AAI für Bibliotheken Wo und wie kann AAI nützlich sein?

Transkript

1 AAI für Bibliotheken Wo und wie kann AAI nützlich sein? Bern, 20. November 2009 Thomas Lenggenhager

2 Übersicht Kurze Einführung in AAI Zugriff auf lizenzierte Inhalte VO Plattform: Kollaboration von Gruppen über Organisationsgrenzen hinweg 2

3 Wofür steht AAI? Authentifizierungs- und Autorisierungs-Infrastruktur Authentication Authorization Infrastructure AuthN & AuthZ 3

4 Ohne AAI Universität A Student Adm Aufwendige Registrierung bei allen Ressourcen Bibliothek B Universität C Web Portal e-learning e-zeitschriften Literatur DB Research DB e-learning Unzuverlässige und veraltete Daten Verschiedene Login-Verfahren Viele Passworte Viele Ressourcen werden nicht geschützt Wenn geschützt, dann oft nur durch IP-Adressen Benutzerverwaltung Authentifizierung Autorisierung Ressource Passwort 4

5 Mit AAI Universität A AAI Student Adm Registrierung bei den Ressourcen entfällt Bibliothek B Web Portal e-learning e-zeitschriften Literatur DB Einheitliches Login-Verfahren Web Single-Sign-On Erschliesst Benutzern neue Ressourcen Standort-unabhängig Universität C Research DB e-learning Benutzerverwaltung Authentifizierung Autorisierung Ressource Passwort 5

6 SWITCHaai Federation in Autumn 2009 # Home Organizations # AAI enabled accounts # Resources >95% coverage in higher education 6

7 Shibboleth - The Software Open Source Word Shibboleth was used to identify members of a group Based on Security Assertion Markup Language (SAML) Internationally used by universities 7

8 AAI-enabling a Home Organization Authentication System Identity Provider WebApp Server Prerequisite Authentication System User Directory Shibboleth Identity Provider (IdP) is a Java WebApp Principal User Directory Shibboleth Web Servers supported Tomcat/JBoss Apache + Tomcat/JBoss IIS + Tomcat/JBoss 8

9 Shibboleth Service Provider for Apache/IIS Runs on: Linux, Solaris, Windows, Mac OS X, FreeBSD, Protects static content and web applications Apache/IIS Web server shibd fetches attributes and propagates them Can authorize users with Apache directives Shibboleth XML Access rules mod_shib mod_php shibd PHP Application mod_jk Tomcat Modules Provides attributes to applications Alternative authorization method Java Application 1 Java Application 2 9

10 Demo 10

11 SWITCHaai Project Timeline Study Pilot Implementation Production Architecture Evaluation Shibboleth 1.3 Shibboleth Shibboleth 2.x AAI Subsidies AAA/SWITCH Nov 1999: Term AAI first time mentioned in a document Nov 2000: AAI Workshop 11

12 What is a Federation? A set of organizations agreeing on a common set of rules and standards Goal Cooperate in inter-organizational authentication, authorization and accounting Common trust Legal Technical 12

13 Federation Metadata XML File (e.g. metadata.switchaai.xml) that contains list of: Accepted Root CA certificates Description of Identity Providers (incl. embedded certificates) Description of Service Providers (incl. embedded certificates) SWITCHaai Metadata is signed by SWITCH Metadata technically describes federation! 13

14 Die SWITCHaai Föderation SWITCH ist der Betreiber der SWITCHaai Föderation Mitglied der Föderation durch Unterschreiben des Service Agreements 14

15 Rechtlicher Rahmen für SWITCHaai Bundesrecht, kantonales Recht (speziell Datenschutz) SWITCH Service Agreement AAI Policy Org 1 Org 2 Org... Org n User Regulations User Regulations User Regulations User Regulations 15

16 SWITCHaai Attributes Personal Unique Identifier Surname Given name User ID Matriculation number Employee number Address(es) Phone number(s) Preferred language Date of birth Gender Group Membership Home Organization Name Home Organization Type Affiliation Study branch Study level Staff category Group membership Organization Path Organizational Unit Path Implementation of Attributes Mandatory Recommended or optional Based on eduperson Attributes Schweizerisches Hochschulinformationssystem (SHIS) NO password 16

