doc/InQueue.html

   1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
   2 <html>
   3         <head>
   4                 <title>InQueue Federation Policy and Configuration Guidelines</title>
   5                 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
   6                 <style type="text/css">
   7
   8                         html
   9                         {
  10                                 background-color: #FFFFFF;
  11                                 color: #000000;
  12                                 margin: .5em;
  13                         }
  14                         a:visited
  15                         {
  16                                 color: #999999;
  17                         }
  18                         a:link
  19                         {
  20                                 color: #990000;
  21                         }
  22                         a:active
  23                         {
  24                                 color: #440000;
  25                         }
  26                         dl
  27                         {
  28                                 background-color: #DDDDDD;
  29                                 background-image: none;
  30                                 margin: 5px;
  31                                 padding: 0px;
  32                                 border-style: solid;
  33                                 border-bottom-width: 2px;
  34                                 border-top-width: 2px;
  35                                 border-left-width: 2px;
  36                                 border-right-width: 2px;
  37                         }
  38                         dt
  39                         {
  40                                 background-color: #DDDDDD;
  41                                 background-image: none;
  42                                 margin: 1px;
  43                                 padding: 1px;
  44                         }
  45                         dd
  46                         {
  47                                 background-color: #DDDDDD;
  48                                 background-image: none;
  49                                 margin: 0px;
  50                                 padding: 1px;
  51                         }
  52                         .attribute
  53                         {
  54                                 font-size: 115%;
  55                                 font-color: #000000;
  56                                 text-align: left;
  57                                 background-color: #DDDDDD;
  58                                 border: 1px black inset;
  59                                 background-image: none;
  60                                 margin: 0px;
  61                                 padding: 2px;
  62                         }
  63                         .value
  64                         {
  65                                 font-color: #000000;
  66                                 text-align: left;
  67                                 background-color: #EEEEEE;
  68                                 background-image: none;
  69                                 padding-top: 0em;
  70                                 padding-bottom: 0.5em;
  71                                 padding-right: 1em;
  72                                 padding-left: 5em;
  73                                 border-style: solid;
  74                                 border-bottom-width: none;
  75                                 border-top-width: none;
  76                                 border-left-width: 1px;
  77                                 border-right-width: 1px;
  78                         }
  79                         .attributeopt
  80                         {
  81                                 font-size: 115%;
  82                                 font-color: #000000;
  83                                 text-align: left;
  84                                 background-color: #BCBCEE;
  85                                 border: 1px black inset;
  86                                 background-image: none;
  87                                 margin: 0px;
  88                                 padding: 2px;
  89                         }
  90                         .valueopt
  91                         {
  92                                 font-color: #000000;
  93                                 text-align: left;
  94                                 background-color: #DDDDFF;
  95                                 background-image: none;
  96                                 padding-top: 0em;
  97                                 padding-bottom: 0.5em;
  98                                 padding-right: 1em;
  99                                 padding-left: 5em;
 100                                 border-style: solid;
 101                                 border-bottom-width: none;
 102                                 border-top-width: none;
 103                                 border-left-width: 1px;
 104                                 border-right-width: 1px;
 105                         }
 106                         .attributelong
 107                         {
 108                                 font-size: 85%;
 109                                 font-color: #000000;
 110                                 text-align: left;
 111                                 background-color: #DDDDDD;
 112                                 border: 1px black inset;
 113                                 background-image: none;
 114                                 margin: 0px;
 115                                 padding: 2px;
 116                         }
 117                         .attributeoptlong
 118                         {
 119                                 font-size: 85%;
 120                                 font-color: #000000;
 121                                 text-align: left;
 122                                 background-color: #BCBCEE;
 123                                 border: 1px black inset;
 124                                 background-image: none;
 125                                 margin: 0px;
 126                                 padding: 2px;
 127                         }
 128                         .demo
 129                         {
 130                                 background-color: #EEEEEE;
 131                                 padding: 3px;
 132                         }
 133                         .fixedwidth
 134                         {
 135                                 font-family: monospace;
 136                                 font-size: 90%;
 137                                 font-color: #121212;
 138                         }
 139
 140                 </style></head><body link="red" vlink="red" alink="black" bgcolor="white">
 141                 InQueue Federation Policy and Configuration Guidelines<br>
 142                 draft-internet2-inqueue-guidelines-02.html<br>
 143                 Nate Klingenstein<br>
 144                 RL 'Bob' Morgan<br />
 145                 2003-06-17<br>
 146
 147                 <h3>InQueue Federation Policy and Configuration Guidelines</h3>
 148
 149                 <h4>1.  Introduction to InQueue</h4>
 150                 <blockquote><p>
 151                         The InQueue Federation, operated by Internet2, is designed for
 152                         organizations that are becoming familiar with the Shibboleth software
 153                         package and the federated trust model.  InQueue provides the basic
 154                         services needed for a federation using Shibboleth:</p>
 155
 156                         <ul>
 157                                 <li>maintenance and distribution of participating site description and
 158                                 security files;</li>
 159                                 <li>a central WAYF ("where are you from") web site;</li>
 160                                 <li>specification of operational procedures and policies, including
 161                                 user data (attribute) definitions; and</li>
 162                                 <li>example target and origin sites with which to test
 163                                 interoperability.</li>
 164                         </ul>
 165
 166                         <p>Participating in InQueue permits an organization to learn about the
 167                         Shibboleth software via the experience of multi-party federated access,
 168                         while integrating its services into the organization's procedures and
 169                         policies.</p>
 170
 171                         <p>The InQueue federation is specifically <b>not</b> intended to support
 172                         production-level end-user access to protected resources.  Organizations
 173                         operating target sites are strongly discouraged from making sensitive or
 174                         valuable resources available via the Federation.</p>
 175                 </blockquote>
 176
 177                 <h4>2.  InQueue Policies</h4>
 178
 179                 <h4>2.1  Participation</h4>
 180
 181                 <blockquote><p>An organization may join InQueue as an origin, as a
 182                         target, or both.
