perun logo

eduGAIN logo Groups Manager Demo

  • Groups Manager Demo
  • Help

Welcome to eduGAIN Groups Manager Demo

This service is intended to test how attribute authorities managed by VO management tools like Perun system can work within the eduGAIN. Everyone can register and create groups which can be used by the service providers to do the authorization decision. Only registered users can be added into the groups, registration is required in order to accept service conditions. As this service is not a production service, there is no guarantee that it will be available 24/7. If you encounter any problem or have any comments, just let us know on perun@cesnet.cz.

Service rules

  • This is NOT a production service, there is no guarantee that it will be available for 24/7.
  • Every information provided to the service will be stored on server located at CESNET (Czech Republic) and is available through the eduGAIN Groups Manager Demo web interface.
  • Attribute authority is configured to release attributes to ANY eduGAIN SPs.
  • Attribute authority releases only name of the group where the user is member.
  • Every user sees only those groups which were created by him.

How to start?

  1. Go to the registration page.
  2. You will receive confirmation with the link to the eduGAIN Groups Manager Demo.
  3. Invite users
  4. If the user go throught the registration, then you can add him into the group.
  5. Configure SP to get attributes from eduGAIN Groups Manager Demo attribute authority, technical documentation follows.

Technical documentation

Below is the list of changes which needs to be done in order to let SP ask the eduGAIN group service attribute authority.

Prerequisites

  • User's IdP must release eduPersonPrincipalName, displayName or givenName/sn and mail to SP https://meta.cesnet.cz/sp/shibboleth (CESNET's Perun instance). The SP is tagged by REFEDS R&S entity category, which by default contains those attributes as a minimal set.
    • Attribute eduPersonPrincipalName: urn:oid:1.3.6.1.4.1.5923.1.1.1.6
    • Attribute displayName: urn:oid:2.16.840.1.113730.3.1.241
    • Attribute mail: urn:oid:0.9.2342.19200300.100.1.3
  • SP must consume metadata containing entities from eduGAIN and must be itself available in eduGAIN metadata.
Just add this piece of code to the shibboleth2.xml after existing AttributeResolver element. The code will ensure that SP will request additional user attributes (name of groups) from eduGAIN Groups Manager. Users are searched by eduPersonPrincipalName (eppn).
<AttributeResolver type="SimpleAggregation" attributeId="eppn"
        format="urn:oid:1.3.6.1.4.1.5923.1.1.1.6">
         <Entity>https://edugain-group.cesnet.cz/idp/shibboleth</Entity>
</AttributeResolver>

Attribute definition

  • Attribute name: https://edugain-group.cesnet.cz/attribute-def/uniqueGroupName
Add attribute map to attribute-map.xml:
<!-- Perun group name attribute -->
<Attribute name="https://edugain-group.cesnet.cz/attribute-def/uniqueGroupName" id="uniqueGroupName" />

Attribute contains name of the group as a value prefixed by edugain_group: string. For example group named test will result in the attribute value edugain_group:test.

cesnet cerit

OTHER CESNET PROJECTS

  • Perun
  • UltraGrid
  • 4k Gateway
  • Shongo
  • Librerouter

CONTACT

perun@cesnet.cz
© 1991–2020 CESNET, z. s. p. o., CERIT-SC