ZXID Home - Open Source IdM for the Masses - SAML SSO

Sampo Kellomäki (sampo@iki.fi)

Downloads

Dependencies: To compile ZXID you need:

  1. openssl-0.9.8e or later. See www.openssl.org. Most Linux distros are sufficient.

  2. zlib from zlib.net. Your distro is sufficient.

  3. libcurl from http://curl.haxx.se/, version 7.15.5 (probably your distribution is fine). It needs to be compiled to support HTTPS.

  4. HTTPS capable web server, such as Apache (see my receipe), with CGI support. Or Jef Pozkanzer's mini_httpd available from http://www.acme.com/ software/mini_httpd/

Platforms:

  • Linux: supported (ix86)

  • FreeBSD: supported, see port in http://www.freshports.org/security/zxid/

  • Solaris 8: supported (Sparc)

  • Mac OS 10 (Darwin): supported (Power PC)

  • Windows 2k: preliminary support using MinGW (I am not knowledgeable enough in Windows to help you if you hit troubles)

ZXID is developed on ix86 Linux with POSIX as a goal, any modern system should work. You will need GNU make. I use gcc-3.4.6 as a compiler so others (such as gcc-4) may need minor tweaking.

ZXID Joins OpenLiberty.org

Who needs this?

ZXID project has currently (April 2008) six outputs

libzxid

A C library for supporting SAML 2.0, including federated Single Sign-On (SSO)

zxid

A C program that implements a SAML Service Provider (SP) as a CGI script

Net::SAML

A Perl module wrapping libzxid. Also zxid.pl, that implements SP in mod_perl environment, is supplied.

php_zxid

A PHP extension that wraps libzxid. Also supplied: zxid.php that implements SP in mod_php environment.

libzxidjni.so

A Java JNI extension that wraps libzxid. Also supplied: zxid.java that implements SP as a CGI script. zxidhlo.java demonstrates use under servlet engine, e.g. Tomcat.

mod_auth_saml

An Apache httpd auth module that does SAML SSO. No programmatic integration required, just alter your Apache httpd.conf

You need this if you are

Web Master

You want to enable SAML based Single Sign-On (SSO) to your web site. In this case you would use the zxid SP CGI script directly, only configuring it slightly or you can go the zxid_simple() route. Otherwise you can hint your PHP or perl developer that this functionality is available and your want it.

Perl Developer

You can use the Net::SAML module to integrate SSO to your application and web site. Given the direct perl support, this is easier than fully understanding the C interface. Both mod_perl and perl as CGI are supported.

PHP Developer

You can use dl("php_zxid.so") to load the module and access the high level functionality, such as SAML 2.0 SSO. We support functionality roughly equivalent to perl Net::SAML. The PHP module is fully ready to use for SSO, but we expect to add a lot more, such as WSC, in future. Both mod_php5 and php as CGI are supported. php4 should also work.

Java Developer

You can use System.loadLibrary("zxidjni") to pull into your Java proram the full power of the ZXID. The functionality supported is roughly equal to Net::SAML.

Web Developer

You want to integrate SAML based SSO to your web site tool or product so that your customers can enjoy SSO enabled web sites. In this case you would study zxid.c for examples and use libzxid.a to implement the functionality in your own program.

Identity Management hacker

You need some building blocks: you will study libzxid and add to it, contributing to the project.

ZXID Project has vastly more ambitious goals. See the ZXID Project chapter in documentation (PDF).

Conor Cahill of Intel (formerly AOL) said back in 2006:

IMNSHO, better go Liberty up front and have the confidence that you do not need to upgrade later - or run two parallel systems. The Liberty (or SAML 2.0) system is comprehensive and addresses every use case anyone has thought so far. The percieved complexity is really an implementation issue and not underlying propery of the spec. Since we provide an implementation, the "complexity" is not customer problem.

Try it out immediately

In this space we host links to IdPs that work with ZXID and to ZXID test sites you can use to get a feel for yourself. There is no guarantee that these sites stay up:

Freely downloadable IdPs you can install and test against

Aims of ZXID Project

ZXID aims at full stack implementation of all federated identity management and identity web services protocols. Initial goal is supporting SP role, followed by ID-WSF WSC and IdP roles. We aim at supporting US GSA E-Auth profile.

ZXID is light weight, has a small foot print, and is implemented in C. It is suitable for both high performance and embedded applications. Scripting languages are supported using SWIG, including Perl, PHP and Java. The "full stack" nature of ZXID means it's self contained and has minimal external library dependencies (see downloads).

Targeted Federated Identity Standards

Targeted ID Web Services Standards

Approach

ZXID consists of C libraries. Some of these libraries are generated from schema grammar descriptions using a tool called xsd2sg.pl, part of Plaindoc distribution. Other libraries that express flows and processing rules are hand-written. The language bindings, other than C, are generated automatically using swig(1).

Status

Beta. As of 0.25 (April 2008) the package is mature for doing SSO and other SP related tasks. It also supports perl and mod_perl by way of Net::SAML module, PHP5 (and php4) using php_zxid.so, as well as Java using libzxidjni.so. However it is still missing some essential functionality (e.g. signature generation).

mod_auth_saml and the WSC and WSP roles are still alpha grade.

So far we have

IdP, DS, and WSP functionality are slated only later (unless a volunteer steps forward).

Documentation

Currently most documentation is maintained as an extensive README.zxid (PDF) file. This file details compilation, installing, configuring, and use. It is also distributed as part of the source code package.

I also encourage you to read the source, especially headers. Starting from c/zx-sa-data.h, zxid.h, zxid.c, and zxidsimp.c will be most instructive.

All the specifications supported by ZXID are freely available on the net. Try

Support

Mailing list and forums

Mail the author until we get the list set up. Or volunteer a list :-)

Bugs

Mail the author until we get bug tracking set up. Or volunteer.

Developer access

We use CVS, but access needs to be manually configured and is not anonymous. If you contribute significantly, I will bother. Others can send patches (good way to show you are worthy of CVS access) to me. I've heard some mixed experiences about open source sites like sourceforge. If you run such site and want to host ZXID Project, please contact me.

If you just always want the latest source: get the tar ball from the downloads section. Trust me, this is still so much in flux that only the tar ball snapshots are in any usable state. CVS access just to get latest source would be pointless.

Commercial Support

Following companies provice consultancy and support contracts for ZXID:

Previous Releases

Some Links

http://www.freshports.org/security/zxid/

License

Copyright (c) 2006-2008 Symlabs (symlabs@symlabs.com), All Rights Reserved. Author: Sampo Kellomäki (sampo@iki.fi)

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

While the source distribution of ZXID does not contain SSLeay or OpenSSL code, if you use this code you will use OpenSSL library. Please give Eric Young and OpenSSL team credit (as required by their licenses).

And remember, you, and nobody else but you, are responsible for auditing ZXID and OpenSSL library for security problems, backdoors, and general suitability for your application.