Athens DA Protocol: Difference between revisions

Latest revision as of 10:01, 22 May 2007

WARNING: This page is retained as a historical record but is out-of-date and is not being maintained.

This was a working document belonging to the Computing Service's Shibboleth Development Project. This project is complete (Raven now supports Shibboleth) and this document only remains for historical and reference purposes. Be aware that it is not being maintained and may be misleading if read out of context.

When using the gateway, you are in effect using AthensDA, except that the eXtensible Authentication Point (XAP) (see AthensDA integration guide) is run by Athens and delegates to the local site's Shibboleth IdP to identify users. Because of this, there is quite a lot of useful information to be found in the JISCMail AthensDA list as well as the JISC-Shibboleth list

Details of the protocol between Athens and the XAP are available in the AthensDA integration guide. Details of the protocol between Athens and the DSPs are largely available in DSP integration guide though there are additional resources that are only available to DSPs.

How it works

When using the gateway you end up with a chain of 4 things, each (except the last) deferring identifying who you are to the next one:

 Resource1 --> Athens --> Raven/Shibboleth --> Raven ---
                                                        |
 Resource1 <-- Athens <-- Raven/Shibboleth <-- Raven <--

Each one remembers who you are if it's already seen you during the current browser session. For example you can keep on accessing the resource without further reference to Athens:

 Resource1 ---
              |
 Resource1 <--

and you can access a new Athens resource without further reference to Raven/Shibboleth

 Resource2 --> Athens ---
                         |
 Resource2 <-- Athens <--

Information provided to content providers

The protocol apparently transfers at least the following to the content provider:

a user name. When using the gateway, the user name is a 20-character random string starting '_'; apparently there is no guarantee that these will always be the same for the same user, but at present they are.
a persistent unique ID. When using the gateway, this is based on the eduPersonTargetedID provided by Shib, though it's not the same
an Organisation_Id, identifying the user's home organization

Other data is also available, see the DSP integration guide.

URLs

Various 'interesting' URLs can be identified by watching the http interaction or by reading submissions to the mailing lists, but only a few are actually documented for use:

The AthensDA integration guide (section 3.4.4) documents the 'setorg' URL which can be used to set the ath_ldom cookie identifying the user's home institution. Note that <returl> can be anything, including other Athens URLs

http://auth.athensams.net/setorg.php?id=<providerid>&ath_returl=<returl>

- <providerid> your providerid
- <returl> URL to return to once the cookie is set

The Local Authentication Integration Standards document includes a logout url to terminate Athens authentication:

https://auth.athensams.net/?ath_action=ssologout&ath_returl=<returl>

- <returl> is optional and provides a URL to refer the user to once logout is complete.

RSS feed of available resources: https://auth.athensams.net/my/resources/rss (but only available once authenticated?)

Target Resource Locators (TRLs) are provided for creating persistent URLs to resources that will trigger authentication:

 From: Eduserv Athens Local Authentication Support <athens-la@EDUSERV.ORG.UK>
 To: ATHENSDA@JISCMAIL.AC.UK
 Date: Tue, 14 Feb 2006 17:20:10 -0000

 ...
 The new service URL format is called a target resource locator (TRL),
 which uses a combination of:

 * the URL of the Athens authentication point (AP)
 * a TRL identifier
 * a resource identifier

 The basic format of a TRL is therefore:

 https://auth.athensams.net/trl/1.0/-/RESOURCE_ID

It appears that adding ?ath_action=noHddsSession will bypass the HDD service and so allow someone logged in via the gateway to access a particular service using their Classic Athens account:

 From: Eduserv Athens Local Authentication Support <athens-la@EDUSERV.ORG.UK>
 To: JISC-SHIBBOLETH@JISCMAIL.AC.UK
 Date: Tue, 14 Feb 2006 17:20:08 -0000
 Subject: Access to services not compliant with Shibboleth - Athens gateway

 As some of you know, Eduserv have been working on a method of allowing
 users at Shibboleth IdPs to use Athens-protected services that do not
 meet Athens implementation standards...

 The fix developed by Eduserv allows a user from a Shibboleth IdP to log
 into non-gateway compliant services with a classic Athens account.  It
 uses a URL format called a target resource locator (TRL), which uses a
 combination of:

 * the URL of the Athens authentication point (AP)
 * a TRL identifier
 * a resource identifier
 * an extra parameter to pass at the Athens AP: ath_action=noHddsSession

 The basic format of a TRL is therefore:

 https://auth.athensams.net/trl/1.0/-/RESOURCE_ID?ath_action=noHddsSession

 A list of TRLs for non-gateway compliant services is below [...]

