Download Slide 1

Web Services Tiered Internet
Authorization (WSTIERIA)
21 June 2011
Fiona Culloch
[email protected]
Output 1: Digimap changes
• Modified production Digimap service
– To give non-browser GIS clients (ArcView
etc.)
• Access to Digimap data via web services
• Using OGC standards (Web Map Service etc.)
• UK federation authentication of registered
users, with SSO
• As alternative to large downloads of raw data
Output 2: DIY instructions
• Short document (7 pages) on “how-to”
– Control access to existing web services
– From non-browser clients
– Without modifying the web service
– Implementable by average sysadmin
– Using only off-the-shelf software
• Apache web server (with mod_rewrite)
• A little scripting (perl, or anything else)
Output 3: Try Shibboleth delegation
• Set up dev & test environment
– PM1: Eclipse + Maven2
– VM1: IdP + delegation plugin
– VM2: example client (JSP) + Shib SP1 + JASIG
delegation library
– PM2: example web service (WSP) + Shib SP2
• “Hello, world”-level success!
– User goes to JSP/SP1, logs in at IdP
– JSP calls JASIG library to GET from WSP/SP2
– Lib accesses SP2 using delegatable token from
IdP; user does not need to log in to SP2
Successes
• Production service (Digimap) using UK
fed. for non-browser web services
• Route to interoperation of unmodified
web services, unmodified non-browser
clients with UK federation
• Demonstrated deployability of new
Shibboleth delegation software by
developer outside the Shibboleth team
Lesson 1: Delegation limitations
• Delegation depends on IdP & all SPs
– Supporting SAML2, bits of Liberty
– SP implementation (Shibboleth 2.2+)
• IdP deployer must explicitly name:
– SP entities allowed to delegate
– SP entities they can delegate to, etc, etc.
• Probably rules out cross-organisational
scenarios for now, leaving
– Intra-org applications (e.g. student portal)
Lesson 2: uPortal not needed
• Original delegation use case was
uPortal web app invoking portlets
• Wasn’t known if delegation library
depended on this uPortal context
• Project showed how a non-uPortal web
app (JSP) can use delegation library
Lesson 3: Delegation & UK federation
• Potential issue identified
– UK federation (& others, e.g. InCommon)
moving from CAs to self-signed trustfabric certs
– Delegation library rejects these because
not in std. Java CA trust list
– Reported to developer (Unicon), response
awaited
Failures
• No deployments outside EDINA
• No future external partner identified
• Attempt to apply the simple Apache +
scripting technique to WebDAV
– Limited success (only easy cases worked)
– Protocol with server URLs in data &
headers defeats simple technique
– Wrote up experience as tech note
Future
• Shibboleth developers
– Migrate delegation library into SP code?
– IdP config optionally take delegation
audiences (SP2,…,n) from SP1 metadata
• EDINA
– More interesting examples (INSPIRE?)
• Community
– Apply techniques!