Vera Clemens (Jun 03 2026 at 13:33): Vera Clemens (Jun 03 2026 at 13:33):Hi,
we've received a request to setup connection of a Dataverse to DFN AAI. The Dataverse is running in Kubernetes.
From what I could gather, it seems that integration of a Shibboleth-based identity provider like DFN AAI in this kind of environment is relatively complicated (e.g. https://guides.dataverse.org/en/latest/installation/shibboleth.html#shibboleth + https://github.com/IQSS/dataverse/issues/5974 "Shibboleth as an SP IMHO is a nightmare" :grimacing: @Oliver Bertuch ).
Is there any recommended approach for this? Or has anyone done something like this? I've only worked with OIDC-based providers thus far...
Thanks in advance!
Philip Durbin 🚀 (Jun 03 2026 at 13:35):Ha, I don't think it's SO bad.
Philip Durbin 🚀 (Jun 03 2026 at 13:36):We use Shibboleth in production at Harvard Dataverse.
Philip Durbin 🚀 (Jun 03 2026 at 13:36):And lots of Dataverse installations use it, I'd say.
Philip Durbin 🚀 (Jun 03 2026 at 13:36):Maybe you can help us learn any shortcomings in those docs you linked.
Vera Clemens (Jun 03 2026 at 13:47):I'm not sure how suitable those installation instructions from the docs are for a Docker/Kubernetes-based environment. I.e., when running a gdcc/dataverse image, those instructions would need to be applied on top?
Vera Clemens (Jun 03 2026 at 13:48):Not critiquing the docs per se, I'll admit I am feeling slightly out of my depth here :smile:
Vera Clemens (Jun 03 2026 at 13:49):Also found these notes here:
Shibboleth is perfectly suited for use as an identity provider.
Running it as a service provider for Dataverse on a Kubernetes deployment is a bad idea. It violates best practices of one service per container and locks you into an Apache-based reverse proxy. You will want to avoid that by all means on Kubernetes cluster.
https://k8s-docs.gdcc.io/en/v4.20/day3/auth.html
(author is also @Oliver Bertuch I believe? :smile: )
Philip Durbin 🚀 (Jun 03 2026 at 13:55):Yeah, let's drag @Oliver Bertuch into this if we can. I may be missing something!
Philip Durbin 🚀 (Jun 03 2026 at 13:55):@Don Sizemore knows all about Shib as well.
Oliver Bertuch (Jun 03 2026 at 14:00):I can only advice against using shibd. There is nothing wrong with using SAML though. IMO the best way forward is using a Broker. Dataverse talks OIDC with it. Any heavy lifting and mapping can be done by the broker (Keycloak, DeX, Unity,...)
Oliver Bertuch (Jun 03 2026 at 14:01):Dex is really lightweight. Keycloak better if you need advanced stuff. Unity is what drives Helmholtz AAI and some others.
Oliver Bertuch (Jun 03 2026 at 14:02):As you are going to federate, maybe DeX is _too_ lightweight. Not sure if and how they support discovery and feeds.
Oliver Bertuch (Jun 03 2026 at 14:06):If your institution already runs shibd as IDP and is federated with DFN, they may be able to run the SP for you and enable OIDC brokering on it.
Oliver Bertuch (Jun 03 2026 at 14:08):Can't you use NFDI AAI from Base4NFDI? IIRC they federate with DFN already and provide OIDC.
Oliver Bertuch (Jun 03 2026 at 14:10):All that said: you can of course run Shibd on K8s in SP mode. But maybe use the OIDC brokering module they provide and don't use the special reverse proxy setup Dataverse suggests. As you run an OIDC based frontend, IMO this won't be a viable/sustainable option for you (or anyone else looking into the Modern UI).
Don Sizemore (Jun 03 2026 at 14:22):@Vera Clemens I remember that Slava got Shibboleth working in Kubernetes, but he had to forward some additional headers to the Apache mod_shib proxy.
Oliver Bertuch (Jun 03 2026 at 14:28):Some of that may be found here IIRC: https://github.com/search?q=repo%3AIQSS%2Fdataverse-docker%20shibboleth&type=code
Philip Durbin 🚀 (Jun 03 2026 at 14:38):Don Sizemore said:
Vera Clemens I remember that Slava got Shibboleth working in Kubernetes, but he had to forward some additional headers to the Apache mod_shib proxy.
@Slava Tykhonov ^^
Vera Clemens (Jun 03 2026 at 14:54):Thanks for the detailed info!! I will take a look and we'll consider our options. Integration via a broker sounds like the most straightforward approach, considering we already have some experience running a Keycloak. But we'll see. Integrating the Base4NFDI AAI also sounds like an interesting idea.
(Just btw, this is for a new & separate Dataverse instance we are administrating, which is using the standard Dataverse UI)
Oliver Bertuch (Jun 03 2026 at 14:58):If this is for a "Classic UI" based Dataverse, using the Apache + mod_shib + AJP approach may be feasible. I still wouldn't advise to do it for any _new_ installation, as the Classic UI is phasing out and you'll need OIDC anyway for the Modern UI.
Last updated: Aug 18 2026 at 08:27 UTC