 183                         Participants are expected to be authorized representatives of
 184                         their organization.  Internet2 reserves the right to make final
 185                         decisions about participation in the Federation.</p>
 186
 187                         <p>Participation in the Federation is limited to the period during which
 188                         an organization is learning about Shibboleth and federated operations.  Upon
 189                         completion of this period, the organization is expected to join a
 190                         Federation (or some other management solution) that meets its long-term
 191                         operational needs.
 192                         </p></blockquote>
 193
 194                         <h4>2.2  Data management</h4>
 195
 196                         <blockquote><p>
 197                                 By participating, origins agree that all attributes sent
 198                                 to targets in the Federation to the best of their knowledge accurately
 199                                 represent information about the authenticated individual accessing the
 200                                 target resource.</p>
 201
 202                                 <p>Targets agree to dispose of all received
 203                                 attributes properly by not mis-using them, aggregating them, or
 204                                 sharing them with other organizations.</p></blockquote>
 205
 206                         <h4>2.3  Security management</h4>
 207
 208                         <blockquote><p>InQueue distributes a set of root certificates for
 209                                 issuers from which server certificates may be obtained to identify
 210                                 InQueue server components.
 211                                 Additionally, sites with certificates not rooted
 212                                 in one of these trusted roots may have these certificates added to the
 213                                 appropriate trust file.  Targets must have a certificate signed by an
 214                                 acceptible CA.  The list of certificate authorities used by
 215                                 InQueue is:</p>
 216                                 <ul type="circle">
 217                                         <li><a href="http://www.verisign.com/">Verisign/RSA Secure Server CA</a></li>
 218                                         <li><a href="http://bossie.doit.wisc.edu/cert/i2server">Internet2
 219                                                 HEPKI Test CA</a></li>
 220                                         <li><a href="http://www.cren.net/crenca/">CREN CA</a></li>
 221                                 </ul>
 222                         </blockquote>
 223
 224                         <h4>2.4  Attributes</h4>
 225                         <blockquote><p>The InQueue
 226                                 Federation specifies a set of attribute definitions to support basic
 227                                 attribute-based authorization.
 228                                 If a Federation member sends or receives an Attribute Assertion
 229                                 containing the InQueue policy uri and referencing one of the listed
 230                                 attributes,
 231                                 the syntax and semantics of the associated attribute value should
 232                                 conform
 233                                 to the definitions specified in the <a href="http://www.educause.edu/eduperson/">EduPerson specification 2002/10</a>
 234                                 </p>
 235
 236                                 <ul type="circle">
 237                                         <li>eduPersonPrincipalName</li>
 238                                         <li>eduPersonEntitlement</li>
 239                                         <li>eduPersonAffiliation (expressed in a slightly different form via
 240                                         a new attribute called eduPersonScopedAffiliation)</li>
 241                                 </ul>
 242                         </blockquote>
 243
 244                         <h4>3.  Joining InQueue</h4>
 245
 246                         <blockquote><p>To join InQueue, origins <a href="mailto:shib-support@internet2.edu?subject=Shib%20Origin%20Site%%0D%20%2020Application"> submit a request to
 247                                         shib-support@internet2.edu</a> containing the following
 248                                 information:</p></blockquote>
 249
 250                         <blockquote>
 251                                 <ul type="circle">
 252                                         <li>Domain Name of the origin site (e.g., Ohio State's is
 253                                         "osu.edu").</li>
 254                                         <li>Complete URL to access the Shibboleth Handle Service at the site.</li>
 255                                         <li>The CN (usually the hostname) of the HS's certificate's subject.
 256                                         This should also be the value of <span class="fixedwidth">edu.internet2.middleware.shibboleth.hs.
