Shibboleth/SAML for SSO at UC Davis

What is Shibboleth and SAML?

Shibboleth is an implementation of the SAML protocols and profiles for web single sign-on.
SAML's strengths lie in secure, cross-domain (federated) authentication and authorization, maintaining privacy when necessary.
http://shibboleth.net/
https://wiki.shibboleth.net/confluence/display/SHIB2/UnderstandingShibboleth
Federations allow allow scaling to potentially millions of users.
- UC Davis is a member of the InCommon (Internet2) and global eduGAIN Federations.
  http://www.incommon.org/participants/
  http://www.geant.org/Services/Trust_identity_and_security/eduGAIN
- We also participate in UCTrust, a subset of InCommon member institutions comprised of UC campuses, UC Office of the President, and affiliated research labs.

If you might (eventually) wish to share your application to non-UC Davis clients, e.g. another UC campus.
When attributes such as name, email address etc. need to be made available to your application when a client logs in, e.g. for personalization.
When attribute values might be required to make access/authorization decisions, e.g. client affiliation.

Apache httpd
- Supports Tomcat, Jetty etc. through an AJP1.3 connector e.g. mod_proxy_ajp
Microsoft IIS
FastCGI
Sun/iPlanet
- Note: Sun/iPlanet is not supported by campus.