Assessing Shibboleth as a means of authenticating and
authorizing access to electronic scholarly publications. A
DLF/CNI workshop
Peter Brantley (NYU), D Greenstein (DLF), Clifford Lynch
(CNI)
February 2, 2002
Introduction
Shibboleth
has been proposed by Internet2 as a technology to
support inter-institutional authentication and authorization for
access to Web pages. Its intent is to support, as much as
possible, the heterogeneous security systems in use on campuses
today, rather than mandating use of particular schemes like
Kerberos or X.509-based PKI.
The technology is intended as a generic one and as such has
yet to be evaluated in any particular applied domain.
The purpose of this workshop is to evaluate Shibboleth as a
possible technology for authenticating and authorizing access to
electronic scholarly publications
This document provides a problem statement that will frame
workshop discussion
Problem statement
In the academic and business worlds, there is rapidly growing
interest in resource-sharing among institutions and the
concomitant need to manage access to many of those resources. In
academia, the focus is on inter-university collaboration to
support both research and education, and the access of licensed
information resources from external content-holding
organizations.
Shibboleth, a joint project of Internet2 and IBM, is
developing an architectural framework and an associated
open-source software prototype to support inter-institutional
resource sharing subject to access restrictions. Shibboleth
enables the secure exchange of interoperable authorization
information, working hand-in-hand with existing campus-level
authentication systems. Shibboleth combines a high level of
granularity over the release of user attributes with robust
logging support, meeting both academic expectations for privacy
and publisher needs for accountability.
Developed within a framework of industry-supported security
standards, such as SAML for attribute assertion, Shibboleth does
not impose client-side software requirements aside from a common
web browser. Its component-based design delivers a low overhead
and a rapid implementation for content-providers and
universities.
Now that the project has reached a stable architectural stage
and coding is commencing, the DLF and CNI are inviting a cross
section of publishers and resource providers to comment on the
design and goals of Shibboleth.
return to top >> |
