Securing Web Services With SAML

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Securing Web Services With SAML"

Transcription

1 Carl A. Foster CS-5260 Research Project Securing Web Services With SAML Contents 1.0 Introduction What is SAML? History of SAML The Anatomy of SAML Assertion Query and Request Protocol Authentication Request Protocol Artifact Resolution Protocol Name Identifier Management Protocol Single Logout Protocol SAML Binding SSO Profile How Web Services Interact Web Service Choreography Web Service Orchestration SAML 2.0 Use Case Conclusions Future Work References Page 1 of 10

2 1.0 Introduction I decided to do research on the SAML protocol and how it is related to securing web services. This paper is designed to describe SAML and how it is used to an audience who has had little to no exposure securing web services with security policies. A brief introduction describing the contents of this paper is below: Sections 2 4 of this paper first describe what SAML is and why it is important from a security standpoint. This is followed by a brief history of SAML and the anatomy of SAML 2.0. Sections 5 7 introduce the reader to how web services interact. Two main interaction types are described; Web Service Choreography and Web Service Orchestration. Section 8 Ties together sections 2 7. where interactions of a real world use case for SAML 2.0 are described. Lastly, sections 9 and 10 outline conclusions of the research and future work 2.0 What is SAML? SAML stands for Security Access Markup Language. It is an XML-based standard for exchanging authentication and authorization between security domains. In a larger sense security policies using SAML are attached to web services and in turn the web service abides by the rules and assertions that are specified by a particular policy. SAML abstracts the security away from platform architectures and vendor specific software implementations. In situations where you are concerned with securing web services, policies can be attached to the service endpoints without a need to change the underlying application. This makes attaching security policies very desirable in situations where the application developer is not involved in the implementation of system security. The diagram below shows a SAML 2.0 policy that is being selected and bound to a web service during application design time. This particular SAML policy also verifies that the transport protocol use Secure Socket Layer (SSL) be used for message protection. The policy can be applied to any SOAP-based endpoint. Figure 1.0 Example of SAML 2.0 Security Policy Page 2 of 10

3 3.0 History of SAML Three major versions of SAML have been released. SAML 1.0 in November of 2002, SAML 1.1 in September of 2003, and SAML 2.0 in March of This research discussed in this paper is primarily concerned with the 2.0 version of SAML. SAML was originally a product of Organization for the Advancement of Structured Information Standards (OASIS) Security Services Technical Committee. OASIS are a not for profit organization. The organization promotes standards for security, cloud computing, Service Oriented Architecture (SOA), web services, emergency management, and many other standards. SAML 2.0 improved the standard in many ways. First, the standard was stabilized. This means that moving forward from version 2.0 no significant changes to the standard will be made. When changes to the standard are made they will be done in a predictable fashion. The Liberty Alliance had been influential in the first part. Secondly, and perhaps most importantly, SAML 2.0 has been more tightly integrated with open source Single Sign On (SSO) and federation services. In particular the Shibboleth project. It is worth mentioning that participants in the Shibboleth project were also authors of the SAML 2.0 Standard. Shibboleth is a standards based open source software package for web single signon across or within organizational boundaries. It allows granular protection of resources across a federation. 4.0 The Anatomy of SAML 2.0 SAML 2.0 is comprised of many things. The Primary Protocols that make up SAML are the Assertion Query and Request Protocol, Authentication and Request Protocol, Artifact Resolution Protocol, Name Identifier Management Protocol, and the Single Logout Protocol. SAML Bindings are SAML SOAP Binding, Reverse SOAP Binding, HTTP Artifact Binding, and the SAML URL Binding. The primary profile that we are concerned with in this paper is the SSO Profile. The information in this section is primarily from the OASIS specification referenced at the end of this document Assertion Query and Request Protocol Defines the messaging and processing rules for requesting existing assertions by reference or querying the assertions by subject and statement type Authentication Request Protocol Use the authentication request protocol to send an <AuthnRequest> message element to a SAML authority and request that it return a <Response> message containing one or more such assertions. Page 3 of 10

4 Artifact Resolution Protocol The artifact resolution protocol provides a mechanism by which SAML protocol messages can be transported in a SAML binding by reference instead of by value. Both requests and responses can be obtained by reference using this specialized protocol. A message sender, instead of binding a message to a transport protocol, sends a small piece of data called an artifact using the binding. An artifact can take a variety of forms, but must support a means by which the receiver can determine who sent it. If the receiver wishes, it can then use this protocol in conjunction with a different (generally synchronous) SAML binding protocol to resolve the artifact into the original protocol message Name Identifier Management Protocol After establishing a name identifier for a principal, an identity provider wishing to change the value and/or format of the identifier that it will use when referring to the principal, or to indicate that a name identifier will no longer be used to refer to the principal, informs service providers of the change by sending them a <ManageNameIDRequest> message Single Logout Protocol The single logout protocol provides a message exchange protocol by which all sessions provided by a particular session authority are near-simultaneously terminated. The single logout protocol is used either when a principal logs out at a session participant or when the principal logs out directly at the session authority. This protocol may also be used to log out a principal due to a timeout. The reason for the logout event can be indicated through the Reason attribute SAML Binding SOAP Binding [SAMLBind] supports the use of SSL/TLS (see [RFC 2246]/[SSL3]) or SOAP Message Security mechanisms for confidentiality SSO Profile The specification calls out a SAMLv2 lightweight Web Browser Single Sign-On Profile. This profile is modeled on the OASIS SAMLv2 Web Browser SSO profile, adding various constraints, and using a new lighter weight SAMLv2 HTTP POST binding offering an optional signature technique that is more simple-to-implement than the optional XML Digital Signature approach. XML digital signature (XMLdsig) [W3C.xmldsig core] is made optional because it is asserted by various implementers that implementation support for it is essentially non-existent in so-called "scripting" environments, e.g. PERL/PYTHON/PHP/Ruby, and/or different implementations of it are not very interoperable as yet, due to the inherent complexity of the specification and its required behaviors. Security Assertion Markup Language (SAML) v2.0, "SAMLv2", is an XML-based framework for creating and exchanging security information. [OASIS.sstc saml exec overview 2.0 cd 01] and OASIS.sstc saml tech overview 2.0 cd 01] provide non-normative overviews of SAMLv2. The SAMLv2 specification set is normatively defined by [OASIS.saml conformance 2.0 os]. Page 4 of 10

