Athens DA Protocol: Difference between revisions

Latest revision as of 10:01, 22 May 2007

WARNING: This page is retained as a historical record but is out-of-date and is not being maintained.

This was a working document belonging to the Computing Service's Shibboleth Development Project. This project is complete (Raven now supports Shibboleth) and this document only remains for historical and reference purposes. Be aware that it is not being maintained and may be misleading if read out of context.

When using the gateway, you are in effect using AthensDA, except that the eXtensible Authentication Point (XAP) (see AthensDA integration guide) is run by Athens and delegates to the local site's Shibboleth IdP to identify users. Because of this, there is quite a lot of useful information to be found in the JISCMail AthensDA list as well as the JISC-Shibboleth list

Details of the protocol between Athens and the XAP are available in the AthensDA integration guide. Details of the protocol between Athens and the DSPs are largely available in DSP integration guide though there are additional resources that are only available to DSPs.

How it works

When using the gateway you end up with a chain of 4 things, each (except the last) deferring identifying who you are to the next one:

 Resource1 --> Athens --> Raven/Shibboleth --> Raven ---
                                                        |
 Resource1 <-- Athens <-- Raven/Shibboleth <-- Raven <--

Each one remembers who you are if it's already seen you during the current browser session. For example you can keep on accessing the resource without further reference to Athens:

 Resource1 ---
              |
 Resource1 <--

and you can access a new Athens resource without further reference to Raven/Shibboleth

 Resource2 --> Athens ---
                         |
 Resource2 <-- Athens <--

Information provided to content providers

The protocol apparently transfers at least the following to the content provider:

a user name. When using the gateway, the user name is a 20-character random string starting '_'; apparently there is no guarantee that these will always be the same for the same user, but at present they are.
a persistent unique ID. When using the gateway, this is based on the eduPersonTargetedID provided by Shib, though it's not the same
an Organisation_Id, identifying the user's home organization

Other data is also available, see the DSP integration guide.

URLs

Various 'interesting' URLs can be identified by watching the http interaction or by reading submissions to the mailing lists, but only a few are actually documented for use:

The AthensDA integration guide (section 3.4.4) documents the 'setorg' URL which can be used to set the ath_ldom cookie identifying the user's home institution. Note that <returl> can be anything, including other Athens URLs

http://auth.athensams.net/setorg.php?id=<providerid>&ath_returl=<returl>

- <providerid> your providerid
- <returl> URL to return to once the cookie is set

The Local Authentication Integration Standards document includes a logout url to terminate Athens authentication:

https://auth.athensams.net/?ath_action=ssologout&ath_returl=<returl>

- <returl> is optional and provides a URL to refer the user to once logout is complete.

RSS feed of available resources: https://auth.athensams.net/my/resources/rss (but only available once authenticated?)

Target Resource Locators (TRLs) are provided for creating persistent URLs to resources that will trigger authentication:

 From: Eduserv Athens Local Authentication Support <athens-la@EDUSERV.ORG.UK>
 To: ATHENSDA@JISCMAIL.AC.UK
 Date: Tue, 14 Feb 2006 17:20:10 -0000

 ...
 The new service URL format is called a target resource locator (TRL),
 which uses a combination of:

 * the URL of the Athens authentication point (AP)
 * a TRL identifier
 * a resource identifier

 The basic format of a TRL is therefore:

 https://auth.athensams.net/trl/1.0/-/RESOURCE_ID

It appears that adding ?ath_action=noHddsSession will bypass the HDD service and so allow someone logged in via the gateway to access a particular service using their Classic Athens account:

 From: Eduserv Athens Local Authentication Support <athens-la@EDUSERV.ORG.UK>
 To: JISC-SHIBBOLETH@JISCMAIL.AC.UK
 Date: Tue, 14 Feb 2006 17:20:08 -0000
 Subject: Access to services not compliant with Shibboleth - Athens gateway

 As some of you know, Eduserv have been working on a method of allowing
 users at Shibboleth IdPs to use Athens-protected services that do not
 meet Athens implementation standards...

 The fix developed by Eduserv allows a user from a Shibboleth IdP to log
 into non-gateway compliant services with a classic Athens account.  It
 uses a URL format called a target resource locator (TRL), which uses a
 combination of:

 * the URL of the Athens authentication point (AP)
 * a TRL identifier
 * a resource identifier
 * an extra parameter to pass at the Athens AP: ath_action=noHddsSession

 The basic format of a TRL is therefore:

 https://auth.athensams.net/trl/1.0/-/RESOURCE_ID?ath_action=noHddsSession

 A list of TRLs for non-gateway compliant services is below [...]

 Dialog DataStar
 https://auth.athensams.net/trl/1.0/-/DIALOG_DATASTAR?ath_action=noHddSession

 International Who's Who
 https://auth.athensams.net/trl/1.0/-/WORLD_WHO_WHO?ath_action=noHddSession

 JISC PDS
 https://auth.athensams.net/trl/1.0/-/PDS?ath_action=noHddSession

 LexisNexis Professional and Executive
 https://auth.athensams.net/trl/1.0/-/Lexis?ath_action=noHddSession

 Oxford Scholarship Online
 https://auth.athensams.net/trl/1.0/-/OUP_OSO?ath_action=noHddSession

 ProQuest
 https://auth.athensams.net/trl/1.0/-/PROQUEST?ath_action=noHddSession

Cookies

ath_ldom, domain .athensams.net, expires +5 yeasrs: contains hom providerID, used by the Home Domain Discovery service to automatically refer authentication to the gateway.
ath_da, domain .athensams.net, session: set following authentication, purpose unknown, contains '2'
ath_username, domain .athensams.net, session: set following authentication, contains Athens usrname, used to support SSO
ath_ltoken, domain .athensams.net, session: contains the L token which supports SSO
__utma, __utmb, __utmc, __utmz: Google analyticics

Authentication sequences

Clean start

Starting with no relevant cookies, choosing 'Athens login' takes you to

http://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>

<dspid> is the service providerid - e.g. EDINA.FILMSOUND
<returl> is the URL to access once authentication is complete

This results in a redirect to the same URL over https, which displays the Athens user id/password box (possibly customised for the site). Selecting 'Alternate login from there takes you to

https://auth.athensams.net/orglist.php?ath_returl=<returl>&ath_dspid=<dspid>

which displays the standard Athens HDDS organisation chooser. Selecting a particular organisation takes you to

https://auth.athensams.net/setsite.php?ath_dspid=<dspid>&ath_returl=<returl>&id=<providerid>

<providerid> is the selected identity provider's id

This displays a message confirming the institution and asking if you want to remember it (in the ath_ldom cookie) for the future. Clicking 'GO>>' (assuming you leave the remember box checked) takes you to

https://auth.athensams.net/setsite.php?ath_dspid=<dspid>&ath_returl=<returl>&id=<providerid>&originProfile=4&doLogin=1&remChk=1&submit=++++Go+%BB+++

which redirects to

https://auth.athensams.net/?ath_action=setldom&id=<providerid>&ath_dspid=<dspid>&ath_returl=<returl>

which sets the ath_ldom cookie and redirects to

https://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>&id=<prviderid>&ath_action=shaauth

Which redirects to the organisation's Shibboleth SSO handler. The target authentication request parameter, normally the URL of the eventual target of the authentication, appears to be an opaque string of some sort, perhaps the AthensDA DA_sso_req packet.

