Using Shibboleth

Shibboleth has two major halves: an identity provider (IdP), which authenticates users and releases selected information about them, and a service provider (SP) that accepts and processes the user data before making access control decisions or passing the information to protected applications. These entities trust each other to properly safeguard user data and sensitive resources.

Here is the process of authentication:

The user accesses a protected resource.
The SP determines an IdP and issues the authentication request.
The user authenticates to the IdP.
The IdP issues a response to the SP.
The SP decodes the message and extracts the attributes.
The browser is redirected to the protected resource.

For details, see https://spaces.internet2.edu/display/SHIB2/FlowsAndConfig.

Overview

The SHIB_AUTH plug-in is implemented by the class org.nuxeo.ecm.platform.shibboleth.auth.ShibbolethAuthenticationPlugin. It authenticates the user based on HTTP headers received from the SP. It also creates (or updates) an entry in the userDirectory for this user.

As the Shibboleth attributes values are passed by HTTP headers, the service org.nuxeo.ecm.platform.shibboleth.service.ShibbolethAuthenticationService has been added to configure the mapping between the user metadata and the headers names.

ShibbGroups are virtual groups based on an EL expression with Shibboleth attributes. A new user management tab is added to create and edit them. The definitions are stored in the shibbGroup directory.

The class org.nuxeo.ecm.platform.shibboleth.computedgroups.ShibbolethGroupComputer computes at login time the ShibbGroups that the current user is member of.

Installation

Marketplace Package Installation

The Shibboleth authentication module could be installed through the Marketplace with the Shibboleth Authentication package. See the page Installing a New Package on Your Instance.

After you installed the package, a new Shib Goups tab is available in the Admin > Users & Groups tab.

Manual Installation

Download the built nuxeo-platform-login-shibboleth.jar.
Deploy it into your Tomcat or JBoss instance, in the bundles directory.

Add a new file named shibboleth-config.xml in the config/ directory of your server. This file defines the login and logout URLs, the mapping between the user metadata and the headers names.

$NUXEO/nxserver/config for a Tomcat distribution
$NUXEO/server/default/deploy/nuxeo.ear/config for a JBoss distribution
shibboleth-config.xml

<?xml version="1.0"?>
<component name="org.nuxeo.ecm.platform.login.shibboleth.config">
<extension
    target="org.nuxeo.ecm.platform.shibboleth.service.ShibbolethAuthenticationService"
    point="config">
    <config>
      <uidHeaders>
        <default>uid</default>
      </uidHeaders>

      <loginURL>https://host/Shibboleth.sso/WAYF</loginURL>
      <logoutURL>https://host/Shibboleth.sso/Logout</logoutURL>

      <fieldMapping header="uid">username</fieldMapping>
      <fieldMapping header="mail">email</fieldMapping>
    </config>
  </extension>
</component>

Configuration

Overriding the Default Authentication Chain

To enable the Shibboleth authentication, you need to add the Shibboleth plug-in to the authentication chain.

To override the default authentication chain in the Nuxeo Platform, add a new file named authentication-chain-config.xml in the config/ directory of your server.

authentication-chain-config.xml

<?xml version="1.0"?>
<component name="org.nuxeo.ecm.platform.your.authentication.chain.config">
  <require>org.nuxeo.ecm.platform.ui.web.auth.WebEngineConfig</require>
  <extension target="org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService"
    point="chain">
    <authenticationChain>
      <plugins>
        <plugin>BASIC_AUTH</plugin>
        <plugin>SHIB_AUTH</plugin>
        <plugin>FORM_AUTH</plugin>
        <plugin>WEBENGINE_FORM_AUTH</plugin>        
        <plugin>ANONYMOUS_AUTH</plugin>
        <plugin>WEBSERVICES_AUTH</plugin>
      </plugins>
    </authenticationChain>
  </extension>
</component>

Note: If you already defined your own authentication chain in any of your config or contrib files, you just need to add the SHIB_AUTH plug-in into your own chain.

Anonymous Authentication Compatibility

As it is not possible to write access rules based on resource URLs with the Nuxeo Platform, Shibboleth LazySession has to be enabled. By adding the ANONYMOUS_AUTH in the authentication chain, the Shibboleth login will only be asked when accessing a restricted resource.

For that, the org.nuxeo.ecm.platform.shibboleth.auth.exceptionhandling.ShibbolethSecurityExceptionHandler will redirect to the login URL when a NuxeoSecurityException is thrown while the current user is anonymous.

To activate it, add a new file named login-anonymous-config.xml in the config/ directory of your server.

<?xml version="1.0"?>
<component name="org.nuxeo.ecm.platform.your.anonymous.user.config">
  <extension target="org.nuxeo.ecm.platform.usermanager.UserService"
    point="userManager">
    <userManager>
      <users>
        <anonymousUser id="Guest">
          <property name="firstName">Guest</property>
          <property name="lastName">User</property>
        </anonymousUser>
      </users>
    </userManager>
  </extension>
</component>

Full Sample Configuration File

Here is a sample configuration file containing everything you need to set up the Shibboleth authentication module:

<component name="sample.shibboleth.config">

  <require>org.nuxeo.ecm.platform.ui.web.auth.WebEngineConfig</require>
  <require>org.nuxeo.ecm.platform.usermanager.UserManagerImpl</require>

  <extension
      target="org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService"
      point="chain">
    <authenticationChain>
      <plugins>
        <plugin>BASIC_AUTH</plugin>
        <plugin>SHIB_AUTH</plugin>
        <plugin>ANONYMOUS_AUTH</plugin>
      </plugins>
    </authenticationChain>
  </extension>

  <extension
    target="org.nuxeo.ecm.platform.shibboleth.service.ShibbolethAuthenticationService"
    point="config">
    <config>
      <uidHeaders>
        <default>uid</default>
      </uidHeaders>

      <loginURL>https://host/Shibboleth.sso/WAYF</loginURL>
      <logoutURL>https://host/Shibboleth.sso/Logout</logoutURL>

      <fieldMapping header="uid">username</fieldMapping>
      <fieldMapping header="mail">email</fieldMapping>
    </config>
  </extension>

  <!-- Add an Anonymous user -->
  <extension target="org.nuxeo.ecm.platform.usermanager.UserService"
    point="userManager">
    <userManager>
      <users>
        <anonymousUser id="Guest">
          <property name="firstName">Guest</property>
          <property name="lastName">User</property>
        </anonymousUser>
      </users>
    </userManager>
  </extension>

</component>

Source Code

The source code of the Shibboleth authentication module can be found as part of the nuxeo-platform-login add-on on GitHub.