Shibboleth has two major halves: an identity provider (IdP), which authenticates users and releases selected information about them, and a service provider (SP) that accepts and processes the user data before making access control decisions or passing the information to protected applications. These entities trust each other to properly safeguard user data and sensitive resources.
Here is the process of authentication:
- The user accesses a protected resource.
- The SP determines an IdP and issues the authentication request.
- The user authenticates to the IdP.
- The IdP issues a response to the SP.
- The SP decodes the message and extracts the attributes.
- The browser is redirected to the protected resource.
For details, see https://spaces.internet2.edu/display/SHIB2/FlowsAndConfig.
The SHIB_AUTH plug-in is implemented by the class
org.nuxeo.ecm.platform.shibboleth.auth.ShibbolethAuthenticationPlugin. It authenticates the user based on HTTP headers received from the SP. It also creates (or updates) an entry in the userDirectory for this user.
As the Shibboleth attributes values are passed by HTTP headers, the service
org.nuxeo.ecm.platform.shibboleth.service.ShibbolethAuthenticationService has been added to configure the mapping between the user metadata and the headers names.
ShibbGroups are virtual groups based on an EL expression with Shibboleth attributes. A new user management tab is added to create and edit them. The definitions are stored in the
org.nuxeo.ecm.platform.shibboleth.computedgroups.ShibbolethGroupComputer computes at login time the ShibbGroups that the current user is member of.
Marketplace Package Installation
After you installed the package, a new Shib Goups tab is available in the Admin > Users & Groups tab.
- Download the built nuxeo-platform-login-shibboleth.jar.
- Deploy it into your Tomcat or JBoss instance, in the
- Add a new file named
config/directory of your server. This file defines the login and logout URLs, the mapping between the user metadata and the headers names.
$NUXEO/nxserver/configfor a Tomcat distribution
$NUXEO/server/default/deploy/nuxeo.ear/configfor a JBoss distribution
Overriding the Default Authentication Chain
To enable the Shibboleth authentication, you need to add the Shibboleth plug-in to the authentication chain.
To override the default authentication chain in the Nuxeo Platform, add a new file named
authentication-chain-config.xml in the
config/ directory of your server.
Note: If you already defined your own authentication chain in any of your config or contrib files, you just need to add the
SHIB_AUTH plug-in into your own chain.
Anonymous Authentication Compatibility
As it is not possible to write access rules based on resource URLs with the Nuxeo Platform, Shibboleth LazySession has to be enabled. By adding the ANONYMOUS_AUTH in the authentication chain, the Shibboleth login will only be asked when accessing a restricted resource.
For that, the
org.nuxeo.ecm.platform.shibboleth.auth.exceptionhandling.ShibbolethSecurityExceptionHandler will redirect to the login URL when a NuxeoSecurityException is thrown while the current user is anonymous.
To activate it, add a new file named
login-anonymous-config.xml in the
config/ directory of your server.
Full Sample Configuration File
Here is a sample configuration file containing everything you need to set up the Shibboleth authentication module:
The source code of the Shibboleth authentication module can be found as part of the
nuxeo-platform-login add-on on GitHub.