The organisation completes a Shibboleth authentication and posts the result to

https://auth.athensams.net/saml/PostRcv

The post contains a copy of the <target> from the request and the a SAML authentication response. This sets session cookies ath_da=2, ath_username=<id>, and ath_ltoken=<ltoken>.

<id> is an Athens userid. When using the gateway this is a randomly allocated string starting '_', e.g. _wplsf6omk2rfw7lfveb
<ltoken> is the AthensDA 'L' token, used to maintain SSO session, e.g. %3CRlMlVeMTj8BvvBMx3w%3E

A zero-delay META-refresh then causes the browser to retrieve:

<returl>&ath_user=<id>&ath_ttok=<ttoken>

<ttoken> is the AThensDA 'T' token, used to transfer the user's identity to the DSP, e.g. %3CRlK1EaMyq%2FIMcMjuAA%3E

which redirects to the real service URL.

Another site, while still logged-in

Choosing 'Athens login' goes to

http://auth.athensams.net/?ath_returl=<returk>&ath_dspid=<dspid>

which redirects to the same URL over https, which uses a zero-delay META-refresh to causes the browser to request

<returl>?ath_user=<id>&ath_ttok=<tok>

which redirects to the real service URL.

Any site, having quit and restart the browser

Choosing 'Athens login' goes to

http://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>

which redirects to the same URL over https: which displays the Continue to login page. Selecting the main link takes you to

https://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>id=<providerid>&ath_action=shaauth

Which redirects to the organisation's Shibboleth SSO handler. The target authentication request parameter, normally the URL of the eventual target of the authentication, appears to be an opaque string of some sort, perhaps the AthensDA DA_sso_req packet.

The organisation completes a Shibboleth authentication and posts the result to

https://auth.athensams.net/saml/PostRcv

The post contains a copy of the <target> from the request and the a SAML authentication response. This sets session cookies ath_da=2, ath_username=<id>, and ath_ltoken=<ltoken>.

<id> is an Athens userid. When using the gateway this is a randomly allocated string starting '_', e.g. _wplsf6omk2rfw7lfveb
<ltoken> is the AthensDA 'L' token, used to maintain SSO session, e.g. %3CRlMlVeMTj8BvvBMx3w%3E

A zero-delay META-refresh then causes the browser to retrieve:

<returl>&ath_user=<id>&ath_ttok=<ttoken>

<ttoken> is the AThensDA 'T' token, used to transfer the user's identity to the DSP, e.g. %3CRlK1EaMyq%2FIMcMjuAA%3E

which redirects to the real service URL.

Classic Athens (for comparison)

Choosing 'Athens login' takes you to

http://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>

This redirects to the same URL over https:, which displays the Athens username/password page. Entering a username/password and clicking login posts ath_uname and ath_passwd to

https://auth.athensams.net/?ath_returl=<returl>&ath_dspid=<dspid>

This sets session cookies ath_da=2, ath_username=<id>, and ath_ltoken=<ltoken>.

<id> is an Athens userid. When using the gateway this is a randomly allocated string starting '_', e.g. _wplsf6omk2rfw7lfveb
<ltoken> is the AthensDA 'L' token, used to maintain SSO session, e.g. %3CRlMlVeMTj8BvvBMx3w%3E

A zero-delay META-refresh then causes the browser to retrieve:

<returl>&ath_user=<id>&ath_ttok=<ttoken>

<ttoken> is the AThensDA 'T' token, used to transfer the user's identity to the DSP, e.g. %3CRlK1EaMyq%2FIMcMjuAA%3E

which redirects to the real service URL.

Captured URLs

Real URLs captured during various interactions:

Default start

1. Starting with no cookies, login to Film & Sound @ http://www.filmandsound.ac.uk/. Choose 'Athens login'

http://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=42&y=14

2. redirect to

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=42&y=14

3. Displays Athens username & password box. Select 'Alternative Login'

https://auth.athensams.net/orglist.php?ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&ath_dspid=EDINA.FILMSOUND

4. Displays Athens HDDS chooser. Select 'Cardiff University' ('cos Cambridge not yet live)

https://auth.athensams.net/setsite.php?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=https%3A%2F%2Fidp.cardiff.ac.uk%2Fshibboleth&oid=218

5. Displays 'Go to Cardiff University' page with 'Save on this computer. Click 'OK'

https://auth.athensams.net/setsite.php?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=https%3A%2F%2Fidp.cardiff.ac.uk%2Fshibboleth&oid=218

6. redirect to

https://auth.athensams.net/?ath_action=setldom&id=https://idp.cardiff.ac.uk/shibboleth&ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D

7. Sets auth_ldom cookie, redirects to

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=https%3A%2F%2Fidp.cardiff.ac.uk%2Fshibboleth&ath_action=shaauth

8. redirect to

https://idp.cardiff.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=WlpjSDFUcHp5dDREMGZpQk34kltZLjGuSYUxm7fxxIlcNti8frex3VK3vKyylGgyyzGL6W5YzeAZmDt%2FVe6kyMQ36IzB5W3y%2FHNJTjDozxiJT5%2BI7MAwj0qTeGq4J3do8atjki5vpU%2B%2ByRN2WzeNYfzqmBRWH%2FTX96c1T8c9H5yEvu4W72Eq%2FcmseFd%2F%2FOQrGdJLay5qNu0dTh6tmK8Gu5WsrX9jCh8HZVxttqtt5aVQZdwLLW8Oz4RB19PVBz0M3tmfT58Kl2ffxqZEMJtIjXA2anf2XBpk80JmnrQJWNc%3D&time=1179728690&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk

9. Displays Cardiff's local authentication page

The same, as if from Cambridge

1. Fake the result of 4) above but choosing 'Cambridge' from the HDDS chooser by entering

https://auth.athensams.net/setsite.php?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=urn:mace:eduserv.org.uk:athens:provider:cam.ac.uk

2. Displays 'Go to the Cambridge University login' page. Leave 'Remember this Org' checked. Click 'Go>>'

https://auth.athensams.net/setsite.php?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Aprovider%3Acam.ac.uk&originProfile=4&doLogin=1&remChk=1&submit=++++Go+%BB+++

3. Redirects to

https://auth.athensams.net/?ath_action=setldom&id=urn:mace:eduserv.org.uk:athens:provider:cam.ac.uk&ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D

4. Sets auth_ldom cookie, redirects to

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Aprovider%3Acam.ac.uk&ath_action=shaauth

5. Redirects to

https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=ZFA0aXhSZjhjNHhXV2MybasvguUrMSbNF5sQ4lSOgc6317IRIVcse4G3po0e%2BkWkz2MtytmCl%2B0sgd12a3uByyf82zWgUB%2BcZe%2FimgKgJzOET1vdzFFpZocqwozvWLt49CZggwR2eq%2B80kq%2FuAcNARhOzkC8vyboZr6JEpHCm%2FfPZTvKgfZkXtMQ2YS4J%2FtwpOng%2Fo%2BGtBTNjt5AEYUT0Btk7zcAiJ7DTYij53WZiAPFmabB4A%2FPjxKKtsy9%2BnS8XOU13ha3MPMPtxU4H5l9FD1hYCM0M10XbgFYcKGlXW0%3D&time=1179730412&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk

6. Redirects to

https://raven.cam.ac.uk/auth/authenticate.html?ver=1&url=https%3a%2f%2fshib.raven.cam.ac.uk%2fshibboleth-idp%2fSSO%3fshire%3dhttps%253A%252F%252Fauth.athensams.net%252Fsaml%252FPostRcv%26target%3dZFA0aXhSZjhjNHhXV2MybasvguUrMSbNF5sQ4lSOgc6317IRIVcse4G3po0e%252BkWkz2MtytmCl%252B0sgd12a3uByyf82zWgUB%252BcZe%252FimgKgJzOET1vdzFFpZocqwozvWLt49CZggwR2eq%252B80kq%252FuAcNARhOzkC8vyboZr6JEpHCm%252FfPZTvKgfZkXtMQ2YS4J%252FtwpOng%252Fo%252BGtBTNjt5AEYUT0Btk7zcAiJ7DTYij53WZiAPFmabB4A%252FPjxKKtsy9%252BnS8XOU13ha3MPMPtxU4H5l9FD1hYCM0M10XbgFYcKGlXW0%253D%26time%3d1179730412%26providerId%3durn%253Amace%253Aeduserv.org.uk%253Aathens%253Afederation%253Auk&date=20070521T065333Z&desc=the%20University%20pilot%20Shibboleth%20service

7. Displays 'Raven confirmation'. Click Continue

https://raven.cam.ac.uk/auth/authenticate4.html

8. Redirects to

https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?WLS-Response=1!200!!20070521T065751Z!1179730417-25013-8!https%3A%2F%2Fshib.raven.cam.ac.uk%2Fshibboleth-idp%2FSSO%3Fshire%3Dhttps%25253A%25252F%25252Fauth.athensams.net%25252Fsaml%25252FPostRcv%26target%3DZFA0aXhSZjhjNHhXV2MybasvguUrMSbNF5sQ4lSOgc6317IRIVcse4G3po0e%25252BkWkz2MtytmCl%25252B0sgd12a3uByyf82zWgUB%25252BcZe%25252FimgKgJzOET1vdzFFpZocqwozvWLt49CZggwR2eq%25252B80kq%25252FuAcNARhOzkC8vyboZr6JEpHCm%25252FfPZTvKgfZkXtMQ2YS4J%25252FtwpOng%25252Fo%25252BGtBTNjt5AEYUT0Btk7zcAiJ7DTYij53WZiAPFmabB4A%25252FPjxKKtsy9%25252BnS8XOU13ha3MPMPtxU4H5l9FD1hYCM0M10XbgFYcKGlXW0%25253D%26time%3D1179730412%26providerId%3Durn%25253Amace%25253Aeduserv.org.uk%25253Aathens%25253Afederation%25253Auk!jw35!!pwd!33534!!2!IESCcka6W7SOI3Hp3X2.eoZP8CU32oUjgt0Y0PkfsSbY4RstzNmKBrEdF5UjYuC5JIcsZvA.W20mTmaVnsjq7qFi14rMD6wHPl1JCIO9EN3lZWkPKzTWDUwS8Ekrt.g60KPyJwnGEwJw7RFoMwKE8JQAS5HDyTZy6BNkhs5qnM4_

9. Sets Ucam-WebAuth-Session-S cookie, redirects to

https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=ZFA0aXhSZjhjNHhXV2MybasvguUrMSbNF5sQ4lSOgc6317IRIVcse4G3po0e%2BkWkz2MtytmCl%2B0sgd12a3uByyf82zWgUB%2BcZe%2FimgKgJzOET1vdzFFpZocqwozvWLt49CZggwR2eq%2B80kq%2FuAcNARhOzkC8vyboZr6JEpHCm%2FfPZTvKgfZkXtMQ2YS4J%2FtwpOng%2Fo%2BGtBTNjt5AEYUT0Btk7zcAiJ7DTYij53WZiAPFmabB4A%2FPjxKKtsy9%2BnS8XOU13ha3MPMPtxU4H5l9FD1hYCM0M10XbgFYcKGlXW0%3D&time=1179730412&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk

10. Sets JSESSIONID and shib_sp_<tandom hex> cookies. Displays 'Auth comlete, please wait' page. Posts to

https://auth.athensams.net/saml/PostRcv

11. Sets ath_da=2, ath_username=_<random hex>, ath_ltoken=<random hex>. Requests (via a no-delay META-refresh)

http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFDOKP4WcWDnunpfQ%3E

12. Redirects to

http://service.filmandsound.ac.uk/WebZ/html/tan.html?sessionid=01-44028-1376784429&active=3

13. Displays Film and Sound's terms of use

Repeat, already authenticated

1. Try Film & Sound @ http://www.filmandsound.ac.uk/ again with all Athens cookies in place. Choose 'Athens login'

http://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=31&y=13

2. Redirects to

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=31&y=13

3. Via a zero-delay METTA-refresh, equests

http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFHJqOzQzRuLRnNWw%3E

4. Redirects to

http://service.filmandsound.ac.uk/WebZ/html/tan.html?sessionid=01-44028-1817385508&active=3

5. Displays Film and Sound's terms of use

Repeat in new browser session

1. Try Film & Sound @ http://www.filmandsound.ac.uk/ again with only persistent Athens cookies in place. Choose 'Athens login'

http://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=26&y=13

2. Redirects to

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=26&y=13

3. Displays 'Continue to login' page. Select 'Cambridge University library' link

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Aprovider%3Acam.ac.uk&ath_action=shaauth

4. Redirects to

https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=cFJ2aWhGTDRtNFZBcVZoSmylfpDG2jY1l1PO4zKMOxjqmUD7Cy%2BktbLd8K3TjeLkTDhgMNWFQoGDjKWt77selxYlANweI2BM47hiIv6M%2FcKlXrur1zSi3ngI7wbJawUAlhsIPdKqPKNYF0x%2BjzT4Ge9f8wmnCywIFi%2BWovXY1WTK431Dmf6hq9Xd4dyXh2b%2Bi2J4w5TOQ8dT86ur6M018xUcXKXpNrKGAJYKn55C3qLRzbEYF9KLGyeNybH6yX%2FzfgNU1dhg4LWqarDTSuV809SjCjQ52qSP8ADWzYBPFYg%3D&time=1179732171&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk

