Shibboleth feedback

[Philip Durbin]

I'm organizing an small internal meeting about Shibboleth and wanted to ask you lovely people in the community what is "top of mind" for you with regard to Shibboleth.

Despite the experimental* status of Shibboleth support in Dataverse 4 I know that some of you have been trying it out and I'd love to hear what you think. Are big changes necessary before you can use it? Is it useful to you as-is? Please let me know!

If you've already sent in your feedback via issues at https://github.com/IQSS/dataverse/issues or tickets at https://help.hmdc.harvard.edu please let me know the numbers so I can quickly find them.

Thanks!

Phil

* http://guides.dataverse.org/en/4.2.2/installation/shibboleth.html#status-experimental

--

Philip Durbin
Software Developer for http://dataverse.org
http://www.iq.harvard.edu/people/philip-durbin

[Ben Companjen]

Hi Phil,

Thanks for reaching out :)

At the top of our list is implementing shib groups. We need group definitions that are more targeted than "all users from institution X (i.e. identified by identity provider X)" and therefore need to check more than one attribute in SAML messages to determine group membership. This is issue 1515 ("arbitrary attributes and regex support") and we want to contribute code for this issue, but I have to fight for the needed developer time. I foresee a change to the model of group definitions and possibly a change to the API and have asked for feedback on this list.

Second on the list is 2548 ("Shibboleth/UI/config: one-click IdP-selection, DiscoFeed-bypass"). We use an external discovery service, so a dropdown list for IdPs could be replaced by a button or link. Also, the hardcoded link to the JSON feed for IdP names should be configurable.

ORCID and ISNI support via SAML is nice (mentioned in https://github.com/IQSS/dataverse/issues/923#issuecomment-169454780), but it's not one of our priorities.

Regards,

Ben

--
You received this message because you are subscribed to the Google Groups "Dataverse Users Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dataverse-commu...@googlegroups.com.
To post to this group, send email to dataverse...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/dataverse-community/CABbxx8Hb2RgxExjgiYkffk3GvrEHET5p-HKT8fNEurJpyz-9Tw%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

[Sherry Lake]

I have more of a question of "how would it work, if?"

If shibboleth login is the ONLY way to create a DV account, then how do we set up (or use) the default administrator? An administrator account is created on installation, can we make one of our shibboleth logged-in users be administrator (how would we do that)?. We of course want to make sure local account creation is not available (https://github.com/IQSS/dataverse/issues/2838), but would we have login access for the admin account in addition to shibboleth log in?

Thanks.
Sherry

[Philip Durbin]

Yes, but let me clarify the terminology.

A *superuser* account is created when you install Dataverse. This is a boolean in the "authenticateduser" table that applies to *all* users including Shibboleth users. Look for "Toggles superuser mode" at http://guides.dataverse.org/en/4.2.2/api/native-api.html#admin

In practice, a superuser is an administrator and the default one "dataverseAdmin" has "admin" in the username but I want to differentiate between being a superuser and being granted the "Admin" role, which is a collection of specific permissions. The permission rules don't apply to superusers.

Setup of Dataverse requires a local account, "dataverseAdmin" by default, but you could always remove its superuser privileges and/or scramble its password once you have Shibboleth working. Or you could keep the dataverseAdmin account working in case your Shibboleth auth goes down temporarily.

I hope this helps!

Phil

p.s. Sounds like https://github.com/IQSS/dataverse/issues/2838 is pretty important to you. /me adds it to his list.

--

You received this message because you are subscribed to the Google Groups "Dataverse Users Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dataverse-commu...@googlegroups.com.
To post to this group, send email to dataverse...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/dataverse-community/892f3b9d-2f06-4d24-b8bb-fe0dead487fc%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Philip Durbin]

Right. I've read https://groups.google.com/d/msg/dataverse-community/FviyNJ-sc0c/29bOpQ64BgAJ but no one has replied on that thread about Shibboleth groups. I'm sure you'd appreciate a reply or more comments on https://github.com/IQSS/dataverse/issues/1515 from the community.