 Dialog DataStar
 https://auth.athensams.net/trl/1.0/-/DIALOG_DATASTAR?ath_action=noHddSession

 International Who's Who
 https://auth.athensams.net/trl/1.0/-/WORLD_WHO_WHO?ath_action=noHddSession

 JISC PDS
 https://auth.athensams.net/trl/1.0/-/PDS?ath_action=noHddSession

 LexisNexis Professional and Executive
 https://auth.athensams.net/trl/1.0/-/Lexis?ath_action=noHddSession

 Oxford Scholarship Online
 https://auth.athensams.net/trl/1.0/-/OUP_OSO?ath_action=noHddSession

 ProQuest
 https://auth.athensams.net/trl/1.0/-/PROQUEST?ath_action=noHddSession

Cookies

ath_ldom, domain .athensams.net, expires +5 yeasrs: contains hom providerID, used by the Home Domain Discovery service to automatically refer authentication to the gateway.
ath_da, domain .athensams.net, session: set following authentication, purpose unknown, contains '2'
ath_username, domain .athensams.net, session: set following authentication, contains Athens usrname, used to support SSO
ath_ltoken, domain .athensams.net, session: contains the L token which supports SSO
__utma, __utmb, __utmc, __utmz: Google analyticics

Authentication sequences

Clean start

Starting with no relevant cookies, choosing 'Athens login' takes you to

http://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>

<dspid> is the service providerid - e.g. EDINA.FILMSOUND
<returl> is the URL to access once authentication is complete

This results in a redirect to the same URL over https, which displays the Athens user id/password box (possibly customised for the site). Selecting 'Alternate login from there takes you to

https://auth.athensams.net/orglist.php?ath_returl=<returl>&ath_dspid=<dspid>

which displays the standard Athens HDDS organisation chooser. Selecting a particular organisation takes you to

https://auth.athensams.net/setsite.php?ath_dspid=<dspid>&ath_returl=<returl>&id=<providerid>

<providerid> is the selected identity provider's id

This displays a message confirming the institution and asking if you want to remember it (in the ath_ldom cookie) for the future. Clicking 'GO>>' (assuming you leave the remember box checked) takes you to

https://auth.athensams.net/setsite.php?ath_dspid=<dspid>&ath_returl=<returl>&id=<providerid>&originProfile=4&doLogin=1&remChk=1&submit=++++Go+%BB+++

which redirects to

https://auth.athensams.net/?ath_action=setldom&id=<providerid>&ath_dspid=<dspid>&ath_returl=<returl>

which sets the ath_ldom cookie and redirects to

https://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>&id=<prviderid>&ath_action=shaauth

Which redirects to the organisation's Shibboleth SSO handler. The target authentication request parameter, normally the URL of the eventual target of the authentication, appears to be an opaque string of some sort, perhaps the AthensDA DA_sso_req packet.

The organisation completes a Shibboleth authentication and posts the result to

https://auth.athensams.net/saml/PostRcv

The post contains a copy of the <target> from the request and the a SAML authentication response. This sets session cookies ath_da=2, ath_username=<id>, and ath_ltoken=<ltoken>.

<id> is an Athens userid. When using the gateway this is a randomly allocated string starting '_', e.g. _wplsf6omk2rfw7lfveb
<ltoken> is the AthensDA 'L' token, used to maintain SSO session, e.g. %3CRlMlVeMTj8BvvBMx3w%3E

A zero-delay META-refresh then causes the browser to retrieve:

<returl>&ath_user=<id>&ath_ttok=<ttoken>

<ttoken> is the AThensDA 'T' token, used to transfer the user's identity to the DSP, e.g. %3CRlK1EaMyq%2FIMcMjuAA%3E

which redirects to the real service URL.

Another site, while still logged-in

Choosing 'Athens login' goes to

http://auth.athensams.net/?ath_returl=<returk>&ath_dspid=<dspid>

which redirects to the same URL over https, which uses a zero-delay META-refresh to causes the browser to request

<returl>?ath_user=<id>&ath_ttok=<tok>

which redirects to the real service URL.

Any site, having quit and restart the browser

Choosing 'Athens login' goes to

http://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>

which redirects to the same URL over https: which displays the Continue to login page. Selecting the main link takes you to

https://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>id=<providerid>&ath_action=shaauth

Which redirects to the organisation's Shibboleth SSO handler. The target authentication request parameter, normally the URL of the eventual target of the authentication, appears to be an opaque string of some sort, perhaps the AthensDA DA_sso_req packet.

The organisation completes a Shibboleth authentication and posts the result to

https://auth.athensams.net/saml/PostRcv

The post contains a copy of the <target> from the request and the a SAML authentication response. This sets session cookies ath_da=2, ath_username=<id>, and ath_ltoken=<ltoken>.

<id> is an Athens userid. When using the gateway this is a randomly allocated string starting '_', e.g. _wplsf6omk2rfw7lfveb
<ltoken> is the AthensDA 'L' token, used to maintain SSO session, e.g. %3CRlMlVeMTj8BvvBMx3w%3E

A zero-delay META-refresh then causes the browser to retrieve:

<returl>&ath_user=<id>&ath_ttok=<ttoken>

<ttoken> is the AThensDA 'T' token, used to transfer the user's identity to the DSP, e.g. %3CRlK1EaMyq%2FIMcMjuAA%3E

which redirects to the real service URL.

Classic Athens (for comparison)

Choosing 'Athens login' takes you to

http://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>

This redirects to the same URL over https:, which displays the Athens username/password page. Entering a username/password and clicking login posts ath_uname and ath_passwd to

https://auth.athensams.net/?ath_returl=<returl>&ath_dspid=<dspid>

This sets session cookies ath_da=2, ath_username=<id>, and ath_ltoken=<ltoken>.