5. Redirects to

https://raven.cam.ac.uk/auth/authenticate.html?ver=1&url=https%3a%2f%2fshib.raven.cam.ac.uk%2fshibboleth-idp%2fSSO%3fshire%3dhttps%253A%252F%252Fauth.athensams.net%252Fsaml%252FPostRcv%26target%3dYVdvdjFKQlFzUmVQVlExeQyQ5Sezpjz50d18RNO7SlWT0GWE%252BImfLfQxBYHDhtpVSAjPH1F8xGhzQg2LRwtwM4328%252Ft5aiHN23PcTYIHc98ZdwiftHXrN31DjkC3FdcVY%252Fvb6JZMG2p4Fd4lhbxPbWw450d2yMiy4IOhP9x%252FmJ5MwR8yTnRpCXbpXGrYiUG8oSXV4%252Bu9dk8Jz%252BgBkwuTq%252FQMUS%252BuqIR%252FNEgNpYuQISEIBMnRYzzXwHfWEzy00sdQ5vvXADWYq%252FXjG4VUirc%252B%252BQQd9zbQSracWmfHFa2Nw3I%253D%26time%3d1179756160%26providerId%3durn%253Amace%253Aeduserv.org.uk%253Aathens%253Afederation%253Auk&date=20070521T140240Z&desc=the%20University%20pilot%20Shibboleth%20service

5. Displays 'Raven confirmation'. Click 'Continue'

https://raven.cam.ac.uk/auth/authenticate4.html

6. Redirects to

https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?WLS-Response=1!200!!20070521T072505Z!1179732172-25012-12!https%3A%2F%2Fshib.raven.cam.ac.uk%2Fshibboleth-idp%2FSSO%3Fshire%3Dhttps%25253A%25252F%25252Fauth.athensams.net%25252Fsaml%25252FPostRcv%26target%3DcFJ2aWhGTDRtNFZBcVZoSmylfpDG2jY1l1PO4zKMOxjqmUD7Cy%25252BktbLd8K3TjeLkTDhgMNWFQoGDjKWt77selxYlANweI2BM47hiIv6M%25252FcKlXrur1zSi3ngI7wbJawUAlhsIPdKqPKNYF0x%25252BjzT4Ge9f8wmnCywIFi%25252BWovXY1WTK431Dmf6hq9Xd4dyXh2b%25252Bi2J4w5TOQ8dT86ur6M018xUcXKXpNrKGAJYKn55C3qLRzbEYF9KLGyeNybH6yX%25252FzfgNU1dhg4LWqarDTSuV809SjCjQ52qSP8ADWzYBPFYg%25253D%26time%3D1179732171%26providerId%3Durn%25253Amace%25253Aeduserv.org.uk%25253Aathens%25253Afederation%25253Auk!jw35!!pwd!35802!!2!kllLpHThJRMfWGRzOa17SyUm1tZR5NAO90p0RrCT.1Eyi0jZk7mLWVO5EiRJkTnNIJEt.DuEA2p1hQrxeDl5Pk38om-3oWQjXP9iH21rm9xwLphfiqSZERwX1lBXmKCA1L2Mtc5UUvReUFLje-HTaMMQUc2c38Uivr8q.vksW5I_

7. Sets Ucam-WebAuth-Session-S cookie, redirects to

https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=cFJ2aWhGTDRtNFZBcVZoSmylfpDG2jY1l1PO4zKMOxjqmUD7Cy%2BktbLd8K3TjeLkTDhgMNWFQoGDjKWt77selxYlANweI2BM47hiIv6M%2FcKlXrur1zSi3ngI7wbJawUAlhsIPdKqPKNYF0x%2BjzT4Ge9f8wmnCywIFi%2BWovXY1WTK431Dmf6hq9Xd4dyXh2b%2Bi2J4w5TOQ8dT86ur6M018xUcXKXpNrKGAJYKn55C3qLRzbEYF9KLGyeNybH6yX%2FzfgNU1dhg4LWqarDTSuV809SjCjQ52qSP8ADWzYBPFYg%3D&time=1179732171&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk

8. Sets JSESSIONID and shib_sp_<random hex> cookies. Displays 'Auth complete, please wait' page, posts to

https://auth.athensams.net/saml/PostRcv

9. Sets ath_da, ath_username, ath_ltoken cookies. Uses a zero-delay META-refresh to request

http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFJmKPUztPFgr%2BvKA%3E

10. Redirects to

http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFJmKPUztPFgr%2BvKA%3E

11. Displays F&S's T&Cs.

Access different site

1. African-American Poetry @ http://collections.chadwyck.co.uk/daap/htxview?template=basic.htx&content=frameset.htx. Select 'Athens users log in'

http://collections.chadwyck.co.uk/athens/

2. Somehow(?) redirect to

http://auth.athensams.net/?ath_returl=%22http%3A%2F%2Fcollections.chadwyck.co.uk%2FathensLogin%22&ath_dspid=CHADWYCK

3. Redirect to

https://auth.athensams.net/?ath_returl=%22http%3A%2F%2Fcollections.chadwyck.co.uk%2FathensLogin%22&ath_dspid=CHADWYCK

4. Via a zero-delay METTA-refresh, redirect to

http://collections.chadwyck.co.uk/athensLogin?ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFNfaOPC26cgSyPKw%3E

5. Redirect to

http://collections.chadwyck.co.uk/home/home_aap.jsp?template=basic.htx&content=frameset.htx

6. Display front page

Classic Athens, from clean start

1. Starting with no cookies, login to Film & Sound @ http://www.filmandsound.ac.uk/. Choose 'Athens login'

http://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=25&y=4

2. Redirect to

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=25&y=4

3. Displays Athens username/password page. Enter username/password, click login. Posts to the following with ath_uname and ath_passwd as POST parameters

https://auth.athensams.net/?ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&ath_dspid=EDINA.FILMSOUND

4. Sets ath_username, ath_ltoken. Requests, via a zero-delay META-refresh

http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=camtsjw35&ath_ttok=%3CRlFhI6NBcCQXmBz75w%3E

Athens DA Protocol: Difference between revisions

Latest revision as of 10:01, 22 May 2007

Contents

How it works

Information provided to content providers

URLs

Cookies

Authentication sequences

Clean start

Another site, while still logged-in

Any site, having quit and restart the browser

Classic Athens (for comparison)