5 5.0 How Web Services Interact As described earlier, security policies are attached to a web service endpoint. In the case of this research the security policy being attached to the web service endpoint uses SAML 2.0 with message protection (SSL.) In order to better understand the use case for SAML 2.0 presented in section 8.0 of this paper, it is important to understand the two major types of web service interaction at a high level. Web Service Choreography is described in section 6.0 and Web Service Orchestration is described in section 7.0. In both examples are primary concern is attaching the SAML 2.0 Policy to each service end point for requests and responses. 6.0 Web Service Choreography In web service choreography the relationships between web services are dynamic. Decisions are typically made between individual web services. This means that no single web service is in control of the actions of all of the other web services. This is a common implementation in cloud computing environments where information is shared between domains. In a web service choreography scenario, the SAML 2.0 Security Policy would be attached to each of the web services in the figure below. This means the exact same policy would be attached to Bank Service, External Bank Service A, External Bank service C, and External Bank Service D. The challenge in this scenario is in getting all parties, both internal and external businesses, to agree upon the type of security policy to apply, and how to regulate change to the system. Page 5 of 10

6 Figure 2.0 High Level Example Web Service Choreography 7.0 Web Service Orchestration In web service orchestration the relationships between web services are relatively static. Decisions are typically controlled by a single service. This means that other web services in the orchestration could be dependent on the web service that is responsible for the orchestration. This is a common design when web services are within the same domain. In a web service orchestration scenario, the SAML 2.0 Security Policy would be attached to each of the web services in the figure below much the same as in the choreography scenario. This means the exact same policy would be attached to Internal Bank Service, Internal Bank Service A, Internal Bank service B, Internal Bank Service C, and Internal Bank Service D. The challenges in setting up this scenario are not as great as those of choreography. This is because all agreements are internal to the business that is implementing the web services. However, If service Bank Service has to rely on any external information provided by an outside web service the challenges of setting up a choreography would than apply. Page 6 of 10

7 Figure 3.0 High Level Example Web Service Orchestration 8.0 SAML 2.0 Use Case The steps below walk through a use case of SAML 2.0. This use case can apply regardless of web service interaction type. It will work in a choreography or orchestration scenario if policy agreements allow. Figure 4.0 shows the flow of events. This use case is nearly identical to one that is provided on Wikipedia. The diagram is from that use case and the steps needed very little tweaking. The SSO provider could be any SSO provider. In this case when we mean SSO provider we are referring to Shibboleth. 1. Request a Resource A resource can be any URI (Uniform Resource Identifier). In this example we are using a URL. We are requesting something from a bank. In the example we use the principal is an HTTP user agent Respond with a form In the case of SAML 2.0 the service provider will respond with an XHTML (extensible HyperText Markup Language) form. <form method="post" action=" <input type="hidden" name="samlrequest" value="request" /> Page 7 of 10

8 ..... <input type="submit" value="submit" /> </form> 3. The Single Sign on Service is requested at the Identity Provider. The user agent issues a POST request at the SSO identity provider. The SAMLRequest is taken from the form in the previous step. If the user does not have a valid security context they are issued one, or, if the security request does not meet the requirements of the provider access is denied. 4. An XHTML form is given in response. If the request is valid the SSO responds with a document containing an XHTML Form. <form method="post" action=" <input type="hidden" name="samlresponse" value="response" />... <input type="submit" value="submit" /> </form> 5. Request the assertion provider at the Service Provider. The user agent issues a POST request to the assertion provider, the value of SAMLResponse is taken from the XHTML form. 6. User Agent is re-directed to the target resource. In our case the user agent is asking for whatever resource myaccount in step #1 actually is. 7. The resource is requested at the Service Provider again. This request is for the original request in step # Requested Resource is returned. In our case we know the security context already exists. The service provider returns the requested resource back to the user agent. Page 8 of 10

9 Figure 4.0 Flow of Events SSO SAML 2.0 Use Case 9.0 Conclusions Nothing is truly mandated. Even if all parties agree upon the type of security policy that will be used between services from different business partners nothing can remove the human element. For example, a SAML security policy can be attached to a web service endpoint but the web service policy can be disabled. Disabling a policy has the same impact as it not being bound to the service at all, the policy is completely ignored. Securing web services with SAML on the surface seems fairly straight forward. You attach (bind) a SAML security policy to a web service that has already been deployed, or you can attach it via a development environment during design time. However, if you take a look at the use case in Section 8.0 you begin to appreciate the amount of configuration involved. For the use case to work you need to install and configure an Identity provider such as Microsoft Active Directory, an SSO solution, a KeyStore, and possibly a ticket management system. This is not to mention device security for network devices such as routers. Although the configuration aspects are quite a challenge, SAML itself provides a good solution for assuring identity and proper authorization across federations. When used in conjunction with Page 9 of 10

10 SSO it can provide fine-grade access to resources while allowing the consumer of the resource to remain virtually anonymous Future Work Develop large scale generic deployment solutions. I think this would be particularly useful in cloud computing environments. Such environments are dynamic in nature and I think the real issue comes into play when resources have to be dynamically scaled. For example, you may access a web service that is available within a virtual machine created at a particular point in time based on the amount of requests coming into the system. How do we know the services on the machine are the most current in an automatic fashion? How can the resource be dynamically identified so that the SSO service does not reject the request even when the remainder of the service has been configured correctly? 11.0 References NIST: Guide to Secure Web Services OASIS: Authorization Context for the OASIS Security Service Markup Language (SAML) V2.0 PAPERS: Information Assurance Challenges and Strategies for Securing SOA Environments and Web Services IEEE SysCon rd Annual IEEE International Systems Conference, 2009 Vancouver, Canada, March 23 26, 2009 Combining Identity Federation With Payment: The SAML Based Payment Protocol 2010 IEEE/IFIP Network Operations and Management Symposium - NOMS 2010 Wikipedia: Page 10 of 10