I understand that because all of your users come from a single IdP the "institution-wide" group developed in https://github.com/IQSS/dataverse/issues/1401 are of no use to you. :(

The single IdP situation is also what led you to open https://github.com/IQSS/dataverse/issues/2548 about the login workflow. I'm not sure the best way for me to replicate the single IdP situation in development, actually.

These were both on my list already but I'm glad to confirm there's nothing new.

Thanks, Ben!

Phil

To view this discussion on the web visit https://groups.google.com/d/msgid/dataverse-community/B104875C-A6C2-473B-9BA0-348FD28F66EB%40dans.knaw.nl.

For more options, visit https://groups.google.com/d/optout.

[Jonathan Crabtree]

Phil/Ben

Odum has started our Shib testing and we are also interested in a defining groups based on  Shib attributes. Potentially affiliation.

We have not gone very far on that since we are still trying to migrate our existing users to Shib users during the migration.

Our situation might also be complicated by users with multiple entries for some attributes . We have some users that have multiple departments and status.

I am a good example. I am Staff at Odum and a Student in the School of Information an Library Science. 

We are planning to migrate to 4.x before dealing with these groups but that will be next on our list too.

Jon

To view this discussion on the web visit https://groups.google.com/d/msgid/dataverse-community/CABbxx8HboqkVzY9fu%2Bym_EVb8Oo3-4JC6PvACJjaN4npocg7OA%40mail.gmail.com.

[Ben Companjen]

Hi Jon,

Thanks for your feedback.

In your situation, would a SAML message include `eduPersonScopedAffiliation`, e.g. `st...@odum.unc.edu;stu...@ils.unc.edu` (I'm making up the scopes here)? 

That would be preferrable to just having assertions about your affiliations (staff, student) and organisational units (Odum, ILS) that the group membership component would have to correlate.

It reminds me that we should check the assertions that we (can) get from our partners.

Ben

[Jonathan Crabtree]

Ben

Yes it would be something like that.

The key would be making decisions about what is primary affiliation and primary role.

I guess you could just put the users in all affiliations and let them manually select the primary.

I have copied Don and he can give you what we get from our iDP as far as assertions

Jon

--
You received this message because you are subscribed to the Google Groups "Dataverse Users Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dataverse-commu...@googlegroups.com.
To post to this group, send email to dataverse...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/dataverse-community/48540D4A-0439-4526-A92A-39AD15E4ECA2%40dans.knaw.nl.

[Philip Durbin]

Thanks, Jon. My takeaway is that while groups are important, you're like us (Harvard Dataverse) in that the priority is giving users the ability to log in to Shibboleth at all and you're willing to wait a bit to get the group stuff working. It looks like you're having a nice chat with Ben further down in this thread, which is great. I'll probably jump in at some point.

The thing that really caught my eye is "we are still trying to migrate our existing users to Shib users during the migration." I *think* you're suggesting a different approach than we're using at Harvard. When we launched Dataverse 4.0 we allowed users to choose to convert their local account to a Shibboleth account if they want to. (After logging in with Shibboleth we check for a matching email address for a builtin user and confirm their local password as developed in https://github.com/IQSS/dataverse/issues/796 .) It sounds like you're going to just convert everyone ahead of time somehow. You'll need their EPPN values I guess. Or maybe I'm completely misunderstanding what you're saying! Anyway, sounds fancy. :)

Phil

To view this discussion on the web visit https://groups.google.com/d/msgid/dataverse-community/E5471AF4-B02E-4D1B-A577-A7857893F530%40gmail.com.

For more options, visit https://groups.google.com/d/optout.

[Jonathan Crabtree]

Phil

Yes you are right on groups.

We are still investigating the migration. Right now we have tons of “test” users and “DVNs” we are cleaning up. I think we want all UNC people to use Shib login one way or another. We have not got very far in making a decision on how to do that. We do not have as many as you do so it might be possible manually as you say but i am not sure yet

jon

To view this discussion on the web visit https://groups.google.com/d/msgid/dataverse-community/CABbxx8FrUdmUxfFN%2BGEoc2%3DdFBxc_OZcELd_kRVJkQB%3DiSys8A%40mail.gmail.com.