SAML-based authentication for patrons

The Circulation Manager occupies the Service Provider (SP) role in the SAML Protocol and authenticates a patron against an Identity Provider (IdP).

Identity Providers (IdP) may use a number of services such as Shibboleth, CAS and EZ Proxy to protect resources.  The following workflows describe the communications between the respective systems and the Circulation Manager (SP)

SAML

SAML-based authentication workflow for patrons is depicted on the picture below:

Image I. SAML Authentication Workflow in Circulation Manager
(content provider does not use SAML)

Both the Circulation Manager and IdP should have their metadata registered with each other. In the simplest case it can be a Shibboleth environment where SP’s metadata is added to IdP’s configuration and vice versa. However, the better solution would be to register the Circulation Manager in InCommon Federation which would allow to use of any IdPs in the federation.

SAML with EZ Proxy

The picture below shows how the workflow looks like in the case when the content is protected by a SAML authentication mechanism: either via SAML proxy or EZProxy with SAML authentication turned on.

Image II. SAML Authentication Workflow in Circulation Manager
(content provider uses a SAML proxy or EZProxy with turned on SAML authentication)

SAML with CAS and EZ Proxy

An alternate configuration may include a Authentication delegated to another application such as a CAS Server.

Image III. SAML Authentication Workflow in Circulation Manager
(content provider uses a SAML proxy or EZProxy with turned on SAML authentication and CAS Authentication Delegation)

In this case there are two authentication events:

1. User authenticates to the Circulation Manager. It works in exactly the same way as in the previous case: users will have to authenticate themselves against IdP either by entering credentials on the IdP’s form or using other mechanisms setup in the IdP’s settings.
2. User authenticates to SAML proxy/EZProxy. This should not require users to authenticate themselves against IdP. However, they may be shown a consent screen asking them to confirm using their credentials with a different SP (either SAML proxy or EZProxy).

Configuration

You can find information about SAML Authentication Provider's configuration in SAML-based authentication for patrons article.

Testing

You can find information about testing in SAML Testbed article.