Lecture Notes for Advanced Web Security 2015

Lecture Notes for Advanced Web Security 2015 Lecture Notes for Advanced Web Security 2015 Part 6 Web Based Single Sign-On and Access Control Martin Hell 1 Introduction Letting users use information from one website on another website can in many

More information

Biometric Single Sign-on using SAML

Biometric Single Sign-on using SAML Biometric Single Sign-on using SAML Architecture & Design Strategies Ramesh Nagappan CISSP Ramesh.Nagappan@sun.com 1 Setting Expectations What you can take away! Understand the importance of Single Sign-On

More information

Implementation Guide SAP NetWeaver Identity Management Identity Provider

Implementation Guide SAP NetWeaver Identity Management Identity Provider Implementation Guide SAP NetWeaver Identity Management Identity Provider Target Audience Technology Consultants System Administrators PUBLIC Document version: 1.10 2011-07-18 Document History CAUTION Before

More information

Biometric Single Sign-on using SAML Architecture & Design Strategies

Biometric Single Sign-on using SAML Architecture & Design Strategies Biometric Single Sign-on using SAML Architecture & Design Strategies Ramesh Nagappan Java Technology Architect Sun Microsystems Ramesh.Nagappan@sun.com 1 Setting Expectations What you can take away! Understand

More information

STUDY ON IMPROVING WEB SECURITY USING SAML TOKEN

STUDY ON IMPROVING WEB SECURITY USING SAML TOKEN STUDY ON IMPROVING WEB SECURITY USING SAML TOKEN 1 Venkadesh.M M.tech, Dr.A.Chandra Sekar M.E., Ph.d MISTE 2 1 ResearchScholar, Bharath University, Chennai 73, India. venkadeshkumaresan@yahoo.co.in 2 Professor-CSC

More information

2015-11-30. Web Based Single Sign-On and Access Control

2015-11-30. Web Based Single Sign-On and Access Control 0--0 Web Based Single Sign-On and Access Control Different username and password for each website Typically, passwords will be reused will be weak will be written down Many websites to attack when looking

More information

Test Plan for Liberty Alliance SAML Test Event Test Criteria SAML 2.0

Test Plan for Liberty Alliance SAML Test Event Test Criteria SAML 2.0 1 2 3 4 5 6 7 8 9 10 11 Test Plan for Liberty Alliance SAML Test Event Test Criteria SAML 2.0 Version 3.2.2 Editor: Kyle Meadors, Drummond Group Inc. Abstract: This document describes the test steps to

More information

HP Software as a Service. Federated SSO Guide

HP Software as a Service. Federated SSO Guide HP Software as a Service Federated SSO Guide Document Release Date: July 2014 Legal Notices Warranty The only warranties for HP products and services are set forth in the express warranty statements accompanying

More information

IVOA Single-Sign-On Profile: Authentication Mechanisms Version 2.0

IVOA Single-Sign-On Profile: Authentication Mechanisms Version 2.0 International Virtual Observatory Alliance IVOA Single-Sign-On Profile: Authentication Mechanisms Version 2.0 IVOA Proposed Recommendation 20151029 Working group http://www.ivoa.net/twiki/bin/view/ivoa/ivoagridandwebservices

More information

Federated Identity Management Solutions

Federated Identity Management Solutions Federated Identity Management Solutions Jyri Kallela Helsinki University of Technology jkallela@cc.hut.fi Abstract Federated identity management allows users to access multiple services based on a single

More information

OIO Web SSO Profile V2.0.5

OIO Web SSO Profile V2.0.5 ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

More information

This chapter describes how to use the Junos Pulse Secure Access Service in a SAML single sign-on deployment. It includes the following sections:

This chapter describes how to use the Junos Pulse Secure Access Service in a SAML single sign-on deployment. It includes the following sections: CHAPTER 1 SAML Single Sign-On This chapter describes how to use the Junos Pulse Secure Access Service in a SAML single sign-on deployment. It includes the following sections: Junos Pulse Secure Access

More information

IMPLEMENTING SINGLE SIGN- ON USING SAML 2.0 ON JUNIPER NETWORKS MAG SERIES JUNOS PULSE GATEWAYS

IMPLEMENTING SINGLE SIGN- ON USING SAML 2.0 ON JUNIPER NETWORKS MAG SERIES JUNOS PULSE GATEWAYS APPLICATION NOTE IMPLEMENTING SINGLE SIGN- ON USING SAML 2.0 ON JUNIPER NETWORKS MAG SERIES JUNOS PULSE GATEWAYS SAML 2.0 combines encryption and digital signature verification across resources for a more

More information

SAML-Based SSO Solution

SAML-Based SSO Solution About SAML SSO Solution, page 1 SAML-Based SSO Features, page 2 Basic Elements of a SAML SSO Solution, page 2 SAML SSO Web Browsers, page 3 Cisco Unified Communications Applications that Support SAML SSO,

More information

Tenrox. Single Sign-On (SSO) Setup Guide. January, 2012. 2012 Tenrox. All rights reserved.

