcated or not. Ifnot, SP make a SAML authenMcaMon
request.
SP returns redirecMon message toIdP.
User enter his/her credenMal to theIdP.
IdP returns message to redirect SP
SP decides to provide service or not,based on returned SAML asserMon.
SP provides service to the user.

7. Provide service

IdP must be fixed for SP.

9

Shibboleth•

A Web SSO middleware (developed by Internet2)–•hdp://shibboleth.internet2.edu/

AssumpMon– User may belong with an organizaMon.
– The organizaMon may issue one’s credenMal such as ID/PW for user authenMcaMon.

•4 Players––––User and browser
IdP (IdenMty Provider)
SP (Service Provider)
DS (Discovery Service) ….
• User selects his/her IdP (or OrganizaMon)••

It was called WAYF（Where are you form?） in Shibboleth ver. 1.x

Adribute based authorizaMon– OrganizaMon may manage user account– User’s adributes may be also manage users adributes10

ShibbolethIdPUserDSSP
1.
2.

1. Access

2. AuthenMcated?

3.
4.
5.

3. Select IdP in DS
5. AuthenMcaMon

4. Redirect

6. Response (Redirect)

8. Provide service

7. Check &decision

6.
7.
8.

A user accesses to an SP.
SP checks authenMcated or not. If
not, SP makes a SAML
authenMcaMon request.
Select his/her IdP in DS process
SP redirects to the IdP.
User enter his/her credenMal to theIdP.
IdP returns message to redirect SP
SP decides to provide service or not,based on returned SAML asserMon.
SP provides service to the user.

11

3. Campus Portal• Portal is a web site that is a major starMng site forusers when they get connected to the web or thatusers tend to visit as an anchor site.
• Campus portal– One stop service for users– Good noMce board for oﬃcials

12

iGoogle

The start page of google apps (iGoogle) …. (Start page is not available, now.)
・ It can include various site information with google gadget.
・ It can use SAML based authentication （Shibboleth）

13

Yahoo! JAPAN14

An image of campus portal
Mash up private services
into portalGoogle Apps for Kyushu University

ie208002@s.kyushu‐u.ac.jp

Private services
of Kyushu U• MyLibrary

HomeE Mail

Library

Recruits

Circles

Kyushu UMyLibrary•返却依頼：「分散システム…」

WebCTCalender

YouTube Kyushu U• Keynote speech of President

・休講通知「情報理学演習」
・レポート 分散システム特論
・情報理学チューリング祭のおしらせ• WebCT

リクナビ＠九大•インターンシップ情報•就職セミナー開催

SaaS/Cloud style service

15

Problem of campus portal• Diﬃcult to integrate independent private services– How to extract informaMon pieces from each sites?
– How to pass through user authenMcaMon?
• This is a barrier.
• Common web SSO may make easier to break this barrier.

16

Outline
1. Background2. Shibboleth
3. Campus Portal
4. SoluMons
5. Conclusion

17

4. SoluMons• We need a data exchange method between private services.
• We studied 4 methods
1.
2.
3.
4.

HTTP proxy
HTTP binding
ArMfact binding
Unsolicited Response• Above 2, 3, and 4 are proposed by M. Aoyagi et al. in this arMcle.
– Makiko Aoyagi, Manabu Okamoto, Michio Shimomura, “A study ofauthenMcaMon methods in Web service mash‐up” IEICE SCIS 2009, 4D1‐4,2009. (in Japanese)18

UserBrowser

SAML

PortalIdP

IdP

SPUserSP1
SP2Browser

PortalSPn19

(1) HTTP Proxy• User entrusts ones credenMal to portal.
– Portal must be trustworthy.

• Portal acts as proxy of user (browser)

IdP

PortalSP

proxy– it sends user’s ID/PW to SP or IdP.

IdP

User

PortalSPBrowser

20

(2) HTTP Binding• Portal, SP, and IdP exchange SAML data directory.
– Aper authenMcaMon at IdP, SP returns
response, and returns informaMon ofSP using agent.

IdP

PortalSPIdPUserSPBrowser

Portal21

(3) ArMfact Binding• IdP and SP exchange arMfacts, where arMfacts include session
informaMon.
IdP

SOAPIdP
User

Portal SPSPSOAPBrowser

Portal22

(4) Unsolicited Response• IdP sends unsolicited response to SP.
• SP receives the unsolicited response,and invokes response process.

IdP

Portal

SP

IdP
User

SPBrowser

Portal23

Comparison of each methods•

SP

Each methods is familiar with SAML and Shibboleth
HTTP Proxy

HTTP Binding

ArMfact Binding

Unsolicited Response

Specify IdPSpecify IdPSpecify IdPAddiMonal SOAP
process

Must supports
unsolicited response.

IdP

AddiMonal SOAP
process

PortalMerit

Easy toimplement.
Less portability.

DemeritPortal becomessecurity bodle
neckSimple.
Easy toimplement.

Secure.

Simple.
Easy to implement.
Good for mulMple SP’s

Can’t apply thismethod If
communicaMon
between IdP and SP islimited.

24Prototype of HTTP Proxy• Environments– IdP– SP• Results

OS

CentOS 5.1

Web

Tomcat 6.0

IdP

Shibboleth– Success to integrate otherservice into portal.
– But, not portable

OSCentOS 5.1

WebApache2.2

SP module

mod_shib2.2

ServicePukiWiki– PortalOS

FreeBSD 7.0

Web ServerApache 2.2

Programming

Ruby 1.8

HTTP User Agent

Mechanize 0.8

25

5. Conclusion• Common Shibboleth SSO pla^orm makes easy to exchange data between
closed/private services.
• On the pla^orm, we may establish something method for informaMon
exchange between private services for campus portal.
• We studied 4 methods:– HTTP proxy– HTTP binding– ArMfact binding– Unsolicited Response … (beder than other)• In the future,– Construct Shibboleth IdP– Shibbolize SPs– Make campus portal which integrates private services.

26