1757952 - Inquiry regarding Shibboleth authentication support to access ACM Digital Library

Status: RESOLVED WONTFIX

(Infrastructure & Operations :: SSO: Requests, task)

Description

[tito]

Hello!

I would like to set up a free trial to the ACM Digital Library for Mozilla. ACM supports authentication through Shibboleth. Is this something that we can support through Mozilla SSO?

This page describes their Shibboleth support:
https://libraries.acm.org/subscriptions-access/authentication

This page describes their Shibboleth metadata:
https://dl.acm.org/pb-assets/shibboleth/dl-acm-org.xml

If Shibboleth protocol is not supported then do we support EZproxy?

Tito

Comment 1

[Jake Watkins [:dividehex]]

(In reply to tito from comment #0)

Hello!

I would like to set up a free trial to the ACM Digital Library for Mozilla. ACM supports authentication through Shibboleth. Is this something that we can support through Mozilla SSO?

This page describes their Shibboleth support:
https://libraries.acm.org/subscriptions-access/authentication

This page describes their Shibboleth metadata:
https://dl.acm.org/pb-assets/shibboleth/dl-acm-org.xml

If Shibboleth protocol is not supported then do we support EZproxy?

Tito

From what I can tell, shibboleth looks to be SAML 2.0 which we do support through Auth0 as our IdP. Although, looking at the metadata XLM, I'm unfamiliar with the attributes being requested.

<RequestedAttribute FriendlyName="eduPersonScopedAffiliation" Name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" NameFormat="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
<RequestedAttribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"/>

We will need to figure out what these are and how to provide them in the SAML mappings.

Comment 2

[tito]

Hello! Can you please provide an update on this ticket? I would like to provide an ETA for my stakeholders.

Comment 3

[Chris Brentano [:ctb]]

I'm going to reach out to Auth0 support and see if they can assist here, but I'm blocked temporarily until I'm added to their support system which should happen tomorrow. Hopefully there's a way to figure this out without standing up a proxy or middleware.

Comment 4

[Chris Brentano [:ctb]]

Hi Tito,

So I finally got in touch with Auth0 Support to ask about Shibboleth integration, and this is what they had to say:

I have been investigating on Shibboleth and Auth0. And I have found there is a Proof of Concept project here:

https://github.com/mcastany/shibboleth-auth0

Although I see this integration is quite old, I have also found that the Shibboleth IdP now defaults to the use of data encryption algorithm family called AES-GCM to encrypt XML which Auth0 does not yet support:

https://wiki.shibboleth.net/confluence/display/IDP4/GCMEncryption

Our engineering department has a current open backlog item in order to support this in the future.

I looked at the PoC project that they linked but it hasn't been updated in 3 years unfortunately. So I think the answer is, Shibboleth integration is not supported at this time, but it could potentially be in the future.