<id> is an Athens userid. When using the gateway this is a randomly allocated string starting '_', e.g. _wplsf6omk2rfw7lfveb
<ltoken> is the AthensDA 'L' token, used to maintain SSO session, e.g. %3CRlMlVeMTj8BvvBMx3w%3E

A zero-delay META-refresh then causes the browser to retrieve:

<returl>&ath_user=<id>&ath_ttok=<ttoken>

<ttoken> is the AThensDA 'T' token, used to transfer the user's identity to the DSP, e.g. %3CRlK1EaMyq%2FIMcMjuAA%3E

which redirects to the real service URL.

Captured URLs

Real URLs captured during various interactions:

Default start

1. Starting with no cookies, login to Film & Sound @ http://www.filmandsound.ac.uk/. Choose 'Athens login'

http://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=42&y=14

2. redirect to

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=42&y=14

3. Displays Athens username & password box. Select 'Alternative Login'

https://auth.athensams.net/orglist.php?ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&ath_dspid=EDINA.FILMSOUND

4. Displays Athens HDDS chooser. Select 'Cardiff University' ('cos Cambridge not yet live)

https://auth.athensams.net/setsite.php?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=https%3A%2F%2Fidp.cardiff.ac.uk%2Fshibboleth&oid=218

5. Displays 'Go to Cardiff University' page with 'Save on this computer. Click 'OK'

https://auth.athensams.net/setsite.php?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=https%3A%2F%2Fidp.cardiff.ac.uk%2Fshibboleth&oid=218

6. redirect to

https://auth.athensams.net/?ath_action=setldom&id=https://idp.cardiff.ac.uk/shibboleth&ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D

7. Sets auth_ldom cookie, redirects to

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=https%3A%2F%2Fidp.cardiff.ac.uk%2Fshibboleth&ath_action=shaauth

8. redirect to

https://idp.cardiff.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=WlpjSDFUcHp5dDREMGZpQk34kltZLjGuSYUxm7fxxIlcNti8frex3VK3vKyylGgyyzGL6W5YzeAZmDt%2FVe6kyMQ36IzB5W3y%2FHNJTjDozxiJT5%2BI7MAwj0qTeGq4J3do8atjki5vpU%2B%2ByRN2WzeNYfzqmBRWH%2FTX96c1T8c9H5yEvu4W72Eq%2FcmseFd%2F%2FOQrGdJLay5qNu0dTh6tmK8Gu5WsrX9jCh8HZVxttqtt5aVQZdwLLW8Oz4RB19PVBz0M3tmfT58Kl2ffxqZEMJtIjXA2anf2XBpk80JmnrQJWNc%3D&time=1179728690&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk

9. Displays Cardiff's local authentication page

The same, as if from Cambridge

1. Fake the result of 4) above but choosing 'Cambridge' from the HDDS chooser by entering

https://auth.athensams.net/setsite.php?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=urn:mace:eduserv.org.uk:athens:provider:cam.ac.uk

2. Displays 'Go to the Cambridge University login' page. Leave 'Remember this Org' checked. Click 'Go>>'

https://auth.athensams.net/setsite.php?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Aprovider%3Acam.ac.uk&originProfile=4&doLogin=1&remChk=1&submit=++++Go+%BB+++

3. Redirects to

https://auth.athensams.net/?ath_action=setldom&id=urn:mace:eduserv.org.uk:athens:provider:cam.ac.uk&ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D

4. Sets auth_ldom cookie, redirects to

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Aprovider%3Acam.ac.uk&ath_action=shaauth

5. Redirects to

https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=ZFA0aXhSZjhjNHhXV2MybasvguUrMSbNF5sQ4lSOgc6317IRIVcse4G3po0e%2BkWkz2MtytmCl%2B0sgd12a3uByyf82zWgUB%2BcZe%2FimgKgJzOET1vdzFFpZocqwozvWLt49CZggwR2eq%2B80kq%2FuAcNARhOzkC8vyboZr6JEpHCm%2FfPZTvKgfZkXtMQ2YS4J%2FtwpOng%2Fo%2BGtBTNjt5AEYUT0Btk7zcAiJ7DTYij53WZiAPFmabB4A%2FPjxKKtsy9%2BnS8XOU13ha3MPMPtxU4H5l9FD1hYCM0M10XbgFYcKGlXW0%3D&time=1179730412&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk

6. Redirects to

https://raven.cam.ac.uk/auth/authenticate.html?ver=1&url=https%3a%2f%2fshib.raven.cam.ac.uk%2fshibboleth-idp%2fSSO%3fshire%3dhttps%253A%252F%252Fauth.athensams.net%252Fsaml%252FPostRcv%26target%3dZFA0aXhSZjhjNHhXV2MybasvguUrMSbNF5sQ4lSOgc6317IRIVcse4G3po0e%252BkWkz2MtytmCl%252B0sgd12a3uByyf82zWgUB%252BcZe%252FimgKgJzOET1vdzFFpZocqwozvWLt49CZggwR2eq%252B80kq%252FuAcNARhOzkC8vyboZr6JEpHCm%252FfPZTvKgfZkXtMQ2YS4J%252FtwpOng%252Fo%252BGtBTNjt5AEYUT0Btk7zcAiJ7DTYij53WZiAPFmabB4A%252FPjxKKtsy9%252BnS8XOU13ha3MPMPtxU4H5l9FD1hYCM0M10XbgFYcKGlXW0%253D%26time%3d1179730412%26providerId%3durn%253Amace%253Aeduserv.org.uk%253Aathens%253Afederation%253Auk&date=20070521T065333Z&desc=the%20University%20pilot%20Shibboleth%20service

7. Displays 'Raven confirmation'. Click Continue

https://raven.cam.ac.uk/auth/authenticate4.html

8. Redirects to

https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?WLS-Response=1!200!!20070521T065751Z!1179730417-25013-8!https%3A%2F%2Fshib.raven.cam.ac.uk%2Fshibboleth-idp%2FSSO%3Fshire%3Dhttps%25253A%25252F%25252Fauth.athensams.net%25252Fsaml%25252FPostRcv%26target%3DZFA0aXhSZjhjNHhXV2MybasvguUrMSbNF5sQ4lSOgc6317IRIVcse4G3po0e%25252BkWkz2MtytmCl%25252B0sgd12a3uByyf82zWgUB%25252BcZe%25252FimgKgJzOET1vdzFFpZocqwozvWLt49CZggwR2eq%25252B80kq%25252FuAcNARhOzkC8vyboZr6JEpHCm%25252FfPZTvKgfZkXtMQ2YS4J%25252FtwpOng%25252Fo%25252BGtBTNjt5AEYUT0Btk7zcAiJ7DTYij53WZiAPFmabB4A%25252FPjxKKtsy9%25252BnS8XOU13ha3MPMPtxU4H5l9FD1hYCM0M10XbgFYcKGlXW0%25253D%26time%3D1179730412%26providerId%3Durn%25253Amace%25253Aeduserv.org.uk%25253Aathens%25253Afederation%25253Auk!jw35!!pwd!33534!!2!IESCcka6W7SOI3Hp3X2.eoZP8CU32oUjgt0Y0PkfsSbY4RstzNmKBrEdF5UjYuC5JIcsZvA.W20mTmaVnsjq7qFi14rMD6wHPl1JCIO9EN3lZWkPKzTWDUwS8Ekrt.g60KPyJwnGEwJw7RFoMwKE8JQAS5HDyTZy6BNkhs5qnM4_

9. Sets Ucam-WebAuth-Session-S cookie, redirects to

https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=ZFA0aXhSZjhjNHhXV2MybasvguUrMSbNF5sQ4lSOgc6317IRIVcse4G3po0e%2BkWkz2MtytmCl%2B0sgd12a3uByyf82zWgUB%2BcZe%2FimgKgJzOET1vdzFFpZocqwozvWLt49CZggwR2eq%2B80kq%2FuAcNARhOzkC8vyboZr6JEpHCm%2FfPZTvKgfZkXtMQ2YS4J%2FtwpOng%2Fo%2BGtBTNjt5AEYUT0Btk7zcAiJ7DTYij53WZiAPFmabB4A%2FPjxKKtsy9%2BnS8XOU13ha3MPMPtxU4H5l9FD1hYCM0M10XbgFYcKGlXW0%3D&time=1179730412&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk

10. Sets JSESSIONID and shib_sp_<tandom hex> cookies. Displays 'Auth comlete, please wait' page. Posts to

https://auth.athensams.net/saml/PostRcv

11. Sets ath_da=2, ath_username=_<random hex>, ath_ltoken=<random hex>. Requests (via a no-delay META-refresh)

http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFDOKP4WcWDnunpfQ%3E

12. Redirects to

http://service.filmandsound.ac.uk/WebZ/html/tan.html?sessionid=01-44028-1376784429&active=3

13. Displays Film and Sound's terms of use

Repeat, already authenticated

1. Try Film & Sound @ http://www.filmandsound.ac.uk/ again with all Athens cookies in place. Choose 'Athens login'

http://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=31&y=13

2. Redirects to

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=31&y=13

3. Via a zero-delay METTA-refresh, equests

http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFHJqOzQzRuLRnNWw%3E

4. Redirects to

http://service.filmandsound.ac.uk/WebZ/html/tan.html?sessionid=01-44028-1817385508&active=3

5. Displays Film and Sound's terms of use

Repeat in new browser session

1. Try Film & Sound @ http://www.filmandsound.ac.uk/ again with only persistent Athens cookies in place. Choose 'Athens login'

http://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=26&y=13

2. Redirects to

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=26&y=13

3. Displays 'Continue to login' page. Select 'Cambridge University library' link

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&id=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Aprovider%3Acam.ac.uk&ath_action=shaauth

