[an error occurred while processing this directive]

<div id="menu">
	<hr/>
	<ul>
		<li><a href="http://www.asio.eu/asio/english/index.shtml">Products</a></li>
		<li><a href="http://www.asio.eu/asio/english/aboutUs.shtml">About Asio-Data</a></li>
		<li><a href="http://www.asio.eu/asio/english/internationalNews.shtml">News</a></li>
		<li><a href="http://www.asio.eu/asio/english/enfaq.shtml">FAQ</a></li>
		<li><a href="http://www.asio.eu/asio/english/references.shtml">References</a></li>
		<li><a href="http://www.asio.eu/asio/english/contact.shtml">Contact us</a></li>
	</ul>

	<hr/>

	<div class="flags">
		<a href="/english/index.shtml"><img src="http://www.asio.eu/asio/english/pics/uk-lgflagSmall.gif" alt="in english"/></a>
		<a href="http://www.asio.fi/index.shtml"><img src="http://www.asio.eu/asio/english/pics/fi-lgflagSmall.gif" alt="in finnish"/></a>
		<!--<a href="http://www.asio.fi/index_du.shtml"><img src="pics/be-lgflagSmall.gif" alt="Belgium"/></a>-->
		<!--<a href="http://www.asio.fi/index_du.shtml"><img src="pics/nl-lgflagSmall.gif" alt="Dutch"/></a>-->
		<a href="/asio/spanish/index.shtml"><img src="http://www.asio.eu/asio/images/fla_sp.gif" alt="Espaņol"/></a>
	</div>

	<div class="clear">&nbsp;</div>
</div>

<div id="main">

<h1>External authentication / Shibboleth</h1>

<p>
The Asio Classroom Booking System has an interface for utilizing an external system for storing user information and authenticating users. One of these implementations is to Shibboleth, an open-source single-signon user administration system. This document contains instructions for installing and configuring the Shibboleth interface. Please note that this document does not detail the process of installing the building blocks of the Shibboleth infrastructure but focuses on describing the Shibboleth-to-Asio interface.

<h3>Shibboleth integration with Asio Classroom Booking System</h3>
<p>
From the point of view of the Asio software, the Shibboleth infrastructure consists of two entities:
<ul>
<li>An identity provider (called "origin" prior to version 1.3), which provides information on the user's identity for the Asio software
<li>A service provider (called "target" prior to version 1.3), which provides the Asio Classroom Booking system an interface to Shibboleth
</ul>
<p>

<img src="shib.png" alt="Shibboleth integration, logon process">

<p>
Whenever a user logs in to the Asio Classroom Booking system that is utilizing Shibboleth-based authentication, the following process takes place:
<ol>
<li>The Asio authentication interface notices that the user has not logged in, and redirects the user to the address of the "shiblogin" subdirectory, which is located under the Asio's main program directory.
<li>The Shibboleth module in Apache activates, the user logs in via Shibboleth's web login and the Shibboleth's session is established
<li>Asio Shibboleth Module passes the Shibboleth session attributes to the authentication interface.
<li>Shibboleth attributes "eduPersonAffiliation" and "eduPersonPrimaryAffiliation" are set as group memberships for the user. (You can utilize this information in configuring the profiler.)
<li>User is profiled according to profiler settings and a session is established
</ol>

<h3>Requirements</h3>
<p>
System requirements for using the Asio Shibboleth Module are as follows:
<ul>
<li>Identity attributes must be stored according to <a href="http://www.csc.fi/suomi/funet/middleware/english/">HAKA Federation</a> specification.
<li>Apache web server with the Shibboleth module installed and properly configured according to the organization's infrastructure.
<li>Shibboleth authentication must be enabled from Apache for the "shiblogin" subdirectory.
<li>Shibboleth module must be set as the active authentication interface for the Asio software
</ul>

<h3>Enabling external authentication for Asio software</h3>
<p>Following list gives step-by-step instructions on how to enable and configure the Shibboleth authentication for Asio software:
<ol>
<li>Open the software's main configuration file inc/server_settings.php into a text editor.
<li>Find the entry labeled $ext_udb_config. This PHP array contains connection settings for Shibboleth. Please go through at least the following entries:
    <ul>
	  <li> "domain_name" = A human-readable name for the system, for example the global domain of your company, for example <b>"company.net"</b>
	  <li> "database" = Database of the classroom booking system to which the external authentication gives access to. You should specify the previously mentioned organization's database name here.
	  <li> "show_info" = Whether or not to show summary of user's profile on the main page (for debugging purposes)
    </ul>
<li>Find the entry labeled $ext_profiler_config. This PHP array contains settings for profiling external user information into Asio software's user privileges.
    <ul>
	  <li> "admin_groups" = Values of "eduPersonAffiliation" which have administration privileges in the Asio software. The setting is given as a PHP array, for example as follows:<br><b>array("administration","maintenance")</b>
	  <li> "normal_groups" = Values of "eduPersonAffiliation" which have booking privileges to the Asio software.
	  <li> "browsing_groups" = Windows user groups which have browsing only access to the Asio software. You can specify a wildcard "*" here, which will give all registered Windows users browsing access.
	  <li> "browsing_types" = Resource type limitation for browsing users. The setting is given as a PHP array, for example as follows:<br><b>array("Computer classes","Meeting rooms")</b>
		<br>Similarly you can define resource type limitation for administrators and booking users with settings admin_types and normal_types.
	  <li> "<b>ROLE</b>_groups" = Windows user groups which belong to the Asio system's role <b>ROLE</b>. You can specify a wildcard "*" here. <i>(starting from classroom booking system version 7)</i>
	  <li> "roles" = Role priorities. The system sets the role for the user as the first one on this list matching the user's groups. Thus you should specify the roles on this list in such order that the role giving most access privileges comes first. <i>(starting from classroom booking system version 7)</i>
    </ul>

<li>Enable Shibboleth authentication interface by copying or linking the file inc/ext_auth.php.shib to inc/ext_auth.php.

 </ol>

 </td>
</tr>
</table>



</div><!-- /main -->

</div><!--container-->
<div class="footer">
	<p><a href="http://www.asio.eu">Front page</a> | <a href="#top">Top of the page</a></p>

		<!--To update, just ftp index.shtml to the server.-->
		
	<p>Last Modified 2007-10-23<br />
		Asio&reg; is a registered trademark in Finland.</p>


<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
<script type="text/javascript">
_uacct = "UA-1278636-2";
urchinTracker();
</script>

</div><!-- /footer -->

</body>
</html>