<!--

Autograph - a personal privacy manager

• user maintainable attributes

• "on top" installation (Shibboleth IdP code is untouched!)

• Release of version 0.9 at sourceforge on 25 August 2006

• Release of version 0.9 25 August 2006

• Go to the 'TestFed OpenIdP' register service and register a user by filling out the provided form.

• Go to one of the Service Providers in the Federation (e.g. sp-afs.mams.org.au ) using the 'TestFed OpenIdP'.
  

• seamless integration in Shibboleth Single Sign On Profile more

• installation

• integration in SSO

• Integration in SSO <!-- * Development -->

• Installation

• under the hood

• Developer forum (you will need a sourceforge account)

• easy to uninstall (Shibboleth IdP configuration is untouched!)

• Release of version 1.0 18 August 2006

• Development

Roadmap

• Release of version 1.0 on 18th of August 2006

Highlights:

• seamless integration in Shibboleth Single Sign On Profile

• "on top" installation (Shibboleth IdP code is untouched!)

• easy to uninstall (Shibboelth IdP configuration is untouched!)

• lightweight web application (file based persistency)

• open source project at sourceforge (Apache 2.0 licence)

• Go to one of the Service Providers in the Federation (e.g. sp-afs.mams.org.au) using the MAMS Public Identiy Provider.

Support

• FAQs
• Help forum
• Open Discussion forum
• Developer forum (you will need a sourceforge account)
• Feature request
• Bug report

Documentation

• Installation
• Architecture
• Integration in SSO

Background

One common way to solve this problem is to create a new account for you at the other institution, after which you need to remember yet another username and password. A much better way is that you offer the service provider that offers the service your 'idCard', containing a little bit of personal information about you - this is just like the real world, where you also often introduce yourself by selecting the most appropriate business card for the occasion. And your institution will sign it for you, so the service provider will know that it can trust it.

Autograph allows you to specify 'idCards' you are offering to service providers. In return, the services will offer you an enhanced customisable user experience. Every time that you visit a service, and only then, your browser will present the specified 'idCard'. However, please note that some service features will not be available if you do not release some personal information.

ShARPE and Autograph are licensed under Apache License, Version 2.0 -->

ShARPE and Autograph are licensed under Apache License, Version 2.0

Installation

Step 1: Add a user to the testfed openidp:

• Go to the MAMS Public Identity Provider register service and register a user by filling out the provided form.

• Click on this Autograph link. When the WAYF service comes up choose the testfed openidp and authenticate with the credentials you provided in step 1.

Step 1: Add a user to the MAMS Public Identity Provider:

• Go to the MAMS Public Identity Provider register service and register a user by filling out the provided form.

• Click on this Autograph link. When the WAYF service comes up choose the MAMS Public Identity Provider and authenticate with the credentials you provided in step 1.
• Select a Service Provider you want to configure your idCard for.

• Change the context parameter ResolverFile in the TOMCAT_HOME/webapps/Autograph/WEB-INF/web.xml. (e.g. /usr/local/shibboleth-idp/etc/resolver.ldap.xml)
• Change the context parameter ARPFileDirectory in the TOMCAT_HOME/webapps/Autograph/WEB-INF/web.xml. (e.g. /usr/local/shibboleth-idp/etc/arps/)
• Change the context parameter MetadataFileLocation in the TOMCAT_HOME/webapps/Autograph/WEB-INF/web.xml. (e.g. /usr/local/shibboleth-idp/etc/schemas/level-1-metadata.xml)

• (Re-)Start tomcat.
• (Re-)Start apache.

• Sign in using Shibboleth.
• In the drop down menu should be a list of all Service Providers described by your metadata.
• To use more advances features please have a look at the following Setup section that describes the metadata extension.

Setup

Autograph needs more detailed information about Service Providers than it is provided in the standard SAML 2.0 metadata. For this reason MAMS created an extension for the metadata. You can find the SAML 2.0 metadata extension here and an example instantiation here.

If you want to use Autograph's full functionality you have to add <Service> elements like shown here:

   <EntityDescriptor entityID="urn:mace:federation.org.au:testfed:level-1:workshop.mams.org.au">
      <Extensions>
         <Service xmlns="urn:mace:federation.org.au:SAML:2.0:metadata:extension" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:mace:federation.org.au:SAML:2.0:metadata:extension saml-schema-metadata-ext-servicedescription.xsd urn:oasis:names:tc:SAML:2.0:assertion saml-schema-assertion-2.0.xsd">
            <ServiceName xml:lang="en">Picture Gallery Service</ServiceName>
            <ServiceLocation>https://workshop.mams.org.au/UniversityOfArt/PictureGallery.jsp</ServiceLocation>
            <ServiceDescription xml:lang="en">A large repository of pictures.</ServiceDescription>
            <ServiceFeature>
               <ServiceFeatureName xml:lang="en">download</ServiceFeatureName>
               <ServiceFeatureDescription xml:lang="en">This Service Feature offers the functionality to download pictures in high resolution.</ServiceFeatureDescription>
               <md:RequestedAttribute Name="urn:mace:dir:attribute-def:eduPersonAffiliation" FriendlyName="community">
                  <saml:AttributeValue>Staff</saml:AttributeValue>
               </md:RequestedAttribute>
               <md:RequestedAttribute Name="urn:mace:dir:attribute-def:givenName" FriendlyName="givenName"/>
               <md:RequestedAttribute Name="urn:mace:dir:attribute-def:sn" FriendlyName="surname"/>
            </ServiceFeature>
            <ServiceFeature>
               <ServiceFeatureName xml:lang="en">search</ServiceFeatureName>
               <ServiceFeatureDescription xml:lang="en">This Service Feature offers search functionality.</ServiceFeatureDescription>
               <md:RequestedAttribute Name="urn:mace:dir:attribute-def:eduPersonAffiliation" FriendlyName="community"/>
            </ServiceFeature>
         </Service>
      </Extensions>
      <AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol">
         ...
      </AttributeAuthorityDescriptor>
      <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol">
         ...
      </SPSSODescriptor>
      <Organization>
         ...
      </Organization>
      <ContactPerson contactType="technical">
         ...
      </ContactPerson>
   </EntityDescriptor>

Step 1: Add a user to the Open IDP Identity Provider:

• Go to the Open IDP register service and register a user by filling out the provided form.

Step 2: Configure your idCard with Autograph:

• Click on this Autograph link. When the WAYF service comes up choose the Open IDP and authenticate with the credentials you provided in step 1.
• Select a Service Provider you want to configure your idCard for. (Some Service Provider (e.g. Workshop Machine) have a detailed Service Provider description which gives Autograph the possiblitiy to provide more functionality.)

<!--

     <Location /Autograph/*>