 257                                                 HandleServlet.issuer</span> in <span class="fixedwidth">origin.properties</span>.</li>
 258                                         <li>Any shorthand aliases the WAYF should support for the origin
 259                                         site (e.g., Ohio State, OSU, Buckeyes)</li>
 260                                         <li>Contact names and addresses for technical and administrative
 261                                         issues.</li>
 262                                         <li>The URL of an error page that users selecting this origin from
 263                                         the WAYF may be referred to by targets if Shibboleth
 264                                         malfunctions. (optional)</li>
 265                                         <li>If the HS's certificate is not issueed by one of the root CAs
 266                                         used
 267                                         by InQueue, then it must be submitted in Base64-encoded DER (aka
 268                                         "PEM") format.</li>
 269                         </ul></blockquote>
 270
 271                         <blockquote><p>To join InQueue, targets must <a href="mailto:shib-support@internet2.edu?subject=Shib%20Target%20Site%%0D%20%2020Application"> submit a basic application to
 272                                         shib-support@internet2.edu</a> containing the following
 273                                 information:</p></blockquote>
 274
 275                         <blockquote>
 276                                 <ul type="circle">
 277                                         <li>The name of the organization</li>
 278                                         <li>Contact names and addresses for both administrative and
 279                                         technical purposes</li>
 280                                 </ul>
 281                         </blockquote>
 282
 283                         <h4>4.  Configuration for Using InQueue</h4>
 284
 285                         <blockquote><p>Once your site is accepted into and added to InQueue,
 286                                 the following configuration parameters must be entered to ensure
 287                                 interoperability and compliance with federation guidelines.  Consult
 288                                 the Shibboleth Deploy Guides for further information on these fields
 289                                 and on <span class="fixedwidth">origin.properties</span> and <span class="fixedwidth">shibboleth.ini</span>.</p></blockquote>
 290
 291                         <blockquote><h5>4.a. Origins:</h5>
 292
 293                                 <dl><dd class="attribute"><span class="fixedwidth">edu.internet2.middleware.shibboleth.hs.HandleServlet.siteName</span>
 294                                         </dd><dd class="value"><p>Must be populated with a URI that will
 295                                         be assigned by InQueue when you are accepted into the
 296                                         federation.</p></dd><dd class="attribute"><span class="fixedwidth">edu.internet2.middleware.shibboleth.audiences</span>
 297                                         </dd><dd class="value"><p>This field must contain InQueue's <span class="fixedwidth">urn:mace:inqueue</span> URI, and may contain other federation URIs as well.</p></dd></dl>
 298                                 </blockquote>
 299
 300                                 <blockquote><h5>4.b. Targets:</h5>
 301
 302                                         <dl><dd class="attribute"><span class="fixedwidth">wayfURL</span>
 303                                                 </dd><dd class="value"><p>This field must be set to InQueue's simple WAYF at <span class="fixedwidth">https://wayf.internet2.edu/InQueue/WAYF</span>.</p></dd><dd class="attribute"><span class="fixedwidth">[policies]</span>
 304                                                 </dd><dd class="value"><p>This section must contain <span class="fixedwidth">InQueue = urn:mace:inqueue</span>, and may
 305                                                 contain other federation name/value pairs as well.</p></dd>
 306                                         </dl>
 307                                 </blockquote>
 308
 309                                 <blockquote><h5>4.b.i. Refreshing Federation Metadata:</h5>
 310                                         <p>Once your target site is accepted into the InQueue federation, it is necessary that you periodically
 311                                         update the target's federation metadata.  This metadata includes information used to identify and authenticate
 312                                         InQueue sites.</p>
 313
 314                                         <p>InQueue's metadata is digitally signed, so the first step is to obtain the InQueue signing certificate.
 315                                         It can be downloaded from <span class="fixedwidth">http://wayf.internet2.edu/InQueue/internet2.pem
 316                                         </span> and has a fingerprint of:</p>
 317                                         <p><span class="fixedwidth">b4 42 6c 1e 8b 7d 8e b3 68 03 00 e4 c4 57 dd 74 89 f8 9a 80</span>.</p>
 318
 319                                         <p>The following commands can be used to obtain the federation's metadata:</p>
 320                                         <p><span class="fixedwidth"> $ cd /opt/shibboleth/etc/shibboleth</span></p>
 321                                         <p><span class="fixedwidth">$ ../../bin/siterefresh --url http://wayf.internet2.edu/InQueue/sites.xml
 322                                                 --out sites.xml --cert internet2.pem</span></p>
 323                                                 <p><span class="fixedwidth">$ ../../bin/siterefresh --url http://wayf.internet2.edu/InQueue/trust.xml
 324                                                         --out trust.xml --cert internet2.pem</span></p>
 325                                 </blockquote>
 326
 327                                 <h4>5.  Testing</h4>
 328                                 <blockquote><p>A <a href="https://wayf.internet2.edu/shibboleth/sample.jsp">sample shibboleth target</a>
 329                                         is available for testing newly installed origin sites.  New targets can make use of a sample origin,
 330                                         which is listed as "Example State University" on the InQueue WAYF ( Username: demo / Password: demo ).</p></blockquote>
 331
 332                 </body></html>
 333