Date post: | 01-Jan-2016 |
Category: |
Documents |
Upload: | crystal-adams |
View: | 218 times |
Download: | 2 times |
Using Shibboleth to provide authenticated access for CSU Faculty, Staff, and Students
on the SBCC campus Wifi network.
Michael GhensInformation Systems SpecialistSanta Barbara City College
The RequestHow do we allow Faculty, Staff and Students from another institution access Santa Barbara City College’s Wi-Fi with verification without creating local accounts.
Both Santa Barbara City College and CSU Channel Islands have Shibboleth Identity Solutions and belong to the InCommon Federation
FederationBoth SBCC and CSUCI belong to Incommon Federation Which allows secure exchange of metadata
The InCommon Federation is the U.S. education and research identity federation, providing a common framework for trusted shared management of access to on-line resources. Through InCommon, Identity Providers can give their users single sign-on convenience and privacy protection, while online Service Providers control access to their protected resources.
Existing EnvironmentOn SBCC’s Side
Aruba Wireless Infrastructure:• Aruba Controller• Active Directory• Shibboleth• LDAP• XML
Tasks• Metadata agreements with CSUCI• What attributes to be provided (UID, SN,
givenName,Mail).• Create Shibbolized Captive Portal for Aruba
Controller• Set up embedded Shibboleth directory
service• Create Backend authentication logic• Log user logins
Setting up Shibboleth SP as Captive Portal
• Apache web server• Shibboleth module• PHP• Embedded Directory Service• Configuring Aruba for external
authentication (XML add_user after user verification)
SyslogMar 8 12:45:15 wfsp FEDAUTH[701]: ************* logged in with role: student from: https://mckinley.csuci.edu/idp/shibbolethMar 8 13:20:22 wfsp FEDAUTH[1428]: ************* logged in with role: student from: https://mckinley.csuci.edu/idp/shibbolethMar 8 13:45:42 wfsp FEDAUTH[2044]: ************* logged in with role: student from: https://mckinley.csuci.edu/idp/shibboleth2013-03-08 12:45:15 INFO Shibboleth-TRANSACTION [120519]: uid (1 values)2013-03-08 12:45:15 INFO Shibboleth-TRANSACTION [120519]: sn (1 values)2013-03-08 12:45:15 INFO Shibboleth-TRANSACTION [120519]: givenName (1 values)2013-03-08 12:45:15 INFO Shibboleth-TRANSACTION [120519]: mail (1 values)2013-03-08 12:45:15 INFO Shibboleth-TRANSACTION [120519]: }2013-03-08 13:20:22 INFO Shibboleth-TRANSACTION [120521]: New session (ID: _7a2287c22a43d1dce53e1fb566fa9b67) with (applicationId: default) for principal from (IdP: https://mckinley.csuci.edu/idp/shibboleth) at (ClientAddress: 10.1.65.53) with (NameIdentifier: _e73e638370aa1e8fe3fa89ae77087838) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from
(AssertionID: _5d8800710f2611c58a7156cefa8e1a83)
Issues
• Session Time Outs• Coordination of infrastructure changes• A more relax captive portal rules