4. Redirects to

https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=cFJ2aWhGTDRtNFZBcVZoSmylfpDG2jY1l1PO4zKMOxjqmUD7Cy%2BktbLd8K3TjeLkTDhgMNWFQoGDjKWt77selxYlANweI2BM47hiIv6M%2FcKlXrur1zSi3ngI7wbJawUAlhsIPdKqPKNYF0x%2BjzT4Ge9f8wmnCywIFi%2BWovXY1WTK431Dmf6hq9Xd4dyXh2b%2Bi2J4w5TOQ8dT86ur6M018xUcXKXpNrKGAJYKn55C3qLRzbEYF9KLGyeNybH6yX%2FzfgNU1dhg4LWqarDTSuV809SjCjQ52qSP8ADWzYBPFYg%3D&time=1179732171&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk

5. Redirects to

https://raven.cam.ac.uk/auth/authenticate.html?ver=1&url=https%3a%2f%2fshib.raven.cam.ac.uk%2fshibboleth-idp%2fSSO%3fshire%3dhttps%253A%252F%252Fauth.athensams.net%252Fsaml%252FPostRcv%26target%3dYVdvdjFKQlFzUmVQVlExeQyQ5Sezpjz50d18RNO7SlWT0GWE%252BImfLfQxBYHDhtpVSAjPH1F8xGhzQg2LRwtwM4328%252Ft5aiHN23PcTYIHc98ZdwiftHXrN31DjkC3FdcVY%252Fvb6JZMG2p4Fd4lhbxPbWw450d2yMiy4IOhP9x%252FmJ5MwR8yTnRpCXbpXGrYiUG8oSXV4%252Bu9dk8Jz%252BgBkwuTq%252FQMUS%252BuqIR%252FNEgNpYuQISEIBMnRYzzXwHfWEzy00sdQ5vvXADWYq%252FXjG4VUirc%252B%252BQQd9zbQSracWmfHFa2Nw3I%253D%26time%3d1179756160%26providerId%3durn%253Amace%253Aeduserv.org.uk%253Aathens%253Afederation%253Auk&date=20070521T140240Z&desc=the%20University%20pilot%20Shibboleth%20service

5. Displays 'Raven confirmation'. Click 'Continue'

https://raven.cam.ac.uk/auth/authenticate4.html

6. Redirects to

https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?WLS-Response=1!200!!20070521T072505Z!1179732172-25012-12!https%3A%2F%2Fshib.raven.cam.ac.uk%2Fshibboleth-idp%2FSSO%3Fshire%3Dhttps%25253A%25252F%25252Fauth.athensams.net%25252Fsaml%25252FPostRcv%26target%3DcFJ2aWhGTDRtNFZBcVZoSmylfpDG2jY1l1PO4zKMOxjqmUD7Cy%25252BktbLd8K3TjeLkTDhgMNWFQoGDjKWt77selxYlANweI2BM47hiIv6M%25252FcKlXrur1zSi3ngI7wbJawUAlhsIPdKqPKNYF0x%25252BjzT4Ge9f8wmnCywIFi%25252BWovXY1WTK431Dmf6hq9Xd4dyXh2b%25252Bi2J4w5TOQ8dT86ur6M018xUcXKXpNrKGAJYKn55C3qLRzbEYF9KLGyeNybH6yX%25252FzfgNU1dhg4LWqarDTSuV809SjCjQ52qSP8ADWzYBPFYg%25253D%26time%3D1179732171%26providerId%3Durn%25253Amace%25253Aeduserv.org.uk%25253Aathens%25253Afederation%25253Auk!jw35!!pwd!35802!!2!kllLpHThJRMfWGRzOa17SyUm1tZR5NAO90p0RrCT.1Eyi0jZk7mLWVO5EiRJkTnNIJEt.DuEA2p1hQrxeDl5Pk38om-3oWQjXP9iH21rm9xwLphfiqSZERwX1lBXmKCA1L2Mtc5UUvReUFLje-HTaMMQUc2c38Uivr8q.vksW5I_

7. Sets Ucam-WebAuth-Session-S cookie, redirects to

https://shib.raven.cam.ac.uk/shibboleth-idp/SSO?shire=https%3A%2F%2Fauth.athensams.net%2Fsaml%2FPostRcv&target=cFJ2aWhGTDRtNFZBcVZoSmylfpDG2jY1l1PO4zKMOxjqmUD7Cy%2BktbLd8K3TjeLkTDhgMNWFQoGDjKWt77selxYlANweI2BM47hiIv6M%2FcKlXrur1zSi3ngI7wbJawUAlhsIPdKqPKNYF0x%2BjzT4Ge9f8wmnCywIFi%2BWovXY1WTK431Dmf6hq9Xd4dyXh2b%2Bi2J4w5TOQ8dT86ur6M018xUcXKXpNrKGAJYKn55C3qLRzbEYF9KLGyeNybH6yX%2FzfgNU1dhg4LWqarDTSuV809SjCjQ52qSP8ADWzYBPFYg%3D&time=1179732171&providerId=urn%3Amace%3Aeduserv.org.uk%3Aathens%3Afederation%3Auk