Captured URLs

Default start

The same, as if from Cambridge

Repeat, already authenticated

Repeat in new browser session

Access different site

Classic Athens, from clean start

Navigation menu

Page actions

Page actions

Personal tools

Navigation

Search

Tools

@@ Line 1: / Line 1: @@
 {{shib-project}}
-As I understand it, the Shib->Athens gateway effectively uses EduServ's proprietary Athens DA protocol once you've actually authenticated. Details of the protocol are not available to the likes of us, but here are some notes on aspects of it that I have deduced.
+When using the gateway, you are in effect using [http://www.athensams.net/local_auth/athensda AthensDA], except that the eXtensible Authentication Point (XAP) (see [http://www.athensams.net/upload/athens/pdf/da_integration_guide.pdf AthensDA integration guide]) is run by Athens and delegates to the local site's Shibboleth IdP to identify users. Because of this, there is quite a lot of useful information to be found in the JISCMail [http://www.jiscmail.ac.uk/lists/athensda.html AthensDA list] as well as the [http://www.jiscmail.ac.uk/lists/JISC-SHIBBOLETH.html JISC-Shibboleth list]
-==Identifiers==
+Details of the protocol between Athens and the XAP are available in the [http://www.athensams.net/upload/athens/pdf/da_integration_guide.pdf AthensDA integration guide]. Details of the protocol between Athens and the DSPs are largely available in [http://www.athensams.net/upload/athens/pdf/dspintegrationguide.pdf DSP integration guide] though there are additional resources that are only available to DSPs.
-The protocol apparently transfers at least two attributes to the content provider: a user name and a persistent unique ID. When using the gateway, the user name is a 20-character random string starting '_' and the persistent unique ID is set from the eduPersonTargetedID provided by Shib. Apparently there is no guarantee that the random user names won't change, though they don't at the moment.
+==How it works==
+When using the gateway you end up with a chain of 4 things, each (except the last) deferring identifying who you are to the next one:
+  Resource1 --> Athens --> Raven/Shibboleth --> Raven ---
+                                                         |
+  Resource1 <-- Athens <-- Raven/Shibboleth <-- Raven <--
+Each one remembers who you are if it's already seen you during the current browser session. For example you can keep on accessing the resource without further reference to Athens:
+  Resource1 ---
+               |
+  Resource1 <--
+and you can access a new Athens resource without further reference to Raven/Shibboleth
+  Resource2 --> Athens ---
+                          |
+  Resource2 <-- Athens <--
+==Information provided to content providers==
+The protocol apparently transfers at least the following to the content provider:
+* a user name. When using the gateway, the user name is a 20-character random string starting '_'; apparently there is no guarantee that these will always be the same for the same user, but at present they are.
+* a persistent unique ID. When using the gateway, this is based on the eduPersonTargetedID provided by Shib, though it's not the same
+* an Organisation_Id, identifying the user's home organization
+Other data is also available, see the [http://www.athensams.net/upload/athens/pdf/dspintegrationguide.pdf DSP integration guide].
 ==URLs==
-  ...In fact you can now, by appending
+Various 'interesting' URLs can be identified by watching the http interaction or by reading submissions to the mailing lists, but only a few are actually documented for use:
-  '&ath_action=daauth&id={your_site_id}' to an Athens AAP URL.
+The [http://www.athensams.net/upload/athens/pdf/da_integration_guide.pdf AthensDA integration guide] (section 3.4.4) documents the 'setorg' URL which can be used to set the ath_ldom cookie identifying the user's home institution. Note that <returl> can be anything, including other Athens URLs
-  Eg. To access the OED:
+  http://auth.athensams.net/setorg.php?id=<providerid>&ath_returl=<returl>
-  http://auth.athensams.net/?ath_dspid=OUP.OED&ath_returl=http%3A%2F%2Fdiction
-  ary.oed.com%2Fentrance.dtl&ath_action=daauth&id=={your_site_id}
+** <providerid> your providerid
+** <returl> URL to return to once the cookie is set
-  This does not set the ldom cookie. If you want to set the cookie at the same
-  time, then you can use the method John suggests.
+The [http://www.athensams.net/upload/athens/pdf/local_auth_integration_standards.pdf Local Authentication Integration Standards] document includes a logout url to terminate Athens authentication:
+ https://auth.athensams.net/?ath_action=ssologout&ath_returl=<returl>
+** <returl> is optional and provides a URL to refer the user to once logout is complete.
-  ...the setorg page ensuring the ath_ldom cookie is set and bypassing the HDDS pages.
+RSS feed of available resources: https://auth.athensams.net/my/resources/rss (but only available once authenticated?)
-  e.g.
-  https://auth.athensams.net/?id=[site ID]&ath_returl=[persistent link URL]
+Target Resource Locators (TRLs) are provided for creating persistent URLs to resources that will trigger authentication:
+  From: Eduserv Athens Local Authentication Support <athens-la@EDUSERV.ORG.UK>
+  To: ATHENSDA@JISCMAIL.AC.UK
+  Date: Tue, 14 Feb 2006 17:20:10 -0000
+  ...
    The new service URL format is called a target resource locator (TRL),
    which uses a combination of:
@@ Line 37: / Line 70: @@
    https://auth.athensams.net/trl/1.0/-/RESOURCE_ID
-  https://auth.athensams.net/trl/1.0/-/RESOURCE_ID?ath_action=noHddsSession
+It appears that adding ?ath_action=noHddsSession will bypass the HDD service and so allow someone logged in via the gateway to access a particular service using their Classic Athens account:
+  From: Eduserv Athens Local Authentication Support <athens-la@EDUSERV.ORG.UK>
+  To: JISC-SHIBBOLETH@JISCMAIL.AC.UK
+  Date: Tue, 14 Feb 2006 17:20:08 -0000
+  Subject: Access to services not compliant with Shibboleth - Athens gateway
+  As some of you know, Eduserv have been working on a method of allowing
+  users at Shibboleth IdPs to use Athens-protected services that do not
+  meet Athens implementation standards...
+  The fix developed by Eduserv allows a user from a Shibboleth IdP to log
