Upload
scott-reeves
View
212
Download
0
Embed Size (px)
Citation preview
TNC 2008
JANET(UK) Shibboleth on Windows Trial
TNC May 2008
Louis Searchwell
Please note that the Shibboleth installer for Windows described in this presentation and the example of its use represent work undertaken for EDINA, University of Edinburgh through a JISC funded Shibboleth support and development project (SDSS) by Rod Widdowson, Steading System Software LLP
Copyright JNT Association 2008
TNC 2008
Contents
• Intro & background
• Why we are doing this
• How it works
• JANET(UK) project objectives
• Conclusions so far
• Further Information
Copyright JNT Association 2008
TNC 2008
Introduction & Background
• UK Federation launched November 2006
• Jointly funded by JISC and Becta
• Push from Government
• Estimate 70% of organisations Microsoft / AD network
• Shibboleth installer funded by JISC
Copyright JNT Association 2008
TNC 2008
Why?
• Provide a Wizard Style installer for AD• Help simplify the installation steps• Customer demand• Reduce the complexity and resource
reliance for IdP Installation• Prevalence of Microsoft Windows
Active Directory • Reduce barrier to entry for smaller
institutions to join the UK federation
Copyright JNT Association 2008
TNC 2008
What it Does
• Prompts for a minimal amount of information– These all have sensible defaults
• Installs JAVA, Tomcat & Shibboleth IdP
• Creates installation notes• Creates “to do next” notes“The desire is that you download the installer, accept
the defaults and be 95% done.”
Copyright Edinburgh University 2008
TNC 2008
What you don’t have to do
• Download & configure a shopping list of related packages e.g. Tomcat
• Change Active Directory LDAP schema• Have expert knowledge of Tomcat, Apache
& Active Directory• Have Java, Tomcat, & OpenSSL Installed• Have Apache or IIS installed• Detailed knowledge on how to deploy an IdP
Copyright Edinburgh University 2008
TNC 2008
How it Works
Copyright Edinburgh University 2008
TNC 2008
How it Works
Copyright Edinburgh University 2008
TNC 2008
How it Works
Copyright Edinburgh University 2008
TNC 2008
How it Works
Copyright Edinburgh University 2008
TNC 2008
How it Works
Copyright Edinburgh University 2008
TNC 2008
How it Works
Copyright Edinburgh University 2008
TNC 2008
Testing with TestShib
Copyright Edinburgh University 2008
TNC 2008
What to do Next
• Join a Federation
• Configure access to Active Directory– But not necessarily co-located
• A certificate for the “Browser port”
• Two holes in the firewall
Copyright JNT Association 2008
TNC 2008
Network Topology Considerations
• Must be able to see the Active Directory server’s LDAP and Kerberos Ports.
• Must have ports 8442 and 8443 visible to the Internet.
• Either use a DMZ or tunnel through your firewall.
Copyright Edinburgh University 2008
TNC 2008
Network Topology
AD Server
ShibbolethIdP
SP
User
Kerberos
LDAP
HTTPS(8443)
HTTPS(8442)
Copyright Edinburgh University 2008
TNC 2008
JANET(UK) Project Objectives
• Establish a test bed of JANET sites• Test the initial installation and provide
feedback to the developer• Track identified bugs/deficiencies and test
any subsequent fixes/enhancements• Documentation• Publish installation and configuration
documentation and case studies of the installer
• Establish an ongoing community e-mail support list using expertise gained as part of the project
Copyright JNT Association 2008
TNC 2008
Sites Currently Involved
Highbury College
Coventry University
Swansea College
Swindon College
Edinburgh Telford College
C2K (HP – supported)
Wider participation – Other organisations
Copyright JNT Association 2008
TNC 2008
Time Scales
• Project expected to be complete by August 2008
• Installer available for general release with documentation mid August
• Shib 2.0 version under development• Case studies available on JANET Web
Site – End of August 2008 • A release version, based on Shibboleth
2.0, is planned for the Autumn
Copyright JNT Association 2008
TNC 2008
Conclusions
• Install requires few parameters
• Ideal for organisations with limited resources
• It works!
• 1.3 Beta1 version will be available in near future
Copyright JNT Association 2008
TNC 2008
For further information
Please visit the project website:
http://www.ja.net/development/middleware/shibboleth-on-windows.html
Documentation:
https://spaces.internet2.edu/display/SHIB/IdPActiveDirectory
or Join Mailing List: [email protected]
Further information Email:([email protected])
Copyright JNT Association 2008
TNC 2008
JANET(UK) Shibboleth on
WindowsTrial
TNC May 2008
Questions?
Acknowledgements – Rod Widdowson of SDSS
Copyright JNT Association 2008