Tenrox. Single Sign-On (SSO) Setup Guide. January, 2012. 2012 Tenrox. All rights reserved. Tenrox Single Sign-On (SSO) Setup Guide January, 2012 2012 Tenrox. All rights reserved. About this Guide This guide provides a high-level technical overview of the Tenrox Single Sign-On (SSO) architecture,

More information

Using SAML for Single Sign-On in the SOA Software Platform

Using SAML for Single Sign-On in the SOA Software Platform Using SAML for Single Sign-On in the SOA Software Platform SOA Software Community Manager: Using SAML on the Platform 1 Policy Manager / Community Manager Using SAML for Single Sign-On in the SOA Software

More information

Feide Integration Guide. Technical Requisites

Feide Integration Guide. Technical Requisites Feide Integration Guide Technical Requisites Document History Version Date Author Comments 1.1 Apr 2015 Jaime Pérez Allow the use of the HTTP-POST binding. 1.0 Oct 2014 Jaime Pérez First version of this

More information

IAM Application Integration Guide

IAM Application Integration Guide IAM Application Integration Guide Date 03/02/2015 Version 0.1 DOCUMENT INFORMATIE Document Title IAM Application Integration Guide File Name IAM_Application_Integration_Guide_v0.1_SBO.docx Subject Document

More information

E-Authentication Federation Adopted Schemes

E-Authentication Federation Adopted Schemes E-Authentication Federation Adopted Schemes Version 1.0.0 Final May 4, 2007 Document History Status Release Date Comment Audience Template 0.0.0 1/18/06 Outline PMO Draft 0.0.1 1/19/07 Initial draft Internal

More information

SAML Security Option White Paper

SAML Security Option White Paper Fujitsu mpollux SAML Security Option White Paper Fujitsu mpollux Version 2.1 February 2009 First Edition February 2009 The programs described in this document may only be used in accordance with the conditions

More information

Setup Guide Access Manager 3.2 SP3

Setup Guide Access Manager 3.2 SP3 Setup Guide Access Manager 3.2 SP3 August 2014 www.netiq.com/documentation Legal Notice THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT ARE FURNISHED UNDER AND ARE SUBJECT TO THE TERMS OF A LICENSE

More information

The increasing popularity of mobile devices is rapidly changing how and where we

The increasing popularity of mobile devices is rapidly changing how and where we Mobile Security BACKGROUND The increasing popularity of mobile devices is rapidly changing how and where we consume business related content. Mobile workforce expectations are forcing organizations to

More information

Agenda. How to configure

Agenda. How to configure dlaw@esri.com Agenda Strongly Recommend: Knowledge of ArcGIS Server and Portal for ArcGIS Security in the context of ArcGIS Server/Portal for ArcGIS Access Authentication Authorization: securing web services

More information

WebLogic Server 7.0 Single Sign-On: An Overview

WebLogic Server 7.0 Single Sign-On: An Overview WebLogic Server 7.0 Single Sign-On: An Overview Today, a growing number of applications are being made available over the Web. These applications are typically comprised of different components, each of

More information

OpenHRE Security Architecture. (DRAFT v0.5)

OpenHRE Security Architecture. (DRAFT v0.5) OpenHRE Security Architecture (DRAFT v0.5) Table of Contents Introduction -----------------------------------------------------------------------------------------------------------------------2 Assumptions----------------------------------------------------------------------------------------------------------------------2

More information

INUVIKA OPEN VIRTUAL DESKTOP ENTERPRISE

INUVIKA OPEN VIRTUAL DESKTOP ENTERPRISE INUVIKA OPEN VIRTUAL DESKTOP ENTERPRISE SAML 2.0 CONFIGURATION GUIDE Roy Heaton David Pham-Van Version 1.1 Published March 23, 2015 This document describes how to configure OVD to use SAML 2.0 for user

More information

OIO SAML Profile for Identity Tokens

OIO SAML Profile for Identity Tokens > OIO SAML Profile for Identity Tokens Version 1.0 IT- & Telestyrelsen October 2009 Content > Document History 3 Introduction 4 Related profiles 4 Profile Requirements 6 Requirements 6

More information

SAML 2.0 Refresher. Víctor Aké Oslo, Norway August Identity and Federation Architect

SAML 2.0 Refresher. Víctor Aké Oslo, Norway August Identity and Federation Architect SAML 2.0 Refresher Víctor Aké Oslo, Norway August 2008 http://www.projectliberty.org Identity and Federation Architect victor.ake@sun.com SAML 2 What is it? What does it do? How does it work? SAML2 components

More information

Perceptive Experience Single Sign-On Solutions

Perceptive Experience Single Sign-On Solutions Perceptive Experience Single Sign-On Solutions Technical Guide Version: 2.x Written by: Product Knowledge, R&D Date: January 2016 2016 Lexmark International Technology, S.A. All rights reserved. Lexmark

More information

Internet Single Sign-On Systems

Internet Single Sign-On Systems Internet Single Sign-On Systems Radovan SEMANČÍK nlight, s.r.o. Súľovská 34, 812 05 Bratislava, Slovak Republic semancik@nlight.sk Abstract. This document describes the requirements and general principles

More information

Symplified I: Windows User Identity. Matthew McNew and Lex Hubbard

Symplified I: Windows User Identity. Matthew McNew and Lex Hubbard Symplified I: Windows User Identity Matthew McNew and Lex Hubbard Table of Contents Abstract 1 Introduction to the Project 2 Project Description 2 Requirements Specification 2 Functional Requirements 2

More information

Microsoft Office 365 Using SAML Integration Guide

Microsoft Office 365 Using SAML Integration Guide Microsoft Office 365 Using SAML Integration Guide Revision A Copyright 2013 SafeNet, Inc. All rights reserved. All attempts have been made to make the information in this document complete and accurate.

More information

PARTNER INTEGRATION GUIDE. Edition 1.0

PARTNER INTEGRATION GUIDE. Edition 1.0 PARTNER INTEGRATION GUIDE Edition 1.0 Last Revised December 11, 2014 Overview This document provides standards and guidance for USAA partners when considering integration with USAA. It is an overview of

More information

This Working Paper provides an introduction to the web services security standards.

