CANHEIT

Effective Shib IDP Operations

Jonathan Zhao

Senior Authentication Systems Specialist, University of Toronto

Effective

Shib IdP

CANHEIT2024

Just another Effective

Jonathan Zhao

01

Completely standalone app environment

Shib admin

OS admin

Implementation

Privileged ports 443 listening

1

Avoid system wide /etc/krb5.conf

2

“green” installation

3

JDK system properties

/opt/apps owned by run account “shib”

- /opt/apps/jdk

- /opt/apps/tomcat

- /opt/apps/shib-idp

…

Containerized(docker) reverse proxy server for TLS termination

02

Meta Data Driven Configuration

Benefits of MDD

Simple configuration and trouble shooting

1

No down time

2

SPs are not affected by each other

3

Metadata files are reloaded at run time automatically

A change for one SP doesn’t affect others

A single metadata file controls everything

Implementation of MDD

Define your own MDD tags

1

Git version control

2

MDA/MDQ

3

Metadata processing/publishing pipeline

e.g. releasing attributes, Duo profile, …

Private repo to protect contact info in metadata

03

Log aggregation

Implementation of log aggregation

Why not SIEM?

1

Real-time monitoring

2

Persistent storage

3

Database and analysis tools

More flexibility

Sever Side Event interface

04

Cluster management

Tools for shib IDP cluster

Web based admin panel

1

Identify individual server

3

Shared sessions are not needed

5

Shib IDP has built-in support for sharing between servers. E.g. OIDC authorization and token endpoints can be at different servers.

Single interface to manage all servers, e.g reloading services…

Each server has a unique ID displayed in their UI

Thank You