Page History

...

The Circulation Manager occupies the Service Provider (SP) role in the SAML Protocol and authenticates a patron against an Identity Provider (IdP).

Identity Providers (IdP) may use a number of services such as Shibboleth, CAS and EZ Proxy to protect resources.  The following workflows describe the communications between the respective systems and the Circulation Manager (SP)

Wokflows

• SAML (Shibboleth)
• SAML with EZ Proxy
• SAML using CAS SSO with EZ Proxy

Anchor
SAML SAML

SAML

SAML-based authentication workflow for patrons is depicted on the picture below:

...

Both the Circulation Manager and IdP should have their metadata registered with each other. In the simplest case it can be a Shibboleth environment where SP’s metadata is added to IdP’s configuration and vice versa. However, the better solution would be to register the Circulation Manager in InCommon Federation which would allow to use of any IdPs in the federation.

Anchor
SAML EZProxy SAML EZProxy

SAML with EZ Proxy

The picture below shows how the workflow looks like in the case when the content is protected by a SAML authentication mechanism: either via SAML proxy or EZProxy with SAML authentication turned on.

Image II. SAML Authentication Workflow in Circulation Manager
(content provider uses a SAML proxy or EZProxy with turned on SAML authentication)

Anchor
SAML with EZ Proxy CAS SAML with EZ Proxy CAS

SAML with CAS and EZ Proxy

An alternate configuration may include a Authentication delegated to another application such as a CAS Server.

...