Last updated: 
4 months 2 weeks ago
Group Manager
Project Moonshot is a Janet-led initiative, in partnership with the GÉANT project and others, to develop a single unifying technology for extending the benefits of federated identity to a broad range of non-Web services, including Cloud infrastructures, High Performance Computing & Grid infrastructures and other commonly deployed services including mail, file store, remote access and instant messaging. The goal of the technology is to enable the management of access to a broad range of services and applications, using a single technology and infrastructure. This is expected to significantly improve the delivery of these services by providing users with a common single sign-on, for both internal and external services. Service providers will be able to more easily offer their services to users from other organisations using a single common authentication mechanism. This will enhance the user’s experience, and reduce costs for those organisations supporting users, and delivering services to them. This group is for community of Moonshot users, whether you're new to the technology, you're currently evaluating and getting to grips with it, or you've deployed it. For the list of guidance available about Moonshot within this group, see the Start Here wiki page. Jisc Assent, the production service underpinned by the Moonshot technology, went live on 25th March 2015. For information on, or to join the Jisc Assent service, please visit http://www.jisc.ac.uk/assent

Moonshot Code Update

6 September 2013 at 5:06pm

Last night Sam Hartman from Painless Security published a code update to ensure Moonshot is in line with the the latest IETF specs.

In particular:

  • We now use RFC 3961 MIC tokens per the approved spec
  • We no longer depend on FreeRADIUS; we use Alan's NetworkRADIUS library. Thanks Alan for working with us and thanks to Luke for doing the integration!
  • OIDs and attribute names are updated from the current versions of the IETF specs.

This code update represents a significant incompatible change with previous versions, so if you have Moonshot code in production and need to support both versions, leave a comment below or email moonshot-community@jiscmail.ac.uk and Sam will help you work through how to do that.

In particular, the following things need to be updated to use the new code:

  • You will need to change the OIDs you are using; see the mech_eap/mech file for the new OIDs.
  • You need to remove the dictionary line from radsec.conf.
  • You need to update the URNs of  any GSS attributes you use in your Shibboleth configuration.
  • We're now using different RADIUS attribute numbers because our attributes have been approved and registered with IANA.

Here's a dictionary fragment:

ATTRIBUTE GSS-Acceptor-Service-Name 164 string
ATTRIBUTE  GSS-Acceptor-Host-Name 165 string
ATTRIBUTE GSS-Acceptor-Service-Specifics 166 string
ATTRIBUTE GSS-Acceptor-Realm-Name 167 string

Links to the code, including the latest DVD image, can be found at https://community.ja.net/groups/moonshot/article/moonshot-dvd-image-and-...