8. Sets JSESSIONID and shib_sp_<random hex> cookies. Displays 'Auth complete, please wait' page, posts to

https://auth.athensams.net/saml/PostRcv

9. Sets ath_da, ath_username, ath_ltoken cookies. Uses a zero-delay META-refresh to request

http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFJmKPUztPFgr%2BvKA%3E

10. Redirects to

http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFJmKPUztPFgr%2BvKA%3E

11. Displays F&S's T&Cs.

Access different site

1. African-American Poetry @ http://collections.chadwyck.co.uk/daap/htxview?template=basic.htx&content=frameset.htx. Select 'Athens users log in'

http://collections.chadwyck.co.uk/athens/

2. Somehow(?) redirect to

http://auth.athensams.net/?ath_returl=%22http%3A%2F%2Fcollections.chadwyck.co.uk%2FathensLogin%22&ath_dspid=CHADWYCK

3. Redirect to

https://auth.athensams.net/?ath_returl=%22http%3A%2F%2Fcollections.chadwyck.co.uk%2FathensLogin%22&ath_dspid=CHADWYCK

4. Via a zero-delay METTA-refresh, redirect to

http://collections.chadwyck.co.uk/athensLogin?ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFNfaOPC26cgSyPKw%3E

5. Redirect to

http://collections.chadwyck.co.uk/home/home_aap.jsp?template=basic.htx&content=frameset.htx

6. Display front page

Classic Athens, from clean start

1. Starting with no cookies, login to Film & Sound @ http://www.filmandsound.ac.uk/. Choose 'Athens login'

http://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=25&y=4

2. Redirect to

https://auth.athensams.net/?ath_dspid=EDINA.FILMSOUND&ath_returl=%22http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D%22&x=25&y=4

3. Displays Athens username/password page. Enter username/password, click login. Posts to the following with ath_uname and ath_passwd as POST parameters

https://auth.athensams.net/?ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&ath_dspid=EDINA.FILMSOUND

4. Sets ath_username, ath_ltoken. Requests, via a zero-delay META-refresh

http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=camtsjw35&ath_ttok=%3CRlFhI6NBcCQXmBz75w%3E