+  into non-gateway compliant services with a classic Athens account.  It
+  uses a URL format called a target resource locator (TRL), which uses a
+  combination of:
+  * the URL of the Athens authentication point (AP)
+  * a TRL identifier
+  * a resource identifier
+  * an extra parameter to pass at the Athens AP: ath_action=noHddsSession
+  The basic format of a TRL is therefore:
+  https://auth.athensams.net/trl/1.0/-/RESOURCE_ID?ath_action=noHddsSession
+  A list of TRLs for non-gateway compliant services is below [...]
+  Dialog DataStar
+  https://auth.athensams.net/trl/1.0/-/DIALOG_DATASTAR?ath_action=noHddSession
+  International Who's Who
+  https://auth.athensams.net/trl/1.0/-/WORLD_WHO_WHO?ath_action=noHddSession
+  JISC PDS
+  https://auth.athensams.net/trl/1.0/-/PDS?ath_action=noHddSession
+  LexisNexis Professional and Executive
+  https://auth.athensams.net/trl/1.0/-/Lexis?ath_action=noHddSession
+  Oxford Scholarship Online
+  https://auth.athensams.net/trl/1.0/-/OUP_OSO?ath_action=noHddSession
+  ProQuest
+  https://auth.athensams.net/trl/1.0/-/PROQUEST?ath_action=noHddSession
 ==Cookies==
-* ath_ldom, domain .athensams.net, expires 2012: contains providerID, appears to drive the Home Domain Discovery service. It may be that this can be set with, e.g., https://auth.athensams.net/?id=[site ID]&ath_returl=[persistent link URL]
+* ath_ldom, domain .athensams.net, expires +5 yeasrs: contains hom providerID, used by the Home Domain Discovery service to automatically refer authentication to the gateway.
+* ath_da, domain .athensams.net, session: set following authentication, purpose unknown, contains '2'
+* ath_username, domain .athensams.net, session: set following authentication, contains Athens usrname, used to support SSO
+* ath_ltoken, domain .athensams.net, session: contains the L token which supports SSO
+* __utma, __utmb, __utmc, __utmz: Google analyticics
+==Authentication sequences==
+===Clean start===
+Starting with no relevant cookies, choosing 'Athens login' takes you to
+ http://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>
+* <dspid> is the service providerid - e.g. EDINA.FILMSOUND
+* <returl> is the URL to access once authentication is complete
+This results in a redirect to the same URL over https, which displays the [[Media:Athens-login.png | Athens user id/password box]] (possibly customised for the site). Selecting 'Alternate login from there takes you to
+ https://auth.athensams.net/orglist.php?ath_returl=<returl>&ath_dspid=<dspid>
+which displays the [[Media:Athens-alternate-login.png | standard Athens HDDS organisation chooser]]. Selecting a particular organisation takes you to
+ https://auth.athensams.net/setsite.php?ath_dspid=<dspid>&ath_returl=<returl>&id=<providerid>
+* <providerid> is the selected identity provider's id
+This displays a [[Media:Athens-setsite-confirm.png | message confirming the institution]] and asking if you want to remember it (in the ath_ldom cookie) for the future. Clicking 'GO>>' (assuming you leave the remember box checked) takes you to
+ https://auth.athensams.net/setsite.php?ath_dspid=<dspid>&ath_returl=<returl>&id=<providerid>&originProfile=4&doLogin=1&remChk=1&submit=++++Go+%BB+++
+which redirects to
+ https://auth.athensams.net/?ath_action=setldom&id=<providerid>&ath_dspid=<dspid>&ath_returl=<returl>
+which sets the ath_ldom cookie and redirects to
+ https://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>&id=<prviderid>&ath_action=shaauth
+Which redirects to the organisation's Shibboleth SSO handler. The ''target'' authentication request parameter, normally the URL of the eventual target of the authentication, appears to be an opaque string of some sort, perhaps the AthensDA DA_sso_req packet.
+The organisation completes a Shibboleth authentication and posts the result to
+ https://auth.athensams.net/saml/PostRcv
+The post contains a copy of the <target> from the request and the a SAML authentication response. This sets session cookies ath_da=2, ath_username=<id>, and ath_ltoken=<ltoken>.
+* <id> is an Athens userid. When using the gateway this is a randomly allocated string starting '_', e.g. _wplsf6omk2rfw7lfveb
+* <ltoken> is the AthensDA 'L' token, used to maintain SSO session, e.g. %3CRlMlVeMTj8BvvBMx3w%3E
+A zero-delay META-refresh then causes the browser to retrieve:
+ <returl>&ath_user=<id>&ath_ttok=<ttoken>
+* <ttoken> is the AThensDA 'T' token, used to transfer the user's identity to the DSP, e.g. %3CRlK1EaMyq%2FIMcMjuAA%3E
+which redirects to the real service URL.
+===Another site, while still logged-in===
+Choosing 'Athens login' goes to
+ http://auth.athensams.net/?ath_returl=<returk>&ath_dspid=<dspid>
+which redirects to the same URL over https, which uses a zero-delay META-refresh to causes the browser to request
+ <returl>?ath_user=<id>&ath_ttok=<tok>
+which redirects to the real service URL.
+===Any site, having quit and restart the browser===
+Choosing 'Athens login' goes to
+ http://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>
+which redirects to the same URL over https: which displays the [[Media:Athens-login-continue.png | Continue to login page]]. Selecting the main link takes you to
+ https://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>id=<providerid>&ath_action=shaauth
+Which redirects to the organisation's Shibboleth SSO handler. The ''target'' authentication request parameter, normally the URL of the eventual target of the authentication, appears to be an opaque string of some sort, perhaps the AthensDA DA_sso_req packet.
+The organisation completes a Shibboleth authentication and posts the result to
+ https://auth.athensams.net/saml/PostRcv
+The post contains a copy of the <target> from the request and the a SAML authentication response. This sets session cookies ath_da=2, ath_username=<id>, and ath_ltoken=<ltoken>.
+* <id> is an Athens userid. When using the gateway this is a randomly allocated string starting '_', e.g. _wplsf6omk2rfw7lfveb
+* <ltoken> is the AthensDA 'L' token, used to maintain SSO session, e.g. %3CRlMlVeMTj8BvvBMx3w%3E
+A zero-delay META-refresh then causes the browser to retrieve:
+ <returl>&ath_user=<id>&ath_ttok=<ttoken>
+* <ttoken> is the AThensDA 'T' token, used to transfer the user's identity to the DSP, e.g. %3CRlK1EaMyq%2FIMcMjuAA%3E
+which redirects to the real service URL.
+===Classic Athens (for comparison)===
