home contents changes issues options help subscribe edit

last edited 5 years ago by brian

What are the core components of a Shibboleth installation? What will origin universities and target resources need to set up?

There are 5 "core" components of Shibboleth. They are intended to be implementable as stand-alone servers but in practice some of them may be combined.

  1. The Shibboleth initiation request server (SHIRE) is installed at the target resource and initiates the Shibboleth interaction. It starts with the WAYF (see below) and acquires a "handle" by which inquiries about the user can be submitted to the campus’s Attribute Authority.
  2. The "Where Are You From" (WAYF) server asks the user to identify their local authentication domain, e.g. MIT or Dartmouth or UC Berkeley. The idea is to support "fuzzy matching" so that a variety of responses can be mapped to the appropriate campus domain. The WAYF could be a generalized service or could be part of a SHIRE.
  3. The Shibboleth Handle Server (HS) is part of a campus security domain. Its role it to supply an abstract "handle" by which queries can be submitted about a user. This is intended to preserve privacy and anonymity as needed.
  4. The Shibboleth Attribute Requester (SHAR) at the target resource uses the handle provided by the SHIRE (above) to submit requests for the user’s authorization attributes. It uses a well-defined XML-based syntax for this. Semantics have been defined for an initial set of queries. The dialogue is patterned after the OASIS SAML design.
  5. The Shibboleth Attribute Authority (AA) associated with the campus security domain responds to queries from the SHAR. It respects the institution's default information release policies and a user's information release preferences.

Besides the HS and the AA, a university will need a robust campus-wide user authentication system and an enterprise directory holding attributes about its community members.

The resource site will need to integrate the SHIRE and the SHAR with their web server system. The WAYF could be run at the resource site or could be a generalized server run for the Shibboleth community.




subject:
  ( 4 subscribers )