Moodle as a central authentication authority and identity provider

Moodle as a central authentication authority and identity provider

by David Bogner -
Number of replies: 5
Picture of Core developers Picture of Plugin developers

Hi,


we are planning to use a Moodle installation as a central authentication SSO / identitiy provider solution. This Moodle installation should only be responsible for the users profile management and should provide SSO to connected institutions (via Moodle MNET).

The idea is to provide a SSO solution for a network of institutions, that all use Moodle as their LMS. And all institutions have a shared user base. Also the authentication authority would be connected to LDAP (not yet clear yet, because this is a political decision, we can't influence, only basic authentication - username password name firstname).

Makes such a structure sense, or is that completely nonsense?

Thank you for your opinions on that.

Best regards,

David

Attachment Bildschirmfoto vom 2012-08-28 100908.png
Average of ratings: -
In reply to David Bogner

Re: Moodle as a central authentication authority and identity provider

by Siamak Alavi -

Hi David,

I am doing a same thing, connected to LDAP and based on a user attribute add user to the related cohort. used plugin called "Autoenrol cohort".

I am using MNET for SSO to Mahara, but in this stage I am facing a problem. I can not manage users in mahara properly, all users will be add to a single institution, witch is not good. We need to separate students based on their class, so students in upper class should not be able to see students in lower class. do you have any idea about this?

Thanks and regards

Siamak

Average of ratings: -
In reply to Siamak Alavi

Re: Moodle as a central authentication authority and identity provider

by David Bogner -
Picture of Core developers Picture of Plugin developers

Hi Siamak,


I do not have any experience with mahara. But if user management is similar to moodle it should be possible to select the users according to a user field (attribute).

You could upload csv files with a profile field (we used the msn field because nobody used that field), then you can do some bulk user action with the users, that have the specific value in the user profile field.

Best regards,

David

Average of ratings: -
In reply to David Bogner

Re: Moodle as a central authentication authority and identity provider

by Vernon Spain -
Picture of Plugin developers Picture of Testers
Hi David, I like this model and we are looking at the same basic idea so I am curious... 1. Would your users login to the M.a.a. and then navigate to their course(e.g. Moodle inst.C) 2. How can you manage bulk enrolments across the mnet? Cheers and regards, Vernon
Average of ratings: -
In reply to Vernon Spain

Re: Moodle as a central authentication authority and identity provider

by David Bogner -
Picture of Core developers Picture of Plugin developers

Hi Vernon,

right now we have that installation for three weeks, and I have migrated 10.000 users from different platforms to our central Moodle MNET authentication provider.

All the other Moodle instances have got only MNET login. There aren't any local users anymore. I am quite enthousiast about this solution. Because I can now login to all the platforms with one login.

Bulk enrolments is possible with a feature called "Remote enrolments". On the moodle installation, where all the user accounts are created, you can enrol the users to courses of the other Moodle platforms, even if they did not login to those platforms yet.

A workflow is described at:

http://docs.moodle.org/22/en/MNet_remote_enrolments

I have also a modified version of the standard theme. That theme allows you to simplify the login on remote hosts. It hides the local login form and generates a login link with automatic redirect to the page where you came from. I just tried to upload it here, but it is too big. You can get it from here: http://ubuntuone.com/1coVBiEBR2bvC1gxz32Sqh
 (it might not be there forever...)

Using the theme might lock you out of your site! (loginform is only hidden, so you can make it visible with firebug, change display:none to display: block).

You also have to define your site admins in the config file, when you use that theme, because remote users can't be defined as admins in the web interface. $CFG->siteadmins = '234,3,21,24';

The numbers are the user ids of the remote users who should be admin. We have a complete workflow how to migrate multiple Mooodle platforms to SSO authentication described in my first post. But the documents are in german.


Best regards.

David

Average of ratings: -
In reply to David Bogner

Re: Moodle as a central authentication authority and identity provider

by Bert van der Hooft -

Hi David,

How about the actual status of moodle as a central authentication system? What are the learning points?

I can read German

Bert


Average of ratings: -