Applications which support MIT Touchstone

The following applications are MIT Touchstone enabled, or directly support Shibboleth authentication. The information below indicates some of the relevant identity providers that the application supports, and also provides some indication about what information about a user is released to the application.

Key to identity providers

Identity providers are the components that provide authentication services for a particular security domain. At this time MIT operates two independent identity providers (IdPs). The core MIT IdP serves all MIT students, faculty, staff, and some others that have an MIT Kerberos username, and possess or are able to obtain, an MIT X.509 certificate.

The second IdP that MIT currently operates is the TouchstoneNetwork IdP. Many people also refer to this as the CAMS IdP. The TouchstoneNetwork IdP hosts the Collaboration Accounts Management System (CAMS), which allows nearly anyone to self-register for an account which may be used to authenticate to several applications. People may self register for an accont with this IdP by using a working email address that they control. Users may not register with an email address that ends in "@mit.edu". This is because people with such email addresses can already use their normal MIT account via the MIT IdP.

MIT is also a participant in the InCommon Federation. Over 100 other universities, corporations, and agencies are also members of the InCommon Federation. Instead of enumerating which of the many IdPs that belong to members of InCommon in the information below, we simply indicate if the application may support an IdP from one of the InCommon participants.

Key to attribute release information

One of the most powerful aspects of MIT Touchstone and Shibboleth is the ability to release selected information about the person that has authenticated to the application. This is done using a SAML assertion. Different applications can receive different information. In fact, some applications will not receive personally identifiable information about the user that has authenticated.

The following explains some of terminology related to our attribute release policies:

DisplayName - this is typically a concatenation of the user's first name and last name. For example: John Doe.

eduPersonPrimaryAffiliation - this will typically be one of the following: student@mit.edu, staff@mit.edu, affiliate@mit.edu. Affiliate means that the person has an MIT account but is not a student, staff, or faculty member. The person might be a temporary contractor, a visiting scholar, or a even a family member of a student or staff member.

email address - In the case of CAMS account this will be the email address that the person used to register and activate their account. For MIT users this will normally be their Kerberos username followed by "@mit.edu".

EPPN (eduPersonPrincipalName) - for MIT users this will be the Kerberos username followed by "@mit.edu". For TouchstoneNetwork Collaboration Accounts this will be an identifier follwed by "@touchstonenetwork.net".

Applications:

Stellar

is the platform for learning, course management and collaboration, serving the MIT community.

Identity providers supported: MIT, and TouchstoneNetwork. InCommon is not supported at this time.

Attributes released to Stellar by the IdPs:

TouchstoneNetwork: DisplayName, email address, EPPN

MIT: DisplayName, email address, EPPN, eduPersonPrimaryAffiliation

Applications which support MIT Touchstone

Key to identity providers

Key to attribute release information

Applications:

The CoManage demo

The TeraGrid beta

Related Links

Applications