The Online Passport service is offered by Northwestern Information Technology (IT) to departments and schools who wish to restrict access to their websites or web-based applications. Authenticated protection can include an entire website or individual portions. Some URLs can be publicly open, while others can require membership in specific NetID groups. Access can also be limited to a group of NetIDs such as faculty, undergraduate students, or particular school students. Once authenticated through the Online Passport service, the user is not challenged for NetID/password when visiting other participating websites.
Features/Options
The AM system is comprised of the AM server and the AM Policy Agent.
- The AM server. A pool of four servers across the Evanston and Chicago campuses that store URL policy information (who is permitted to access what) and provide the user interface for logging in.
- The AM Policy Agent. This is a module that is loaded into your web or application server. The agent is responsible for intercepting all URL requests, determining whether the URLs are protected, verifying that the user has successfully authenticated, and enforcing any relevant access policies.
Single Sign-on process:
- A user requests a URL in the browser.
- The AM Policy Agent on the Web server intercepts the request and checks for the presence of the SSO (Single Sign-on) cookie.
- If the cookie is not present, the user is redirected to the AM server and asked to login.
- Upon successful login, the user is redirected back to the original URL.
- The Policy Agent again intercepts the request, verifies that the cookie is present and valid, optionally checks access control policies (see below), then passes the request on to the web server.
Access Control:
- Online Passport can restrict access to your web site (or portions thereof) to standard NetID groups. For example, access to "http://your-server.northwestern.edu/public/" might be allowed for any valid NetID, while "http://your-server.northwestern.edu/faculty-only-files/" might be restricted to Northwestern faculty.
- The authenticated user's NetID is provided to your web applications as an HTTP REMOTE_USER environment variable, so you can make fine-grained access control decisions, and/or use the NetID as a unique session identifier.
Ordering
In order to use Online Passport SSO, you will need to formally request access for your application (NetID required). Please visit the Authentication and Authorization Services to request access.
A special username and password will be issued to your application for use in contacting the Access Manager server to retrieve policy information and other configuration data. We will also retain contact information in order to inform you of upgrades, configuration changes, server maintenance, and other outages.