+Choosing 'Athens login' takes you to
+ http://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>
+This redirects to the same URL over https:, which displays the Athens username/password page. Entering a username/password and clicking login posts ath_uname and ath_passwd to
+ https://auth.athensams.net/?ath_returl=<returl>&ath_dspid=<dspid>
+This sets session cookies ath_da=2, ath_username=<id>, and ath_ltoken=<ltoken>.
+* <id> is an Athens userid. When using the gateway this is a randomly allocated string starting '_', e.g. _wplsf6omk2rfw7lfveb
+* <ltoken> is the AthensDA 'L' token, used to maintain SSO session, e.g. %3CRlMlVeMTj8BvvBMx3w%3E
+A zero-delay META-refresh then causes the browser to retrieve:
+ <returl>&ath_user=<id>&ath_ttok=<ttoken>
+* <ttoken> is the AThensDA 'T' token, used to transfer the user's identity to the DSP, e.g. %3CRlK1EaMyq%2FIMcMjuAA%3E
+which redirects to the real service URL.
+==Captured URLs==
+Real URLs captured during various interactions:
+===Default start===
+. Starting with no cookies, login to Film & Sound @ http://www.filmandsound.ac.uk/. Choose 'Athens login'
+ http://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=42&y=14
+. redirect to
+ https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=42&y=14
+. Displays Athens username & password box. Select 'Alternative Login'
+ https://auth.athensams.net/orglist.php?ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&ath_dspid=EDINA.FILMSOUND
+. Displays Athens HDDS chooser. Select 'Cardiff University' ('cos Cambridge not yet live)
+ https://auth.athensams.net/setsite.php?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=https%3A%2F%2Fidp.cardiff.ac.uk%2Fshibboleth&oid=218
+. Displays 'Go to Cardiff University' page with 'Save on this computer. Click 'OK'
+ https://auth.athensams.net/setsite.php?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=https%3A%2F%2Fidp.cardiff.ac.uk%2Fshibboleth&oid=218
+. redirect to
+ https://auth.athensams.net/?ath_action=setldom&id=https://idp.cardiff.ac.uk/shibboleth&ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D
+. Sets auth_ldom cookie, redirects to
+ https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=https%3A%2F%2Fidp.cardiff.ac.uk%2Fshibboleth&ath_action=shaauth
+. redirect to
+ https://idp.cardiff.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=WlpjSDFUcHp5dDREMGZpQk34kltZLjGuSYUxm7fxxIlcNti8frex3VK3vKyylGgyyzGL6W5YzeAZmDt%2FVe6kyMQ36IzB5W3y%2FHNJTjDozxiJT5%2BI7MAwj0qTeGq4J3do8atjki5vpU%2B%2ByRN2WzeNYfzqmBRWH%2FTX96c1T8c9H5yEvu4W72Eq%2FcmseFd%2F%2FOQrGdJLay5qNu0dTh6tmK8Gu5WsrX9jCh8HZVxttqtt5aVQZdwLLW8Oz4RB19PVBz0M3tmfT58Kl2ffxqZEMJtIjXA2anf2XBpk80JmnrQJWNc%3D&time=1179728690&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk
+. Displays Cardiff's local authentication page
+===The same, as if from Cambridge===
+. Fake the result of 4) above but choosing 'Cambridge' from the HDDS chooser by entering
+ https://auth.athensams.net/setsite.php?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=urn:mace:eduserv.org.uk:athens:provider:cam.ac.uk
+. Displays 'Go to the Cambridge University login' page. Leave 'Remember this Org' checked. Click 'Go>>'
+ https://auth.athensams.net/setsite.php?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Aprovider%3Acam.ac.uk&originProfile=4&doLogin=1&remChk=1&submit=++++Go+%BB+++
+. Redirects to
+ https://auth.athensams.net/?ath_action=setldom&id=urn:mace:eduserv.org.uk:athens:provider:cam.ac.uk&ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D
+. Sets auth_ldom cookie, redirects to
+ https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Aprovider%3Acam.ac.uk&ath_action=shaauth
+. Redirects to
+ https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=ZFA0aXhSZjhjNHhXV2MybasvguUrMSbNF5sQ4lSOgc6317IRIVcse4G3po0e%2BkWkz2MtytmCl%2B0sgd12a3uByyf82zWgUB%2BcZe%2FimgKgJzOET1vdzFFpZocqwozvWLt49CZggwR2eq%2B80kq%2FuAcNARhOzkC8vyboZr6JEpHCm%2FfPZTvKgfZkXtMQ2YS4J%2FtwpOng%2Fo%2BGtBTNjt5AEYUT0Btk7zcAiJ7DTYij53WZiAPFmabB4A%2FPjxKKtsy9%2BnS8XOU13ha3MPMPtxU4H5l9FD1hYCM0M10XbgFYcKGlXW0%3D&time=1179730412&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk
+. Redirects to
+ https://raven.cam.ac.uk/auth/authenticate.html?ver=1&url=https%3a%2f%2fshib.raven.cam.ac.uk%2fshibboleth-idp%2fSSO%3fshire%3dhttps%253A%252F%252Fauth.athensams.net%252Fsaml%252FPostRcv%26target%3dZFA0aXhSZjhjNHhXV2MybasvguUrMSbNF5sQ4lSOgc6317IRIVcse4G3po0e%252BkWkz2MtytmCl%252B0sgd12a3uByyf82zWgUB%252BcZe%252FimgKgJzOET1vdzFFpZocqwozvWLt49CZggwR2eq%252B80kq%252FuAcNARhOzkC8vyboZr6JEpHCm%252FfPZTvKgfZkXtMQ2YS4J%252FtwpOng%252Fo%252BGtBTNjt5AEYUT0Btk7zcAiJ7DTYij53WZiAPFmabB4A%252FPjxKKtsy9%252BnS8XOU13ha3MPMPtxU4H5l9FD1hYCM0M10XbgFYcKGlXW0%253D%26time%3d1179730412%26providerId%3durn%253Amace%253Aeduserv.org.uk%253Aathens%253Afederation%253Auk&date=20070521T065333Z&desc=the%20University%20pilot%20Shibboleth%20service
+. Displays 'Raven confirmation'. Click Continue
+ https://raven.cam.ac.uk/auth/authenticate4.html
+. Redirects to
+ https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?WLS-Response=1!200!!20070521T065751Z!1179730417-25013-8!https%3A%2F%2Fshib.raven.cam.ac.uk%2Fshibboleth-idp%2FSSO%3Fshire%3Dhttps%25253A%25252F%25252Fauth.athensams.net%25252Fsaml%25252FPostRcv%26target%3DZFA0aXhSZjhjNHhXV2MybasvguUrMSbNF5sQ4lSOgc6317IRIVcse4G3po0e%25252BkWkz2MtytmCl%25252B0sgd12a3uByyf82zWgUB%25252BcZe%25252FimgKgJzOET1vdzFFpZocqwozvWLt49CZggwR2eq%25252B80kq%25252FuAcNARhOzkC8vyboZr6JEpHCm%25252FfPZTvKgfZkXtMQ2YS4J%25252FtwpOng%25252Fo%25252BGtBTNjt5AEYUT0Btk7zcAiJ7DTYij53WZiAPFmabB4A%25252FPjxKKtsy9%25252BnS8XOU13ha3MPMPtxU4H5l9FD1hYCM0M10XbgFYcKGlXW0%25253D%26time%3D1179730412%26providerId%3Durn%25253Amace%25253Aeduserv.org.uk%25253Aathens%25253Afederation%25253Auk!jw35!!pwd!33534!!2!IESCcka6W7SOI3Hp3X2.eoZP8CU32oUjgt0Y0PkfsSbY4RstzNmKBrEdF5UjYuC5JIcsZvA.W20mTmaVnsjq7qFi14rMD6wHPl1JCIO9EN3lZWkPKzTWDUwS8Ekrt.g60KPyJwnGEwJw7RFoMwKE8JQAS5HDyTZy6BNkhs5qnM4_
+. Sets Ucam-WebAuth-Session-S cookie, redirects to
+ https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=ZFA0aXhSZjhjNHhXV2MybasvguUrMSbNF5sQ4lSOgc6317IRIVcse4G3po0e%2BkWkz2MtytmCl%2B0sgd12a3uByyf82zWgUB%2BcZe%2FimgKgJzOET1vdzFFpZocqwozvWLt49CZggwR2eq%2B80kq%2FuAcNARhOzkC8vyboZr6JEpHCm%2FfPZTvKgfZkXtMQ2YS4J%2FtwpOng%2Fo%2BGtBTNjt5AEYUT0Btk7zcAiJ7DTYij53WZiAPFmabB4A%2FPjxKKtsy9%2BnS8XOU13ha3MPMPtxU4H5l9FD1hYCM0M10XbgFYcKGlXW0%3D&time=1179730412&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk
+.  Sets JSESSIONID and shib_sp_<tandom hex> cookies. Displays 'Auth comlete, please wait' page. Posts to
+ https://auth.athensams.net/saml/PostRcv
+. Sets ath_da=2, ath_username=_<random hex>, ath_ltoken=<random hex>. Requests (via a no-delay META-refresh)
+ http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFDOKP4WcWDnunpfQ%3E
+. Redirects to
+ http://service.filmandsound.ac.uk/WebZ/html/tan.html?sessionid=01-44028-1376784429&active=3
+. Displays Film and Sound's terms of use
+===Repeat, already authenticated===
+. Try Film & Sound @ http://www.filmandsound.ac.uk/ again with all Athens cookies in place. Choose 'Athens login'
+ http://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=31&y=13
+. Redirects to
+ https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=31&y=13
+. Via a zero-delay METTA-refresh, equests
+ http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFHJqOzQzRuLRnNWw%3E
+. Redirects to
+ http://service.filmandsound.ac.uk/WebZ/html/tan.html?sessionid=01-44028-1817385508&active=3
+. Displays Film and Sound's terms of use
+===Repeat in new browser session===
+. Try Film & Sound @ http://www.filmandsound.ac.uk/ again with only persistent Athens cookies in place. Choose 'Athens login'
+ http://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=26&y=13
+. Redirects to
+ https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=26&y=13
+. Displays 'Continue to login' page. Select 'Cambridge University library' link
+ https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Aprovider%3Acam.ac.uk&ath_action=shaauth
+. Redirects to
+ https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=cFJ2aWhGTDRtNFZBcVZoSmylfpDG2jY1l1PO4zKMOxjqmUD7Cy%2BktbLd8K3TjeLkTDhgMNWFQoGDjKWt77selxYlANweI2BM47hiIv6M%2FcKlXrur1zSi3ngI7wbJawUAlhsIPdKqPKNYF0x%2BjzT4Ge9f8wmnCywIFi%2BWovXY1WTK431Dmf6hq9Xd4dyXh2b%2Bi2J4w5TOQ8dT86ur6M018xUcXKXpNrKGAJYKn55C3qLRzbEYF9KLGyeNybH6yX%2FzfgNU1dhg4LWqarDTSuV809SjCjQ52qSP8ADWzYBPFYg%3D&time=1179732171&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk
+. Redirects to
+ https://raven.cam.ac.uk/auth/authenticate.html?ver=1&url=https%3a%2f%2fshib.raven.cam.ac.uk%2fshibboleth-idp%2fSSO%3fshire%3dhttps%253A%252F%252Fauth.athensams.net%252Fsaml%252FPostRcv%26target%3dYVdvdjFKQlFzUmVQVlExeQyQ5Sezpjz50d18RNO7SlWT0GWE%252BImfLfQxBYHDhtpVSAjPH1F8xGhzQg2LRwtwM4328%252Ft5aiHN23PcTYIHc98ZdwiftHXrN31DjkC3FdcVY%252Fvb6JZMG2p4Fd4lhbxPbWw450d2yMiy4IOhP9x%252FmJ5MwR8yTnRpCXbpXGrYiUG8oSXV4%252Bu9dk8Jz%252BgBkwuTq%252FQMUS%252BuqIR%252FNEgNpYuQISEIBMnRYzzXwHfWEzy00sdQ5vvXADWYq%252FXjG4VUirc%252B%252BQQd9zbQSracWmfHFa2Nw3I%253D%26time%3d1179756160%26providerId%3durn%253Amace%253Aeduserv.org.uk%253Aathens%253Afederation%253Auk&date=20070521T140240Z&desc=the%20University%20pilot%20Shibboleth%20service
+. Displays 'Raven confirmation'. Click 'Continue'
+ https://raven.cam.ac.uk/auth/authenticate4.html
+. Redirects to
+ https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?WLS-Response=1!200!!20070521T072505Z!1179732172-25012-12!https%3A%2F%2Fshib.raven.cam.ac.uk%2Fshibboleth-idp%2FSSO%3Fshire%3Dhttps%25253A%25252F%25252Fauth.athensams.net%25252Fsaml%25252FPostRcv%26target%3DcFJ2aWhGTDRtNFZBcVZoSmylfpDG2jY1l1PO4zKMOxjqmUD7Cy%25252BktbLd8K3TjeLkTDhgMNWFQoGDjKWt77selxYlANweI2BM47hiIv6M%25252FcKlXrur1zSi3ngI7wbJawUAlhsIPdKqPKNYF0x%25252BjzT4Ge9f8wmnCywIFi%25252BWovXY1WTK431Dmf6hq9Xd4dyXh2b%25252Bi2J4w5TOQ8dT86ur6M018xUcXKXpNrKGAJYKn55C3qLRzbEYF9KLGyeNybH6yX%25252FzfgNU1dhg4LWqarDTSuV809SjCjQ52qSP8ADWzYBPFYg%25253D%26time%3D1179732171%26providerId%3Durn%25253Amace%25253Aeduserv.org.uk%25253Aathens%25253Afederation%25253Auk!jw35!!pwd!35802!!2!kllLpHThJRMfWGRzOa17SyUm1tZR5NAO90p0RrCT.1Eyi0jZk7mLWVO5EiRJkTnNIJEt.DuEA2p1hQrxeDl5Pk38om-3oWQjXP9iH21rm9xwLphfiqSZERwX1lBXmKCA1L2Mtc5UUvReUFLje-HTaMMQUc2c38Uivr8q.vksW5I_
+. Sets Ucam-WebAuth-Session-S cookie, redirects to
+ https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=cFJ2aWhGTDRtNFZBcVZoSmylfpDG2jY1l1PO4zKMOxjqmUD7Cy%2BktbLd8K3TjeLkTDhgMNWFQoGDjKWt77selxYlANweI2BM47hiIv6M%2FcKlXrur1zSi3ngI7wbJawUAlhsIPdKqPKNYF0x%2BjzT4Ge9f8wmnCywIFi%2BWovXY1WTK431Dmf6hq9Xd4dyXh2b%2Bi2J4w5TOQ8dT86ur6M018xUcXKXpNrKGAJYKn55C3qLRzbEYF9KLGyeNybH6yX%2FzfgNU1dhg4LWqarDTSuV809SjCjQ52qSP8ADWzYBPFYg%3D&time=1179732171&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk
+. Sets JSESSIONID and shib_sp_<random hex> cookies. Displays 'Auth complete, please wait' page, posts to
+ https://auth.athensams.net/saml/PostRcv
+. Sets ath_da, ath_username, ath_ltoken cookies. Uses a zero-delay META-refresh to request
+ http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFJmKPUztPFgr%2BvKA%3E
+. Redirects to
+ http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFJmKPUztPFgr%2BvKA%3E
+. Displays F&S's T&Cs.
+===Access different site===
+.   African-American Poetry @  http://collections.chadwyck.co.uk/daap/htxview?template=basic.htx&content=frameset.htx. Select 'Athens users log in'
+ http://collections.chadwyck.co.uk/athens/
+. Somehow(?) redirect to
+ http://auth.athensams.net/?ath_returl=%22http%3A%2F%2Fcollections.chadwyck.co.uk%2FathensLogin%22&ath_dspid=CHADWYCK
+. Redirect to
+ https://auth.athensams.net/?ath_returl=%22http%3A%2F%2Fcollections.chadwyck.co.uk%2FathensLogin%22&ath_dspid=CHADWYCK
+. Via a zero-delay METTA-refresh, redirect to
+ http://collections.chadwyck.co.uk/athensLogin?ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFNfaOPC26cgSyPKw%3E
+. Redirect to
+ http://collections.chadwyck.co.uk/home/home_aap.jsp?template=basic.htx&content=frameset.htx
+. Display front page
+===Classic Athens, from clean start===
+. Starting with no cookies, login to Film & Sound @ http://www.filmandsound.ac.uk/. Choose 'Athens login'
+ http://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=25&y=4
+. Redirect to
+ https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=25&y=4
+. Displays Athens username/password page. Enter username/password, click login. Posts to the following with ath_uname and ath_passwd as POST parameters
+ https://auth.athensams.net/?ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&ath_dspid=EDINA.FILMSOUND
+. Sets ath_username, ath_ltoken. Requests, via a zero-delay META-refresh
+ http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=camtsjw35&ath_ttok=%3CRlFhI6NBcCQXmBz75w%3E