This Working Paper provides an introduction to the web services security standards. International Civil Aviation Organization ATNICG WG/8-WP/12 AERONAUTICAL TELECOMMUNICATION NETWORK IMPLEMENTATION COORDINATION GROUP EIGHTH WORKING GROUP MEETING (ATNICG WG/8) Christchurch New Zealand

More information

Research and Implementation of Single Sign-On Mechanism for ASP Pattern *

Research and Implementation of Single Sign-On Mechanism for ASP Pattern * Research and Implementation of Single Sign-On Mechanism for ASP Pattern * Bo Li, Sheng Ge, Tian-yu Wo, and Dian-fu Ma Computer Institute, BeiHang University, PO Box 9-32 Beijing 100083 Abstract Software

More information

Integrating VMware Horizon Workspace and VMware Horizon View TECHNICAL WHITE PAPER

Integrating VMware Horizon Workspace and VMware Horizon View TECHNICAL WHITE PAPER Integrating VMware Horizon Workspace and VMware Horizon View TECHNICAL WHITE PAPER Table of Contents Introduction.... 3 Requirements.... 3 Horizon Workspace Components.... 3 SAML 2.0 Standard.... 3 Authentication

More information

SAML-Based SSO Solution

SAML-Based SSO Solution About SAML SSO Solution, page 1 SAML-Based SSO Features, page 2 Basic Elements of a SAML SSO Solution, page 2 SAML SSO Web Browsers, page 3 Cisco Unified Communications Applications that Support SAML SSO,

More information

An Oracle White Paper August 2010. Oracle OpenSSO Fedlet

An Oracle White Paper August 2010. Oracle OpenSSO Fedlet An Oracle White Paper August 2010 Oracle OpenSSO Fedlet Disclaimer The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated

More information

SAML Federated Identity at OASIS

SAML Federated Identity at OASIS International Telecommunication Union SAML Federated Identity at OASIS Hal Lockhart BEA Systems Geneva, 5 December 2006 SAML and the OASIS SSTC o SAML: Security Assertion Markup Language A framework for

More information

JVA-122. Secure Java Web Development

JVA-122. Secure Java Web Development JVA-122. Secure Java Web Development Version 7.0 This comprehensive course shows experienced developers of Java EE applications how to secure those applications and to apply best practices with regard

More information

INTEGRATE SALESFORCE.COM SINGLE SIGN-ON WITH THIRD-PARTY SINGLE SIGN-ON USING SENTRY A GUIDE TO SUCCESSFUL USE CASE

INTEGRATE SALESFORCE.COM SINGLE SIGN-ON WITH THIRD-PARTY SINGLE SIGN-ON USING SENTRY A GUIDE TO SUCCESSFUL USE CASE INTEGRATE SALESFORCE.COM SINGLE SIGN-ON WITH THIRD-PARTY SINGLE SIGN-ON USING SENTRY A GUIDE TO SUCCESSFUL USE CASE Legal Marks No portion of this document may be reproduced or copied in any form, or by

More information

Introduction to SAML

Introduction to SAML Introduction to THE LEADER IN API AND CLOUD GATEWAY TECHNOLOGY Introduction to Introduction In today s world of rapidly expanding and growing software development; organizations, enterprises and governments

More information

HP Software as a Service

HP Software as a Service HP Software as a Service Software Version: 6.1 Federated SSO Document Release Date: August 2013 Legal Notices Warranty The only warranties for HP products and services are set forth in the express warranty

More information

Revised edition. OIO Web SSO Profile V2.0.9 (also known as OIOSAML 2.0.9) Includes errata and minor clarifications

Revised edition. OIO Web SSO Profile V2.0.9 (also known as OIOSAML 2.0.9) Includes errata and minor clarifications OIO Web SSO Profile V2.0.9 (also known as OIOSAML 2.0.9) Revised edition Includes errata and minor clarifications Danish Agency for Digitisation September 2012 Contents > 1 Introduction 8 1.1 Referenced

More information

Ameritas Single Sign-On (SSO) and Enterprise SAML Standard. Architectural Implementation, Patterns and Usage Guidelines

Ameritas Single Sign-On (SSO) and Enterprise SAML Standard. Architectural Implementation, Patterns and Usage Guidelines Ameritas Single Sign-On (SSO) and Enterprise SAML Standard Architectural Implementation, Patterns and Usage Guidelines 1 Background and Overview... 3 Scope... 3 Glossary of Terms... 4 Architecture Components...

More information

Trend of Federated Identity Management for Web Services

Trend of Federated Identity Management for Web Services 30 Trend of Federated Identity Management for Web Services Chulung Kim, Sangyong Han Abstract While Web service providers offer different approaches to implementing security, users of Web services demand

More information

New Single Sign-on Options for IBM Lotus Notes & Domino. 2012 IBM Corporation

New Single Sign-on Options for IBM Lotus Notes & Domino. 2012 IBM Corporation New Single Sign-on Options for IBM Lotus Notes & Domino 2012 IBM Corporation IBM s statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM s sole

More information

Setup Guide Access Manager Appliance 3.2 SP3

Setup Guide Access Manager Appliance 3.2 SP3 Setup Guide Access Manager Appliance 3.2 SP3 August 2014 www.netiq.com/documentation Legal Notice THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT ARE FURNISHED UNDER AND ARE SUBJECT TO THE TERMS

More information

PROVIDING SINGLE SIGN-ON TO AMAZON EC2 APPLICATIONS FROM AN ON-PREMISES WINDOWS DOMAIN

PROVIDING SINGLE SIGN-ON TO AMAZON EC2 APPLICATIONS FROM AN ON-PREMISES WINDOWS DOMAIN PROVIDING SINGLE SIGN-ON TO AMAZON EC2 APPLICATIONS FROM AN ON-PREMISES WINDOWS DOMAIN CONNECTING TO THE CLOUD DAVID CHAPPELL DECEMBER 2009 SPONSORED BY AMAZON AND MICROSOFT CORPORATION CONTENTS The Challenge:

More information

Server based signature service. Overview

Server based signature service. Overview 1(11) Server based signature service Overview Based on federated identity Swedish e-identification infrastructure 2(11) Table of contents 1 INTRODUCTION... 3 2 FUNCTIONAL... 4 3 SIGN SUPPORT SERVICE...