@@ Line 1: / Line 1: @@
 {{shib-project}}
-When using the gateway, you are in effect using [http://www.athensams.net/local_auth/athensda AthensDA], except that the eXtensible Authentication Point (XAP) that would normally be run by the local site for AthensDA (see [http://www.athensams.net/upload/athens/pdf/da_integration_guide.pdf AthensDA integration guide]) is run for them by Athens but uses the local site's Shibboleth IdP to identify the local site's users. Because of this, there is quite a lot of useful information to be found in the [http://www.jiscmail.ac.uk/lists/athensda.html AthensDA JISCMail mailing list]
+When using the gateway, you are in effect using [http://www.athensams.net/local_auth/athensda AthensDA], except that the eXtensible Authentication Point (XAP) (see [http://www.athensams.net/upload/athens/pdf/da_integration_guide.pdf AthensDA integration guide]) is run by Athens and delegates to the local site's Shibboleth IdP to identify users. Because of this, there is quite a lot of useful information to be found in the JISCMail [http://www.jiscmail.ac.uk/lists/athensda.html AthensDA list] as well as the [http://www.jiscmail.ac.uk/lists/JISC-SHIBBOLETH.html JISC-Shibboleth list]
-Details of the protocol between Athens and the XAP are available in the [http://www.athensams.net/upload/athens/pdf/da_integration_guide.pdf AthensDA integration guide]. Details of the protocol between Athens and the DSPs are not available to the likes of us (though there are hints in the [http://www.athensams.net/upload/athens/pdf/dspintegrationguide.pdf DSP integration guide] but this document contains some further notes that relate to it.
+Details of the protocol between Athens and the XAP are available in the [http://www.athensams.net/upload/athens/pdf/da_integration_guide.pdf AthensDA integration guide]. Details of the protocol between Athens and the DSPs are largely available in [http://www.athensams.net/upload/athens/pdf/dspintegrationguide.pdf DSP integration guide] though there are additional resources that are only available to DSPs.
 ==How it works==
@@ Line 31: / Line 31: @@
 * a persistent unique ID. When using the gateway, this is based on the eduPersonTargetedID provided by Shib, though it's not the same
 * an Organisation_Id, identifying the user's home organization
+Other data is also available, see the [http://www.athensams.net/upload/athens/pdf/dspintegrationguide.pdf DSP integration guide].
 ==URLs==
@@ Line 42: / Line 44: @@
 ** <providerid> your providerid
 ** <returl> URL to return to once the cookie is set
+The [http://www.athensams.net/upload/athens/pdf/local_auth_integration_standards.pdf Local Authentication Integration Standards] document includes a logout url to terminate Athens authentication:
+ https://auth.athensams.net/?ath_action=ssologout&ath_returl=<returl>
+** <returl> is optional and provides a URL to refer the user to once logout is complete.
+RSS feed of available resources: https://auth.athensams.net/my/resources/rss (but only available once authenticated?)
 Target Resource Locators (TRLs) are provided for creating persistent URLs to resources that will trigger authentication:
@@ Line 105: / Line 115: @@
    ProQuest
    https://auth.athensams.net/trl/1.0/-/PROQUEST?ath_action=noHddSession
-RSS feed of available resources: https://auth.athensams.net/my/resources/rss (only available once authenticated?)
 ==Cookies==
-* ath_ldom, domain .athensams.net, expires 2012: contains providerID, appears to drive the Home Domain Discovery service.
+* ath_ldom, domain .athensams.net, expires +5 yeasrs: contains hom providerID, used by the Home Domain Discovery service to automatically refer authentication to the gateway.
-* ath_da, ath_username, and ath_ltoken, domain .athensams.net, session: contain DA type?, username, some sort of token
+* ath_da, domain .athensams.net, session: set following authentication, purpose unknown, contains '2'
+* ath_username, domain .athensams.net, session: set following authentication, contains Athens usrname, used to support SSO
+* ath_ltoken, domain .athensams.net, session: contains the L token which supports SSO
 * __utma, __utmb, __utmc, __utmz: Google analyticics
@@ Line 125: / Line 135: @@
 * <returl> is the URL to access once authentication is complete
-This results in a redirect to the same URL over https, which displays the [[Media:Athens-login.png | Athens user id/password box]] (posibably customised for the site). Selecting 'Alternate login from there takes you to
+This results in a redirect to the same URL over https, which displays the [[Media:Athens-login.png | Athens user id/password box]] (possibly customised for the site). Selecting 'Alternate login from there takes you to
   https://auth.athensams.net/orglist.php?ath_returl=<returl>&ath_dspid=<dspid>
@@ Line 135: / Line 145: @@
 * <providerid> is the selected identity provider's id
-This displays a [[Media:Athens-setsite-confirm.png | message confirming the institution]] and asking if you want to remember it (with a cookie) for the future. Clicking 'GO>>' (assuming you leave the remember box checked) takes you to
+This displays a [[Media:Athens-setsite-confirm.png | message confirming the institution]] and asking if you want to remember it (in the ath_ldom cookie) for the future. Clicking 'GO>>' (assuming you leave the remember box checked) takes you to
   https://auth.athensams.net/setsite.php?ath_dspid=<dspid>&ath_returl=<returl>&id=<providerid>&originProfile=4&doLogin=1&remChk=1&submit=++++Go+%BB+++
@@ Line 146: / Line 156: @@
   https://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>&id=<prviderid>&ath_action=shaauth
-Which redirects to the organisation's Shibboleth SSO handler. The ''target'' authentication request parameter, normally the URL of the eventual target of the authentication, appears to be an opaque string of some sort. The organisation completes a Shibboleth authentication and posts the result to
+Which redirects to the organisation's Shibboleth SSO handler. The ''target'' authentication request parameter, normally the URL of the eventual target of the authentication, appears to be an opaque string of some sort, perhaps the AthensDA DA_sso_req packet.
+The organisation completes a Shibboleth authentication and posts the result to
