Demo
Ueli Kienholz, SWITCH
2. December 2002
2002 © SWITCH
Shibboleth AA Process
hualalai
I don’t know you.
Not even which home
org you are from.
I redirect your request
to the WAYF
WAYF
Users Home Org
1
Resource Owner
SHIRE
Resource
ruapehu
2002 © SWITCH
koolau
e-Academia / AAI Info Day
2
Shibboleth AA Process
Please tell me
where you come from
hualalai
WAYF
2
3
Users Home Org
1
I don’t know you.
Not even which home
org you are from.
I redirect your request
to the WAYF
Resource Owner
SHIRE
Resource
ruapehu
2002 © SWITCH
koolau
e-Academia / AAI Info Day
3
Shibboleth AA
OK,Process
I redirect your
request now to
the Handle Service
of your home org.
Please tell me
where you come from
hualalai
WAYF
4
Users Home Org
2
3
1
I don’t know you.
Not even which home
org you are from.
I redirect your request
to the WAYF
Resource Owner
SHIRE
Resource
ruapehu
2002 © SWITCH
koolau
e-Academia / AAI Info Day
4
Shibboleth AA
OK,Process
I redirect your
request now to
the Handle Service
of your home org.
Please tell me
where you come from
hualalai
WAYF
I don’t know you.
Please authenticate
yourself
4
5
6
Users Home Org
2
3
1
HS
I don’t know you.
Not even which home
org you are from.
I redirect your request
to the WAYF
Resource Owner
SHIRE
Resource
ruapehu
2002 © SWITCH
koolau
e-Academia / AAI Info Day
5
Shibboleth AA
OK,Process
I redirect your
Please tell me
where you come from
request now to
the Handle Service
of your home org.
hualalai
WAYF
I don’t know you.
Please authenticate
yourself
4
5
6
Users Home Org
2
3
1
7
I don’t know you.
Not even which home
org you are from.
I redirect your request
to the WAYF
Resource Owner
Credentials
HS
SHIRE
Resource
User DB
OK, I know you now.
I redirect your request
to the target, together
with a handle
ruapehu
2002 © SWITCH
koolau
e-Academia / AAI Info Day
6
Shibboleth AA
OK,Process
I redirect your
Please tell me
where you come from
request now to
the Handle Service
of your home org.
hualalai
WAYF
I don’t know you.
Please authenticate
yourself
4
5
6
Users Home Org
2
3
1
7
I don’t know you.
Not even which home
org you are from.
I redirect your request
to the WAYF
Resource Owner
Credentials
HS
SHIRE
OK, I know you now.
I redirect your request
to the target, together
with a handle
ruapehu
2002 © SWITCH
9
AA
Handle
Let’s pass over the
attributes the user
has allowed me to
release
e-Academia / AAI Info Day
Resource
User DB
koolau
7
Shibboleth AA
OK,Process
I redirect your
Please tell me
where you come from
request now to
the Handle Service
of your home org.
hualalai
I don’t know you.
Not even which home
org you are from.
I redirect your request
to the WAYF
WAYF
I don’t know you.
Please authenticate
yourself
4
5
6
Users Home Org
2
3
1
Resource Owner
7
Credentials
HS
8
Handle
SHIRE
OK, I know you now.
I redirect your request
to the target, together
with a handle
ruapehu
2002 © SWITCH
Handle
9
AA
Handle
SHAR
Let’s pass over the
attributes the user
has allowed me to
release
I don’t know the
attributes of this user.
Let’s ask the Attribute
Authority
e-Academia / AAI Info Day
Resource
User DB
koolau
8
Shibboleth AA
OK,Process
I redirect your
Please tell me
where you come from
request now to
the Handle Service
of your home org.
hualalai
I don’t know you.
Not even which home
org you are from.
I redirect your request
to the WAYF
WAYF
I don’t know you.
Please authenticate
yourself
4
5
6
Users Home Org
2
3
1
Resource Owner
7
Credentials
HS
8
Handle
SHIRE
ruapehu
2002 © SWITCH
Handle
9
AA
Handle
SHAR
Attributes
Resource
OK, I know you now.
I redirect your request
to the target, together
with a handle
Resource
Manager
User DB
10
Attributes
Let’s pass over the
attributes the user
has allowed me to
release
I don’t know the
attributes of this user.
Let’s ask the Attribute
Authority
e-Academia / AAI Info Day
OK, based on the
attributes, Ikoolau
grant
access to the
resource
9
Shibboleth Internet2 Demo
wayf.internet2.edu
WAYF
Shib
Target
Server
example.edu
User DB
2002 © SWITCH
ohio-state.edu
Shib
Origin
Server
e-Academia / AAI Info Day
10
Shibboleth Internet2 Demo
wayf.internet2.edu
WAYF
2
3
1
example.edu
User DB
2002 © SWITCH
ohio-state.edu
Shib
Target
Server
Shib
Origin
Server
e-Academia / AAI Info Day
11
Shibboleth Internet2 Demo
wayf.internet2.edu
WAYF
5
4
3
1
6
example.edu
User DB
2002 © SWITCH
2
ohio-state.edu
Shib
Target
Server
Shib
Origin
Server
e-Academia / AAI Info Day
12
Shibboleth Internet2 Demo
wayf.internet2.edu
WAYF
5
4
2
3
1
6
example.edu
7
Credentials
User DB
2002 © SWITCH
Shib
Origin
Server
ohio-state.edu
Shib
Target
Server
8
Attributes
e-Academia / AAI Info Day
13
Shibboleth Internet2 Demo
The cookie I gave you
last time tells me
that you are from
example.edu
wayf.internet2.edu
WAYF
5
4
3
example.edu
7
Credentials
User DB
Shib
Target
Server
1
6
Shib
Origin
Server
ohio-state.edu
2
8
2b
Attributes
webassign.net
1b
Shib
Target
Server
2002 © SWITCH
e-Academia / AAI Info Day
14
Shibboleth Internet2 Demo
The cookie I gave you
last time tells me
that you are from
example.edu
wayf.internet2.edu
WAYF
5
4
3
example.edu
7
Credentials
User DB
Shib
Target
Server
1
6
Shib
Origin
Server
ohio-state.edu
2
8
2b
Attributes
webassign.net
1b
Shib
Target
Server
Your are already
authenticated
2002 © SWITCH
e-Academia / AAI Info Day
15
Shibboleth Internet2 Demo
The cookie I gave you
last time tells me
that you are from
example.edu
wayf.internet2.edu
WAYF
5
4
3
example.edu
7
Credentials
User DB
Shib
Target
Server
1
6
Shib
Origin
Server
ohio-state.edu
2
8
2b
Attributes
webassign.net
1b
Attributes
Your are already
authenticated
2002 © SWITCH
8b
e-Academia / AAI Info Day
Shib
Target
Server
16