17 Attribute Based Authorization Example Dermatology Online with Interactive Technology (DOIT) DOIT: Authorization Rule HomeOrg = UZH UniBE UNIL Affiliation = Student StudyBranch = Medicine StudyLevel = 20 17

18 AAI - Essential Facts AAI makes life easier for everybody Users have a single account for all their services Authentication only at user s home organization User data is maintained only once Collaboration between multiple organizations is simplified 18

19 Übersicht Kurze Einführung in AAI Zugriff auf lizenzierte Inhalte VO Plattform: Kollaboration von Gruppen über Organisationsgrenzen hinweg 19

20 Status der Federation Partner Dawson Books EBSCO EBSCOhost Elsevier ScienceDirect Scopus (only licensed by EPFL) H.W. Wilson WilsonWeb MetaPress SpringerLink and many other publishers S. Karger AG SAGW InfoClio Schweizerisches Bundesgericht Web Zugang für Juristen Thomson Reuters Inc. ISI Web of Knowledge Universitätsbibliothek Freiburg, DE ReDI Apple Sales International Apple Neptun Store ETH Alumni Vereinigung Instruct CASUS Jobzippers Jobzippers Microsoft Schweiz AG DreamSpark / Microsoft Software Download Netenviron GmbH polyright SA 20

21 E-content Provider mit Shibboleth 21

22 Access to a Shibbolized Provider of e-journals Elsevier ScienceDirect IP-Filter Shib Uni Zürich Uni Zürich user at home redirect SFX redirect link list link list WWW 22

23 Access to a Non-Shibbolized Provider of e-journals IP-Filter Nature Uni Zürich redirect rewrite EZproxy Shib Uni Zürich user at home redirect redirect SFX link list link list WWW 23

24 Links zu Publisher und AAI JISC (UK): Service Provider Interface Study InCommon (US): Arbeitsgruppe InC-Library Wie kann ich direkte Login Links (Bookmarks) machen, ohne Umweg über den Discovery Service? 24

25 Übersicht Kurze Einführung in AAI Zugriff auf lizenzierte Inhalte VO Plattform: Kollaboration von Gruppen über Organisationsgrenzen hinweg 25

26 The VO Problem Support for Virtual Organizations across institutional boundaries is unsolved Who belongs to the VO, who not? Where to store VO specific attributes shared by multiple services? Storing VO specific info in the Home Organization Identity Providers is unfeasible Virtual Organization = A group of collaborating individuals 26

27 The Idea Use VO Platform(s) to store VO specific info Let SP aggregate attributes from users Home Institution, and from VO Platform(s) Use a shared identifier between all involved entities Use standard SAML 2 back-channel attribute queries to SAML 2 Attribute Authorities 27

28 The Library Use Case The VO: Swiss University Libraries In the beginning the IDS libraries with Ex Libris Aleph Primary interest of IDS: get rid of the proprietary Aleph «Shared User File» VO Services The Aleph library systems using Shibboleth with Ex Libris PDS A new central Library Identity Provider for all users without an AAI account (not included on the following slides) Proposal for an E-lib.ch web portal sub project 28

29 The Components Bibliotheks VO System Universitäts Identity Provider Aleph Systeme mit PDS 29

30 User registers on the VO Platform 30

31 Shared ID Attribute known by Home IdP, VO Services SP and VO Platform Used as SAML 2 Persistent NameIdentifier for attribute request Could be a common identifier like swissedupersonuniqueid Rather unlikely for generic VOs Problematic if IDs are already widely known Could also be a value of the form edupersontargetedid that is generated by the IdP for an SP or group of VO SPs with: <EntityDescriptor entityid=" <AffiliationDescriptor affiliationownerid=" <AffiliateMember> <AffiliateMember> <AffiliateMember> </AffiliationDescriptor> </EntityDescriptor> 31

32 User connects to a VO Service 3) 1) 2) 4) 32

33 VO Service aggregates attributes Knowing a Shared ID, a VO Service is able to aggregate attributes without user interaction Use SP tool resolvertest 3) 2) 1) 33

34 SWITCHaai Link Collection How to join SWITCHaai? AAI Support Information or ask AAI-announce Mailinglist The AAI Demo 34