More information

DocuSign Single Sign On Implementation Guide Published: March 17, 2016

DocuSign Single Sign On Implementation Guide Published: March 17, 2016 DocuSign Single Sign On Implementation Guide Published: March 17, 2016 Copyright Copyright 2003-2016 DocuSign, Inc. All rights reserved. For information about DocuSign trademarks, copyrights and patents

More information

SAML 2.0 INT SSO Deployment Profile

SAML 2.0 INT SSO Deployment Profile 1 2 3 4 5 6 SAML 2.0 INT 7 8 9 Version: 0.1 Date: 2011-12-2 10 Editor: TBD 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 Contributors: The full list of contributors can be referenced here: URL Status: This

More information

CA Single Sign-On r12.x (CA SiteMinder) Implementation Proven Professional Exam

CA Single Sign-On r12.x (CA SiteMinder) Implementation Proven Professional Exam CA Single Sign-On r12.x (CA SiteMinder) Implementation Proven Professional Exam (CAT-140) Version 1.4 - PROPRIETARY AND CONFIDENTIAL INFORMATION - These educational materials (hereinafter referred to as

More information

000-575. IBM Tivoli Federated Identity Manager V6.2.2 Implementation. Version: Demo. Page <<1/10>>

000-575. IBM Tivoli Federated Identity Manager V6.2.2 Implementation. Version: Demo. Page <<1/10>> 000-575 IBM Tivoli Federated Identity Manager V6.2.2 Implementation Version: Demo Page 1.What is the default file name of the IBM Tivoli Directory Integrator log? A. tdi.log B. ibmdi.log C. ibmdisrv.log

More information

USING FEDERATED AUTHENTICATION WITH M-FILES

USING FEDERATED AUTHENTICATION WITH M-FILES M-FILES CORPORATION USING FEDERATED AUTHENTICATION WITH M-FILES VERSION 1.0 Abstract This article provides an overview of federated identity management and an introduction on using federated authentication

More information

DEPLOYMENT GUIDE. SAML 2.0 Single Sign-on (SSO) Deployment Guide with Ping Identity

DEPLOYMENT GUIDE. SAML 2.0 Single Sign-on (SSO) Deployment Guide with Ping Identity DEPLOYMENT GUIDE SAML 2.0 Single Sign-on (SSO) Deployment Guide with Ping Identity Table of Contents SAML Overview...3 Integration Topology...3 Deployment Requirements...4 Configuration Steps...4 Step

More information

Extending DigiD to the Private Sector (DigiD-2)

Extending DigiD to the Private Sector (DigiD-2) TECHNISCHE UNIVERSITEIT EINDHOVEN Department of Mathematics and Computer Science MASTER S THESIS Extending DigiD to the Private Sector (DigiD-2) By Giorgi Moniava Supervisors: Eric Verheul (RU, PwC) L.A.M.

More information

Get Success in Passing Your Certification Exam at first attempt!

Get Success in Passing Your Certification Exam at first attempt! Get Success in Passing Your Certification Exam at first attempt! Exam : C2150-575 Title : IBM Tivoli Federated Identity Manager V6.2.2 Implementation Version : Demo 1.What is the default file name of the

More information

National Identity Exchange Federation. Web Browser User-to-System Profile. Version 1.0

National Identity Exchange Federation. Web Browser User-to-System Profile. Version 1.0 National Identity Exchange Federation Web Browser User-to-System Profile Version 1.0 August 18, 2014 Table of Contents TABLE OF CONTENTS 1 1. TARGET AUDIENCE AND PURPOSE 2 2. TERMINOLOGY 2 3. REFERENCES

More information

FileCloud Security FAQ

FileCloud Security FAQ is currently used by many large organizations including banks, health care organizations, educational institutions and government agencies. Thousands of organizations rely on File- Cloud for their file

More information

Flexible Identity Federation

Flexible Identity Federation Flexible Identity Federation Quick start guide version 1.0.1 Publication history Date Description Revision 2015.09.23 initial release 1.0.0 2015.12.11 minor updates 1.0.1 Copyright Orange Business Services

More information

OpenSSO: Cross Domain Single Sign On

OpenSSO: Cross Domain Single Sign On OpenSSO: Cross Domain Single Sign On Version 0.1 History of versions Version Date Author(s) Changes 0.1 11/30/2006 Dennis Seah Contents Initial Draft. 1 Introduction 1 2 Single Domain Single Sign-On 2

More information

Revised edition. OIO Web SSO Profile V2.0.8 (also known as OIOSAML 2.0.8) Includes errata and minor clarifications

Revised edition. OIO Web SSO Profile V2.0.8 (also known as OIOSAML 2.0.8) Includes errata and minor clarifications OIO Web SSO Profile V2.0.8 (also known as OIOSAML 2.0.8) Revised edition Includes errata and minor clarifications Danish Agency for Digitisation December 2011 Contents > 1 Introduction 8 1.1 Referenced

More information

[MS-SAMLPR]: Security Assertion Markup Language (SAML) Proxy Request Signing Protocol

[MS-SAMLPR]: Security Assertion Markup Language (SAML) Proxy Request Signing Protocol [MS-SAMLPR]: Security Assertion Markup Language (SAML) Proxy Request Signing Protocol Intellectual Property Rights Notice for Open Specifications Documentation Technical Documentation. Microsoft publishes

More information

Identity Management im Liberty Alliance Project

Identity Management im Liberty Alliance Project Rheinisch-Westfälische Technische Hochschule Aachen Lehrstuhl für Informatik IV Prof. Dr. rer. nat. Otto Spaniol Identity Management im Liberty Alliance Project Seminar: Datenkommunikation und verteilte

More information

www.novell.com/documentation Policy Guide Access Manager 3.1 SP5 January 2013

www.novell.com/documentation Policy Guide Access Manager 3.1 SP5 January 2013 www.novell.com/documentation Policy Guide Access Manager 3.1 SP5 January 2013 Legal Notices Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation,

