Shibboleth authentication - Revision history

Drn@ecs.soton.ac.uk at 16:19, 11 May 2015

2015-05-11T16:19:22Z

2015-05-11T15:23:40Z

2009-08-12T11:55:25Z

2008-05-05T13:50:14Z

2008-05-05T13:49:33Z

‎Using the code

2008-05-05T13:47:26Z

‎Using the code

2008-05-05T13:41:36Z

‎The ''context URL''

2008-05-05T13:39:09Z

‎The Authentication routine

2008-05-05T13:36:09Z

‎The ''context URL''

2008-05-05T13:33:18Z

‎The Authentication routine

@@ Line 1: / Line 1: @@
-{{Deprecated | This page is somewhat out of date.  Please before to these more update to date [[Shibboleth|Shibboleth]] instructions.}}
+{{Deprecated | This page is somewhat out of date.  Please refer to these more up to date [[Shibboleth|Shibboleth]] instructions.}}
 ==Shibboleth Authentication==
 '''TIMTOWTDI'''

← Older revision		Revision as of 15:23, 11 May 2015
Line 1:		Line 1:
		+	{{Deprecated \| This page is somewhat out of date. Please before to these more update to date [[Shibboleth\|Shibboleth]] instructions.}}
	==Shibboleth Authentication==		==Shibboleth Authentication==
	'''TIMTOWTDI'''		'''TIMTOWTDI'''

← Older revision		Revision as of 11:55, 12 August 2009
Line 206:		Line 206:

	'''NOTE''': You will almost certainly want to process <code>$puid</code> and <code>$orgid</code> in some way, but that is all post authentication		'''NOTE''': You will almost certainly want to process <code>$puid</code> and <code>$orgid</code> in some way, but that is all post authentication
		+
		+	[[Category:Authentication]]

@@ Line 2: / Line 2: @@
 '''TIMTOWTDI'''
 (There Is More That One Way To Do It)
 This is the system I implemented for using with the UK Access management Federation (which is a Shibboleth implimentation).

@@ Line 204: / Line 204: @@
+      }
-      $v->{puid} = $authorise->{'userID'};
+      $puid  = $authorise->{'userID'};
-      $orgid     = $authorise->{'edinaOrgID'};
+      $orgid = $authorise->{'orgID'};
 </pre>

@@ Line 126: / Line 126: @@
 ===The ''context URL''===
 The script for reading the authentication details needs to be within the EPrints server, and ideally protected by a secure (<code>https</code>) connection.
 The actual code is very simple: get the EPrints session code from the EPpints cookie, and use that as the index for the data supplied by the Shibboleth authentication server.

@@ Line 76: / Line 76: @@
     my ($session) = @_;
-    my $authentication_point = 'https://Your.Shibb.Authentication.Point/with/path';
+    my $DEBUG = 0;
     my $code;
     my $puid;
     if (! $session->have_parameters)
+    {
-    my $args = $session->{'request'}->args();
+     my $args = $session->{'request'}->args();
       $args =~ /code=(.*?)[&;\b]/;
       $secret_code = $1; # $r->param('secret_code');
@@ Line 92: / Line 92: @@
     my $ath_returl = $session->get_full_url;
-   unless ($secret_code) {
+   unless ($secret_code)
      my $code = EPrints::Apache::AnApache::cookie( $session->get_request, "eprints_session" );
      $ath_returl .= "&code=$code";  # append parameter to URL
      redirect(
-             url => '$authentication_point',
+             url => '**YourURLHere**',
              params => {
                context => $ath_returl,
@@ Line 106: / Line 106: @@
+   }
    ($puid, $orgid) = $session->{database}->get_auth_puid( $secret_code );
    return unless $puid;
    my %return_hash = (
-            UserID     => $puid,
+            userID     => $puid,
-            OrgID      => $orgid,
+            orgID      => $orgid,
                     );
    return \%return_hash;
+}
 </pre>

← Older revision		Revision as of 13:36, 5 May 2008
Line 131:		Line 131:

	The actual code is very simple: get the EPrints session code from the EPpints cookie, and use that as the index for the data supplied by the Shibboleth authentication server.		The actual code is very simple: get the EPrints session code from the EPpints cookie, and use that as the index for the data supplied by the Shibboleth authentication server.
		+	We store the user identification details in a table and not pass them via a URL as this minimises the opportunities for spoofing an authenticated user.

	<pre>		<pre>