Discovery Service Options

Transcription

1 Discovery Service Options SWITCHaai Team The classic way: One per Federation achieves high availability through redundancy and IP Anycast. 2

2 Alternatives to Central Direct Login URLs SWITCH Embedded Shibboleth Embedded Discovery Service EDS 3 Solution 1: Direct Login URLs A separate login link for a specific IdP 1 click direct redirect to IdP without going via Useful when only users of few IdPs use resource 4

3 Composing Login URLs 5 Solution 2: Embedded 6

4 Embedded 7 Embedded Embed on Web Application customize look and feel still transparently uses central 8

5 Information and Configuration More information about the Embedded : Generate the Embedded code for your SP: 9 Configuration Configuration Example of Embedded! //ExampleofhowtoaddIdentityProviderfromotherfederations varwayf_additional_idps=[ {name:esslingenuniversityofappliedsciences, entityid: logourl: }, {name:dalarnauniversity, entityid: logourl: } ]; 10

6 Configuration (2) Configuration Example of Embedded //EntityIDsofIdentityProviderthatshouldnotbeshownatall //[Optional,commentedoutbydefault] varwayf_hide_idps=newarray( //CategoriesofIdentityProviderthatshouldnotbeshown //Possiblevalues are:university,uas,hospital,library,vho,others,all varwayf_hide_categories=newarray(library,vho,others,hospital);!! 11 Enable JSON Discovery feed to use local metadata of SP SP In shibboleth2.xml: <Sessionslifetime=28800 timeout=3600 relaystate=ss:mem checkaddress=false consistentaddress=true handlerssl=true cookieprops=https>... <!FFJSONfeedofdiscoveryinformation.FF> <Handlertype=DiscoveryFeedLocation=/DiscoFeed/> </Sessions> 12

7 JSON Discovery feed example SP [ { entityid: DisplayNames: [! { value: Universita della Svizzera Italiana, lang: en },! { value: Universita della Svizzera Italiana, lang: it }! ]! },! { entityid: DisplayNames: [! ]! { value: Université de Lausanne Test, lang: en },! { value: Université de Lausanne Test, lang: fr }! ],! 13 Configuration (3) Configuration Example of Embedded! //WhethertoloadIdentityProvidersfromtheDiscoveryFeedprovidedby //theserviceprovider. //IdPsthatarenotlistedintheDiscoveryFeedandthattheSPthereforeis //notabletoacceptassertionsfrom,arehiddenbytheembedded //IdPsthatareintheDiscoveryFeedbutareunknowntotheSWITCHwayf //areaddedtothewayf_additional_idps. //Thelistwayf_additional_idpswillbesortedalphabetically //TheSPmusthaveconfiguredthediscoveryfeedhandlerthatgeneratesa //JSONobject.Otherwiseitwon'tgeneratetheJSONdatacontainingtheIdPs. //[Optional,default:false] varwayf_use_disco_feed=true; 14

8 Solution 3: Embedded Discovery Service EDS Requires the Discovery Feed provided by the SP Embed the DS directly into the service Search-as-you-type or select from list JavaScript, CSS and HTML only developed and maintained by the Shibboleth team download from Documentation can be found at: 15 Embedded Discovery Service EDS 16

9 MetadataFilter Example SP In shibboleth2.xml: <MetadataProvidertype=XML...> <MetadataFiltertype=Whitelist> <Include> <Include> <Include> </MetadataFilter> </MetadataProvider> 17 Embedded vs Embedded DS Properties Login Link Embedded EDS Independent from central server Display only valid IdPs for SP ( ) Search as you type feature Show Home Org Logo ( ) Very easy deployment Can be used with old SPs (<2.4) ( ) Categories supported ( ) Uses cached recent IdP selection across different services 18

10 When to use what? Numbers of IdPs Login Link(s) Embedded EDS To mention: Disco Juice Very comprehensive Discovery Service Well suited for services with users from many IdPs Search-as-you-type only Uses Geo IP and metric to guess user s IdP Based on PHP and JS 20