More information

Kantara egov and SAML2int comparison

Kantara egov and SAML2int comparison Kantara egov and SAML2int comparison 17.8.2010/mikael.linden@csc.fi This document compares the egovernment Implementation profile of SAML 2.0, created by the egovernment WG of Kantara Initiative, and the

More information

CA Performance Center

CA Performance Center CA Performance Center Single Sign-On User Guide 2.4 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the Documentation ) is

More information

Authentication and Single Sign On

Authentication and Single Sign On Contents 1. Introduction 2. Fronter Authentication 2.1 Passwords in Fronter 2.2 Secure Sockets Layer 2.3 Fronter remote authentication 3. External authentication through remote LDAP 3.1 Regular LDAP authentication

More information

SAML Authentication Quick Start Guide

SAML Authentication Quick Start Guide SAML Authentication Quick Start Guide Powerful Authentication Management for Service Providers and Enterprises Authentication Service Delivery Made EASY Copyright 2013 SafeNet, Inc. All rights reserved.

More information

Standards and Guidelines for. Information Technology. Infrastructure, Architecture, and Ongoing Operations

Standards and Guidelines for. Information Technology. Infrastructure, Architecture, and Ongoing Operations Standards and Guidelines for Information Technology Infrastructure, Architecture, and Ongoing Operations This document describes applicable standards and guidelines for the university's policy on Information

More information

MLSListings Single Sign On Implementation Guide. Compatible with MLSListings Applications

MLSListings Single Sign On Implementation Guide. Compatible with MLSListings Applications MLSListings Single Sign On Implementation Guide Compatible with MLSListings Applications February 2010 2010 MLSListings Inc. All rights reserved. MLSListings Inc. reserves the right to change details in

More information

Run-time Service Oriented Architecture (SOA) V 0.1

Run-time Service Oriented Architecture (SOA) V 0.1 Run-time Service Oriented Architecture (SOA) V 0.1 July 2005 Table of Contents 1.0 INTRODUCTION... 1 2.0 PRINCIPLES... 1 3.0 FERA REFERENCE ARCHITECTURE... 2 4.0 SOA RUN-TIME ARCHITECTURE...4 4.1 FEDERATES...

More information

Cyber Authentication Technology Solutions Interface Architecture and Specification Version 2.0: Deployment Profile

Cyber Authentication Technology Solutions Interface Architecture and Specification Version 2.0: Deployment Profile Cyber Authentication Technology Solutions Interface Architecture and Specification Version 2.0: Status: Baseline for RFP #3 Final r7.2 Date modified: 25 March, 2011 13:53 File name: CA - V2.0 Final r7.2_en.doc

More information

Setup Guide Access Manager 4.0 SP1

Setup Guide Access Manager 4.0 SP1 Setup Guide Access Manager 4.0 SP1 May 2014 www.netiq.com/documentation Legal Notice THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT ARE FURNISHED UNDER AND ARE SUBJECT TO THE TERMS OF A LICENSE

More information

Service Oriented Architecture

Service Oriented Architecture Service Oriented Architecture Charlie Abela Department of Artificial Intelligence charlie.abela@um.edu.mt Last Lecture Web Ontology Language Problems? CSA 3210 Service Oriented Architecture 2 Lecture Outline

More information

The Primer: Nuts and Bolts of Federated Identity Management

The Primer: Nuts and Bolts of Federated Identity Management The Primer: Nuts and Bolts of Federated Identity Management Executive Overview For any IT department, it is imperative to understand how your organization can securely manage and control users identities.

More information

TECHNOLOGY BRIEF: INTEGRATED IDENTITY AND ACCESS MANAGEMENT (IAM) An Integrated Architecture for Identity and Access Management

TECHNOLOGY BRIEF: INTEGRATED IDENTITY AND ACCESS MANAGEMENT (IAM) An Integrated Architecture for Identity and Access Management TECHNOLOGY BRIEF: INTEGRATED IDENTITY AND ACCESS MANAGEMENT (IAM) An Integrated Architecture for Identity and Access Management Table of Contents Executive Summary 1 SECTION 1: CHALLENGE 2 The Need for

More information

Single Sign On (SSO) Implementation Manual. For Connect 5 & MyConnect Sites

Single Sign On (SSO) Implementation Manual. For Connect 5 & MyConnect Sites Single Sign On (SSO) Implementation Manual For Connect 5 & MyConnect Sites Version 6 Release 5.7 September 2013 1 What is Blackboard Connect Single Sign On?... 3 How it Works... 3 Drawbacks to Using Single

More information

Alfresco Share SAML. 2. Assert user is an IDP user (solution for the Security concern mentioned in v1.0)

Alfresco Share SAML. 2. Assert user is an IDP user (solution for the Security concern mentioned in v1.0) Alfresco Share SAML Version 1.1 Revisions 1.1 1.1.1 IDP & Alfresco user logs in using saml login page (Added info about saving the username and IDP login date as a solution for the Security concern mentioned

More information

An Oracle White Paper Dec 2013. Oracle Access Management Security Token Service

An Oracle White Paper Dec 2013. Oracle Access Management Security Token Service An Oracle White Paper Dec 2013 Oracle Access Management Security Token Service Disclaimer The following is intended to outline our general product direction. It is intended for information purposes only,

More information

Security Assertion Markup Language (SAML) 2.0 Technical Overview

Security Assertion Markup Language (SAML) 2.0 Technical Overview 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Security Assertion Markup Language (SAML) 2.0 Technical Overview Working Draft 03, 20 February 2005 Document identifier:

More information

Greg Giles, Cisco Systems. Is compression a valid candidate for a standard?

