Shibboleth Developers

[Tom Barton <>]

Does this use case really belong in the realm of virtual organization 
management systems? I think JISC is being funded to look into such matters.

Tom

Thomas Lenggenhager wrote:

> I'd like to propose a use case which is not very well covered
> with the current Shibboleth implementation.
>
> Origin Independent Groups of Users
> ==================================
> Let us assume there is a distributed research team made up of a few
> groups of researchers, each located at a university already equipped
> with a Shibboleth origin installation and all are part of the same
> federation.
>
> This research team wants to protect access to their Shibboleth enabled
> web server to members of their teams.
>
>
> How to solve that case with the current Shibboleth?
> ===================================================
> With the existing Shibboleth they would have to use a unique ID like
> the eduPersonPrincipalName and list all the EPPNs of their team members
> in the target authorization. This is not a really user-friendly way
> of configure it and does not scale well for groups beyond 10 people.
>
>
> Idea for a Possible Addition to Shibboleth Resource Manager
> ===========================================================
>  - The Shibboleth Resource Manager would have to support the use of
>    an origin independent Group Management Server (GMS) which would
>    act similarly to an AA server.
>
>  - From the authorization config, the target fetches the URL of the
>    GMS to verify whether the person with the EPPN provided (instead
>    of a handle) is member of the group specified.
>    The answer of the GMS would just be a YES or NO assertion.
>
>  - A GMS itself should include a Shibboleth protected web server,
>    however, its additional functionalities are not directly linked
>    with Shibboleth.
>
>    - Setting-up a new group
>      A group admin gets authorized to configure a new group on the GMS.
>      The group admin is able to approve additional members.
>
>    - Adding members to a group
>      The group admin invites potential members to join the group by
>      providing them a URL under which they can apply for subscribtion.
>      By contacting that URL, the user provides the EPPN as well as some
>      further attributes which allow the group admin to decide on
>      membership for that user.
>      By accepting the user, the EPPN gets added to the list of members
>      and is therefore available for future tests on group membership.
>
> Sure you have further solutions in mind for that use case.
>
>
> I think support for groups made up of people from more than one origin
> site will become a need as soon as Shibboleth is deployed wider and
> through an extension of Shibboleth tackling that we could increase its
> usefulness.
>
> For authorizing groups, the current Shibboleth heavily depends on
> eduPersonEntitlement which is a way for official groups of people
> belonging to one origin site only or for cases like JSTOR where an
> important information supplier defines which value to use.
> Smaller or more ad-hoc groups of people will not easily be able to
> get their special entitlement value into the attribute database of
> the origin site.
>
> Thomas
> _____________________________________________________
> Thomas Lenggenhager             
> SWITCH         The Swiss Education & Research Network
> Limmatquai 138                    Tel: +41 1 268 1520 
> CH-8001 Zurich, Switzerland       Fax: +41 1 268 1568