Shibboleth authentication - Revision history

Drn@ecs.soton.ac.uk at 16:19, 11 May 2015

2015-05-11T16:19:22Z

← Older revision		Revision as of 16:19, 11 May 2015
Line 1:		Line 1:
	{{Deprecated \| This page is somewhat out of date. Please ~~before~~ to these more ~~update~~ to date [[Shibboleth\|Shibboleth]] instructions.}}		{{Deprecated \| This page is somewhat out of date. Please refer to these more up to date [[Shibboleth\|Shibboleth]] instructions.}}
	==Shibboleth Authentication==		==Shibboleth Authentication==
	'''TIMTOWTDI'''		'''TIMTOWTDI'''

Drn@ecs.soton.ac.uk at 15:23, 11 May 2015

2015-05-11T15:23:40Z

← Older revision		Revision as of 15:23, 11 May 2015
Line 1:		Line 1:
			{{Deprecated \| This page is somewhat out of date. Please before to these more update to date [[Shibboleth\|Shibboleth]] instructions.}}
	==Shibboleth Authentication==		==Shibboleth Authentication==
	'''TIMTOWTDI'''		'''TIMTOWTDI'''

Tdb01r at 11:55, 12 August 2009

2009-08-12T11:55:25Z

← Older revision		Revision as of 11:55, 12 August 2009
Line 206:		Line 206:

	'''NOTE''': You will almost certainly want to process <code>$puid</code> and <code>$orgid</code> in some way, but that is all post authentication		'''NOTE''': You will almost certainly want to process <code>$puid</code> and <code>$orgid</code> in some way, but that is all post authentication

			[[Category:Authentication]]

Kiz at 13:50, 5 May 2008

2008-05-05T13:50:14Z

← Older revision		Revision as of 13:50, 5 May 2008
Line 2:		Line 2:
	'''TIMTOWTDI'''		'''TIMTOWTDI'''
	(There Is More That One Way To Do It)		(There Is More That One Way To Do It)

	~~====This is a work in progress====~~
	~~There are still errors in the fine detail, but the basic concept it valid~~

	This is the system I implemented for using with the UK Access management Federation (which is a Shibboleth implimentation).		This is the system I implemented for using with the UK Access management Federation (which is a Shibboleth implimentation).

Kiz: /* Using the code */

2008-05-05T13:49:33Z

Using the code

← Older revision		Revision as of 13:49, 5 May 2008
Line 204:		Line 204:
	}		}

	$~~v->{~~puid} = $authorise->{'userID'};		$puid = $authorise->{'userID'};
	$orgid = $authorise->{'~~edinaOrgID~~'};		$orgid = $authorise->{'orgID'};
	</pre>		</pre>

			'''NOTE''': You will almost certainly want to process <code>$puid</code> and <code>$orgid</code> in some way, but that is all post authentication

Kiz: /* Using the code */

2008-05-05T13:47:26Z

Using the code

← Older revision		Revision as of 13:47, 5 May 2008
Line 204:		Line 204:
	}		}

	$v->{puid} = $authorise->{'~~edinaUserID~~'};		$v->{puid} = $authorise->{'userID'};
			$orgid = $authorise->{'edinaOrgID'};
	</pre>		</pre>

Kiz: /* The ''context URL'' */

2008-05-05T13:41:36Z

The ''context URL''

← Older revision		Revision as of 13:41, 5 May 2008
Line 126:		Line 126:
	===The ''context URL''===		===The ''context URL''===
	The script for reading the authentication details needs to be within the EPrints server, and ideally protected by a secure (<code>https</code>) connection.		The script for reading the authentication details needs to be within the EPrints server, and ideally protected by a secure (<code>https</code>) connection.

			I called mine <code>/cgi/shibb</code> (not very imaginative, but what the heck). If you have the script behind an https connection, it probably won't be in <code>/cgi</code>...

	The actual code is very simple: get the EPrints session code from the EPpints cookie, and use that as the index for the data supplied by the Shibboleth authentication server.		The actual code is very simple: get the EPrints session code from the EPpints cookie, and use that as the index for the data supplied by the Shibboleth authentication server.

Kiz: /* The Authentication routine */

2008-05-05T13:39:09Z

The Authentication routine

← Older revision		Revision as of 13:39, 5 May 2008
Line 76:		Line 76:
	my ($session) = @_;		my ($session) = @_;

	my $~~authentication_point~~ = ~~'https://Your.Shibb.Authentication.Point/with/path'~~;		my $DEBUG = 0;
	my $code;		my $code;
			my $orgid;
	my $puid;		my $puid;
	~~my $orgid;~~

	if (! $session->have_parameters)		if (! $session->have_parameters)
	{		{
	my $args = $session->{'request'}->args();		my $args = $session->{'request'}->args();
	$args =~ /code=(.*?)[&;\b]/;		$args =~ /code=(.*?)[&;\b]/;
	$secret_code = $1; # $r->param('secret_code');		$secret_code = $1; # $r->param('secret_code');
Line 92:		Line 92:
	my $ath_returl = $session->get_full_url;		my $ath_returl = $session->get_full_url;

	unless ($secret_code) {		unless ($secret_code)
			{
	my $code = EPrints::Apache::AnApache::cookie( $session->get_request, "eprints_session" );		my $code = EPrints::Apache::AnApache::cookie( $session->get_request, "eprints_session" );
	$ath_returl .= "&code=$code"; # append parameter to URL		$ath_returl .= "&code=$code"; # append parameter to URL

	redirect(		redirect(
	url => '~~$authentication_point~~',		url => 'YourURLHere',
	params => {		params => {
	context => $ath_returl,		context => $ath_returl,
Line 106:		Line 106:

	}		}

	($puid, $orgid) = $session->{database}->get_auth_puid( $secret_code );		($puid, $orgid) = $session->{database}->get_auth_puid( $secret_code );

	return unless $puid;		return unless $puid;

	my %return_hash = (		my %return_hash = (
	~~UserID~~ => $puid,		userID => $puid,
	~~OrgID~~ => $orgid,		orgID => $orgid,
	);		);

	return \%return_hash;		return \%return_hash;

	}		}
	</pre>		</pre>

Kiz: /* The ''context URL'' */

2008-05-05T13:36:09Z

The ''context URL''

← Older revision		Revision as of 13:36, 5 May 2008
Line 131:		Line 131:

	The actual code is very simple: get the EPrints session code from the EPpints cookie, and use that as the index for the data supplied by the Shibboleth authentication server.		The actual code is very simple: get the EPrints session code from the EPpints cookie, and use that as the index for the data supplied by the Shibboleth authentication server.
			We store the user identification details in a table and not pass them via a URL as this minimises the opportunities for spoofing an authenticated user.

	<pre>		<pre>

Kiz: /* The Authentication routine */

2008-05-05T13:33:18Z

The Authentication routine

← Older revision		Revision as of 13:33, 5 May 2008
Line 79:		Line 79:
	my $code;		my $code;
	my $puid;		my $puid;
			my $orgid;

	if (! $session->have_parameters)		if (! $session->have_parameters)
Line 106:		Line 107:
	}		}

	$puid = $session->{database}->get_auth_puid( $secret_code );		($puid, $orgid) = $session->{database}->get_auth_puid( $secret_code );

	return unless $puid;		return unless $puid;
Line 112:		Line 113:
	my %return_hash = (		my %return_hash = (
	UserID => $puid,		UserID => $puid,
			OrgID => $orgid,
	);		);