collective.shibboleth 1.1

Configuring Shibboleth for the EDS

Follow the instructions on the Shibboleth Wiki at https://wiki.shibboleth.net/confluence/display/EDS10/3.+Configuration under Configuing the Service Provider. Your configuration may need to differ from the instructions given. The one mandatory configuration step is setting up the DiscoveryFeed handler.

Your EDS configuration options (set in idpselect_config.js) are configured within Plone when you create the Shibboleth EDS portlet.

Shibboleth authentication configuration

There are two ways you can authenticate users to your site using Shibboleth: either actively, by forcing a session for certain resources, or passively, by only passing through authentication information if a session exists. More information about this in terms of Shibboleth can be found at https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent.

In a Plone context, using collective.shibboleth, you thus have two choices:

1. Configure Shibboleth and your front-end webserver to be passively aware of your application. After an authentication session has been created, session details will automatically be added to incoming requests for Plone to accept; or

2. Configure Shibboleth and your front-end webserver to require a session for all or part of your site’s URLs. When a user visits the relevant URL or path, authentication will be requested and the user redirected to the relevant Discovery Service.

How Plone handles this authentication

The first option above is able to be more seamless as you can utilise a EDS login portlet inside Plone, rather than having a jarring jump to a Discovery Service or WAYF page.

By default, the underlying PAS plugin (Products.AutoUserMakerPASPlugin) that listens for Shibboleth headers is configured to accept these on any site URL. For a default Plone install, a plone.session PAS plugin is configured (the one that normally handles authentication), and this will create a session and take over authentication from here on out whilst a user is logged in.

To most efficiently manage this, the suggestion is to configure Shibboleth to protect just the logged_in view for Plone, and configure this URL as the return point (either via the EDS portlet, or via a URL parameter). The EDS portlet will default to this automatically (but can be customised). This way, you can be sure that Shibboleth attributes will only be passed into Plone when the user accesses this specific path. As this path is typically only used during login, you’ll be reducing the load time and processing required for the rest of the user’s session.

The suggested flow is thus:

1. Configure Shibd Discovery Handler and protect /logged_in path with Shibboleth.

2. Install this package in Plone and configure the Shibboleth EDS portlet on the pluggable login page.

Now, when the user comes along:

1. User clicks Login in Plone

2. User is shown the EDS portlet, consisting of a list of Identity Providers (IdPs)

3. User selects an IdP and is taken to the IdP login page, or redirected transparently if the user is already authenticated with their IdP.

4. User is redirected back to Plone and logged in automatically. Behind the scenes, Shibboleth has injected the attributes into the user’s request to logged_in and Products.AutoUserMakerPASPlugin has created that user an account.

The user’s session has now been created and they’re ready to use Plone without relying on Shibboleth attributes.

About the included Embedded Discovery Service (EDS)

This package uses the Shibboleth EDS as provided by the main Shibboleth project. Distributions of the EDS are available at http://download.opensuse.org/repositories/security:/shibboleth/ and the source is available from http://svn.shibboleth.net/view/js-embedded-discovery/.

The EDS is configurable as the Shibboleth login portlet. This portlet can be added to any page, though is most useful on the pluggable login page that is configured by this package.

The included EDS distribution has been customised using the included patch file (src/collective/shibboleth/browser/shibboleth-ds-plone.patch) in the following ways:

• Allow configuration of the EDS using a data-options attribute on the DOM element. Typically, the configuration function had to edited by hand.

• Adjust or remove some styles that conflict with Plone’s defaults.

The patch is primarily required because the idpselect_config.js file hard-codes a large structure of language information. We are working with the Shibboleth project on improving their JavaScript and incorporating the patch back upstream.

For now, to reapply the patch to a new version of the EDS, do:

cd src/collective/shibboleth/browser/
patch -p5 < shibboleth-ds-plone.patch
# Commit the result once patch is checked

David Beitey, Author

1.1 (2015-05-20)

• Nothing changed yet.

1.0 (2015-05-20)

• Upgrade EDS to r151 for recent bug fixes. [davidjb]

• Assign a portlet onto the Pluggable Login page on installation. [davidjb]

• Change from a Embedded WAYF to Shibboleth’s EDS. [davidjb]

• Remove old collective.aaf code from this package; that package now depends on this one. [davidjb]

• Refactor from collective.aaf, and turn collective.aaf into an AAF-specific layer on top of this package. [davidjb]