Presentation on our approach to SSO (by Piers Harding of Catalyst IT). Includes reference to code download or reference implementations.

1. SSO everywhere Piers Harding 13 th April, 2010

3. It's based on the MoE SSO Pilot experience

4. We will go through the build process for an IdP

5. We will integrate as many Services as Possible (Moodle, Mahara, Koha, MediaWiki, Status.Net, Drupal, Google Apps)

6. You can take this home!

7. Please ask questions

9. Sharing the necessary user attributes from a central repository

11. It is based on SAML 2.0

12. It requires a centrally stored session, that each service refers back to

15. what typical scenarios?

16. what is the interaction?

17. and for schools?

19. Now that includes the Identity Provider

20. The Schema

21. The User Directory - Example user dn: cn=John Doe,ou=People,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount uid: john sn: Doe givenName: John cn: John Doe displayName: John Doe userPassword: password mail: john.doe@example.com postalCode: 31000 l: Toulouse o: Example

23. Firstname => givenName

24. Lastname => sn

25. Role => group membership(cn=Staff,ou=Groups) or position (cn=John Doe, ou=Staff)

26. Email => mail

27. Organisation => typically defined by the name of the UD connected to

29. PHP5

30. Memcached

31. simpleSAMLphp

33. Negotiates authentication with User Directory

34. Hold contracts with service providers regarding user attributes on offer

36. Holds metadata contract with IdP

37. Applies filter rules

38. Passes attributes to attached service

40. Both IdP and SP can apply filters with respect to users that will be accepted, and attributes that will be shared

41. Metadata - Example <?xml version=&quot;1.0&quot;?> <EntityDescriptor xmlns=&quot;urn:oasis:names:tc:SAML:2.0:metadata&quot; entityID=&quot;https://idp.local.net/simplesaml/module.php/saml/sp/metadata.php/default-sp&quot;> <SPSSODescriptor xmlns:ds=&quot;http://www.w3.org/2000/09/xmldsig#&quot; protocolSupportEnumeration=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot;> <KeyDescriptor use=&quot; signing &quot;> <ds:KeyInfo xmlns:ds=&quot;http://www.w3.org/2000/09/xmldsig#&quot;> <ds:X509Data> <ds:X509Certificate> [base64 encoded cert data] </ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </KeyDescriptor> <KeyDescriptor use=&quot; encryption &quot;> <ds:KeyInfo xmlns:ds=&quot;http://www.w3.org/2000/09/xmldsig#&quot;> <ds:X509Data> <ds:X509Certificate> [base64 encoded cert data] </ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </KeyDescriptor> <SingleLogoutService Binding=&quot;urn:oasis:names:tc:SAML:2.0:bindings: HTTP-Redirect &quot; Location=&quot; https://idp.local.net/simplesaml/module.php/saml/sp/saml2-logout.php/default-sp &quot;/> <AssertionConsumerService Binding=&quot;urn:oasis:names:tc:SAML:2.0:bindings: HTTP-POST &quot; Location=&quot; https://idp.local.net/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp &quot; index=&quot;0&quot;/> </SPSSODescriptor> <ContactPerson contactType=&quot;technical&quot;> <SurName>Administrator</SurName> <EmailAddress>piers@local.net</EmailAddress> </ContactPerson> </EntityDescriptor>

44. Runs all demo services fully self contained

46. Review config.php

47. Step through authsources.php

48. See LDAP admin

49. See metadata/saml20-*

50. Launch IdP admin page

52. Install/configure simplesamlphp for SP

53. Edit paths in auth/saml/config.php

55. Manage Authentication ->

58. Each service needs an associated SP

60. In particular the SAML Technical Overview - http://www.oasis-open.org/committees/download.php/11511/sstc-saml-tech-overview-2.0-draft-03.pdf

61. MLE Reference Group http://groups.google.co.nz/group/mle-reference-group?hl=en-GB

62. simpleSAMLphp http://git.catalyst.net.nz/gw?p=simplesamlphp.git;a=summary

63. VirtualBox image + presentation notes + howto http://www.catalyst.net.nz/sso/index.html