Greg Giles, Cisco Systems. Is compression a valid candidate for a standard? 1 WebServices Framework & Assertion exchange using SAML 2 3 4 5 Submitted By : Abstract: Krishna Sankar, Cisco Systems Greg Giles, Cisco Systems 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

More information

WebNow Single Sign-On Solutions

WebNow Single Sign-On Solutions WebNow Single Sign-On Solutions Technical Guide ImageNow Version: 6.7. x Written by: Product Documentation, R&D Date: June 2015 2012 Perceptive Software. All rights reserved CaptureNow, ImageNow, Interact,

More information

SAML Security Analysis. Huang Zheng Xiong Jiaxi Ren Sijun

SAML Security Analysis. Huang Zheng Xiong Jiaxi Ren Sijun SAML Security Analysis Huang Zheng Xiong Jiaxi Ren Sijun outline The intorduction of SAML SAML use case The manner of SAML working Security risks on SAML Security policy on SAML Summary my course report

More information

Software Design Document SAMLv2 IDP Proxying

Software Design Document SAMLv2 IDP Proxying Software Design Document SAMLv2 IDP Proxying Federation Manager 7.5 Version 0.2 Please send comments to: dev@opensso.dev.java.net This document is subject to the following license: COMMON DEVELOPMENT AND

More information

Introduction to Directory Services

Introduction to Directory Services Introduction to Directory Services Overview This document explains how AirWatch integrates with your organization's existing directory service such as Active Directory, Lotus Domino and Novell e-directory

More information

CHAPTER - 3 WEB APPLICATION AND SECURITY

CHAPTER - 3 WEB APPLICATION AND SECURITY CHAPTER - 3 WEB APPLICATION AND SECURITY 3.1 Introduction Web application or Wepapp is the general term that is normally used to refer to all distributed web-based applications. According to the more technical

More information

Disclaimer. SAP 2008 / SAP TechEd 08 / SIM202 / Page 2

Disclaimer. SAP 2008 / SAP TechEd 08 / SIM202 / Page 2 SIM202 SAML 2.0 and Identity Federation Yonko Yonchev, NW PM Security SAP AG Dimitar Mihaylov, NW Security and Identity Management SAP Labs Bulgaria Tsvetomir Tsvetanov, Active Global Support SAP America

More information

Contents at a Glance. 1 Introduction 17. 2 Basic Principles of IT Security 23. 3 Authentication and Authorization in

Contents at a Glance. 1 Introduction 17. 2 Basic Principles of IT Security 23. 3 Authentication and Authorization in at a Glance 1 Introduction 17 2 Basic Principles of IT Security 23 3 Authentication and Authorization in SAP NetWeaver Application Server Java 53 4 Single Sign-On 151 5 Identity Provisioning 289 6 Secure

More information

IT@Intel. Improving Security and Productivity through Federation and Single Sign-on

IT@Intel. Improving Security and Productivity through Federation and Single Sign-on White Paper Intel Information Technology Computer Manufacturing Security Improving Security and Productivity through Federation and Single Sign-on Intel IT has developed a strategy and process for providing

More information

Reducing SOA Identity Fatigue through Automated Identity Testing

Reducing SOA Identity Fatigue through Automated Identity Testing TM Reducing SOA Identity Fatigue through Automated Identity Testing By Crosscheck Networks I. Introduction Identity Management plays a pivotal role in securing Web Services-based

More information

XML Signatures in an Enterprise Service Bus Environment

XML Signatures in an Enterprise Service Bus Environment XML Signatures in an Enterprise Bus Environment Eckehard Hermann Research & Development XML Integration Uhlandstraße 12 64297 Darmstadt, Germany Eckehard.Hermann@softwareag.com Dieter Kessler Research

More information

Identity Federation Management to make Operational and Business Efficiency through SSO

Identity Federation Management to make Operational and Business Efficiency through SSO 2012 International Conference on Industrial and Intelligent Information (ICIII 2012) IPCSIT vol.31 (2012) (2012) IACSIT Press, Singapore Identity Federation Management to make Operational and Business

More information

INTEGRATION GUIDE. DIGIPASS Authentication for Google Apps using IDENTIKEY Federation Server

INTEGRATION GUIDE. DIGIPASS Authentication for Google Apps using IDENTIKEY Federation Server INTEGRATION GUIDE DIGIPASS Authentication for Google Apps using IDENTIKEY Federation Server Disclaimer Disclaimer of Warranties and Limitation of Liabilities All information contained in this document

More information

Authentication Methods

Authentication Methods Authentication Methods Overview In addition to the OU Campus-managed authentication system, OU Campus supports LDAP, CAS, and Shibboleth authentication methods. LDAP users can be configured through the

More information

Federal Identity, Credential, and Access Management Security Assertion Markup Language (SAML) 2.0 Web Browser Single Sign-on (SSO) Profile

Federal Identity, Credential, and Access Management Security Assertion Markup Language (SAML) 2.0 Web Browser Single Sign-on (SSO) Profile Federal Identity, Credential, and Access Management Security Assertion Markup Language (SAML) 2.0 Web Browser Single Sign-on (SSO) Profile Version 1.0 September 27, 2010 Document History This is the first

More information

Digital Signature Web Service Interface

Digital Signature Web Service Interface 1 2 Digital Signature Web Service Interface 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 1 Introduction This document describes an RPC interface for a centralized

More information

White Paper Delivering Web Services Security: The Entrust Secure Transaction Platform

White Paper Delivering Web Services Security: The Entrust Secure Transaction Platform White Paper Delivering Web Services Security: September 2003 Copyright 2003 Entrust. All rights reserved. Entrust is a registered trademark of Entrust, Inc. in the United States and certain other countries.

More information

Enabling Federation and Web-Single Sign-On in Heterogeneous Landscapes with the Identity Provider and Security Token Service Supplied by SAP NetWeaver

Enabling Federation and Web-Single Sign-On in Heterogeneous Landscapes with the Identity Provider and Security Token Service Supplied by SAP NetWeaver Enabling Federation and Web-Single Sign-On in Heterogeneous Landscapes with the Identity Provider and Security Token Service Supplied by SAP NetWeaver SAP Product Management, SAP NetWeaver Identity Management

More information