1. Overview

Only GNOME 2 has so far be tested with Moonshot.

2. Compatibility

2.1. Key

In the tables below, the following icons have the following meanings:

•  - This version of the software has been tested and verified as supporting Moonshot.
•  - This version of the software has been tested and verified as not supporting Moonshot.
•  - This version of the software has not yet been tested thoroughly and its status is not known. Let us know if you have tried it and whether it worked or not!

2.2. Compatibility List

Version	Compatible?	Notes
GNOME 3
GNOME 2		When running on a supported Linux platform
GNOME 1

3. Installation & Configuration

 How you set up a Moonshot-enabled version of GNOME will differ depending on your OS. See the relevant pages for your particular distribution:

• CentOS 6
• RHEL 6
• Scientific Linux 6

4. Next Steps

4.1. Account Mapping

Moonshot by default uses Shibboleth libraries to parse RADIUS and SAML attributes.

SAML assertions can be embedded inside RADIUS responses by the IdP, allowing an IdP to exercise a very fine-grained authorisation policy. One potential use of this is to allow the Moonshot IdP to specify which account the user should log in to your GNOME environment as. RADIUS attributes, such as the User-Name attribute, are simply mapped with a special type of Shibboleth attribute. To do this, enable the functionality in Shibboleth as follows.

Edit /etc/shibboleth/shibboleth2.xml and modify the lines after the opening <SPConfig ... clockSkew="180"> stanza:

    <OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a">
        <Extensions>
                <Library path="plugins.so" fatal="true" />
        </Extensions>
    </OutOfProcess>

    <OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a">
        <Extensions>
                <Library path="plugins.so" fatal="true" />
        </Extensions>
    </OutOfProcess>

4.1.1. Mapping to an account specified in a SAML attribute

To map an attribute in a SAML assertion embedded in a RADIUS response, your GNOME environment maps that to a local user account (via local-login-user) as follows:

1. Edit /etc/shibboleth/attribute-map.xml and find the SAML attribute that the Moonshot IdP will be sending you that contains the username.

   Example

   We want to map from the incoming SAML2 representation of "eduPersonEntitlement"

   <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" id="entitlement"/>

2. Change the id of the attribute to "local-login-user".

   Example

   We change the attribute defining the SAML2 representation of "eduPersonEntitlement" such that its id becomes "local-login-user"

   <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" id="local-login-user"/>

   In the standard Moonshot distribution, GNOME will look for local-login-user to determine who to authenticate the user as. This attribute mapping will be managed by the XML assertion in the FreeRADIUS reply for a successful authentication.

4.1.2. Further mapping options

To Come!

4.2. Logging into GNOME using Moonshot

The user experience of logging into GNOME is different to the usual experience when using Moonshot (see the warning at the start of this page).

To do so, do the following:

1. On the GNOME login screen, click on the "Other..." button below the list of local users.
2. At the Username: prompt, enter the full NAI of your username (e.g., johnsmith@example.com). Hit return.
3. A Password: prompt will show. Enter the password associated with the account. Hit return.
4. If successful, you should be logged into GNOME as the local user that your account is mapped to (see next section).