   https://auth.athensams.net/saml/PostRcv
-The post contains a copy of the <target> from the request (and presumably an authentication response and other shib stuff?). This sets session cookies ath_da=2, ath_username=_<random hex>, and ath_ltoken=<random hex>. Somehow (another auto-submit form?) this causes the browser to retrieve:
+The post contains a copy of the <target> from the request and the a SAML authentication response. This sets session cookies ath_da=2, ath_username=<id>, and ath_ltoken=<ltoken>.
-  <returl>&ath_user=<id>&ath_ttok=<tok>
+* <id> is an Athens userid. When using the gateway this is a randomly allocated string starting '_', e.g. _wplsf6omk2rfw7lfveb
+* <ltoken> is the AthensDA 'L' token, used to maintain SSO session, e.g. %3CRlMlVeMTj8BvvBMx3w%3E
+A zero-delay META-refresh then causes the browser to retrieve:
+  <returl>&ath_user=<id>&ath_ttok=<ttoken>
+* <ttoken> is the AThensDA 'T' token, used to transfer the user's identity to the DSP, e.g. %3CRlK1EaMyq%2FIMcMjuAA%3E
-* <id> is a randomly allocated 'athens id' starting '_', e.g. _wplsf6omk2rfw7lfveb, corresponding to ath_username
-* <tok> is some sort of encoded token, e.g. %3CRlFJmKPUztPFgr%2BvKA%3E, corresponding to ath_ltoken
 which redirects to the real service URL.
@@ Line 165: / Line 182: @@
   http://auth.athensams.net/?ath_returl=<returk>&ath_dspid=<dspid>
-which redirects to the same URL over https, which somehow (auto-submit form?) causes the browser to request
+which redirects to the same URL over https, which uses a zero-delay META-refresh to causes the browser to request
   <returl>?ath_user=<id>&ath_ttok=<tok>
@@ Line 181: / Line 198: @@
   https://auth.athensams.net/?ath_dspid=<dspid>&ath_returl=<returl>id=<providerid>&ath_action=shaauth
-Which redirects to the organisation's Shibboleth SSO handler. The ''target'' authentication request parameter, normally the URL of the eventual target of the authentication, appears to be an opaque string of some sort. The organisation completes a Shibboleth authentication and posts the result to
+Which redirects to the organisation's Shibboleth SSO handler. The ''target'' authentication request parameter, normally the URL of the eventual target of the authentication, appears to be an opaque string of some sort, perhaps the AthensDA DA_sso_req packet.
+The organisation completes a Shibboleth authentication and posts the result to
   https://auth.athensams.net/saml/PostRcv
-The post contains a copy of the <target> from the request (and presumably an authentication response and other shib stuff?). This sets session cookies ath_da=2, ath_username=_<random hex>, and ath_ltoken=<random hex>. Somehow (another auto-submit form?) this causes the browser to retrieve:
+The post contains a copy of the <target> from the request and the a SAML authentication response. This sets session cookies ath_da=2, ath_username=<id>, and ath_ltoken=<ltoken>.
- <returl>&ath_user=<id>&ath_ttok=<tok>
+* <id> is an Athens userid. When using the gateway this is a randomly allocated string starting '_', e.g. _wplsf6omk2rfw7lfveb
+* <ltoken> is the AthensDA 'L' token, used to maintain SSO session, e.g. %3CRlMlVeMTj8BvvBMx3w%3E
-* <id> is a randomly allocated 'athens id' starting '_', e.g. _wplsf6omk2rfw7lfveb, corresponding to ath_username
+A zero-delay META-refresh then causes the browser to retrieve:
-* <tok> is some sort of encoded token, e.g. %3CRlFJmKPUztPFgr%2BvKA%3E, corresponding to ath_ltoken
+ <returl>&ath_user=<id>&ath_ttok=<ttoken>
+* <ttoken> is the AThensDA 'T' token, used to transfer the user's identity to the DSP, e.g. %3CRlK1EaMyq%2FIMcMjuAA%3E
 which redirects to the real service URL.
@@ Line 204: / Line 227: @@
   https://auth.athensams.net/?ath_returl=<returl>&ath_dspid=<dspid>
-This sets ath_username, ath_ltoken cookies and somehow (auto-submitting form?) requests
+This sets session cookies ath_da=2, ath_username=<id>, and ath_ltoken=<ltoken>.
-  <returl>&ath_user=camtsjw35&ath_ttok=%3CRlFhI6NBcCQXmBz75w%3E
+* <id> is an Athens userid. When using the gateway this is a randomly allocated string starting '_', e.g. _wplsf6omk2rfw7lfveb
+* <ltoken> is the AthensDA 'L' token, used to maintain SSO session, e.g. %3CRlMlVeMTj8BvvBMx3w%3E
+A zero-delay META-refresh then causes the browser to retrieve:
+  <returl>&ath_user=<id>&ath_ttok=<ttoken>
+* <ttoken> is the AThensDA 'T' token, used to transfer the user's identity to the DSP, e.g. %3CRlK1EaMyq%2FIMcMjuAA%3E
+which redirects to the real service URL.
 ==Captured URLs==
+Real URLs captured during various interactions:
 ===Default start===
@@ Line 326: / Line 360: @@
   https://auth.athensams.net/saml/PostRcv
-. Sets ath_da, ath_username, ath_ltoken cookies. Somehow requests
+. Sets ath_da, ath_username, ath_ltoken cookies. Uses a zero-delay META-refresh to request
   http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFJmKPUztPFgr%2BvKA%3E
@@ Line 345: / Line 379: @@
   https://auth.athensams.net/?ath_returl=%22http%3A%2F%2Fcollections.chadwyck.co.uk%2FathensLogin%22&ath_dspid=CHADWYCK
-. Somehow(?) redirect to
+. Via a zero-delay METTA-refresh, redirect to
   http://collections.chadwyck.co.uk/athensLogin?ath_user=_wplsf6omk2rfw7lfveb&ath_ttok=%3CRlFNfaOPC26cgSyPKw%3E
@@ Line 364: / Line 398: @@
   https://auth.athensams.net/?ath_returl=http%3A%2F%2Fservice.filmandsound.ac.uk%2Fcgi-bin%2Ffilmandsoundlogin-sso%3Fathens_sso%3D1%26edina3%3D1%26%3D&ath_dspid=EDINA.FILMSOUND
-. Sets ath_username, ath_ltoken. Somehow requests
+. Sets ath_username, ath_ltoken. Requests, via a zero-delay META-refresh
   http://service.filmandsound.ac.uk/cgi-bin/filmandsoundlogin-sso?athens_sso=1&edina3=1&=&ath_user=camtsjw35&ath_ttok=%3CRlFhI6NBcCQXmBz75w%3E

Athens DA Protocol: Difference between revisions

Latest revision as of 10:01, 22 May 2007

Contents

How it works

Information provided to content providers

URLs

Cookies

Authentication sequences

Clean start

Another site, while still logged-in

Any site, having quit and restart the browser

Classic Athens (for comparison)

Captured URLs

Default start

The same, as if from Cambridge

Repeat, already authenticated

Repeat in new browser session

Access different site

Classic Athens, from clean start

Navigation menu

Page actions

Page actions

Personal tools

Navigation

Search

Tools