SAML Profile for SSO in Danish Public Sector V2.0 Assertion Examples,
|
|
|
- Aubrey Carroll
- 8 years ago
- Views:
Transcription
1 > SAML Profile for SSO in Danish Public Sector V2.0 Assertion Examples, Version 1.1 IT- og Telestyrelsen, Center for Serviceorienteret Infrastruktur August 2007
2 1 Introduction This non-normative document contains a number of examples of XML messages defined in the DK-SAML 2.0 profile. Note that all examples are produced by hand and are thus not generated by a computer program. Therefore, differences may occur in real life deployments. Note further that the examples have been simplified in order to improve readability and clarity. For example, encryption of elements is not shown and long binary values or repeated elements have been shortened etc. Therefore, the examples won t validate directly against the SAML XML schemas published by OASIS.
3 2 SAML Assertion with OCES Attribute Profile The first example shows an assertion conforming to the OCES Attribute Profile with citizen attributes (without encryption): <saml:assertion ID="idvalue " IssueInstant=" T12:00:00" Version="2.0" xmlns:saml="urn:oasis:names:tc:saml:2.0:assertion" xmlns:xsi=" xmlns:ds=" <saml:issuer> <ds:signature> <ds:signedinfo> <ds:canonicalizationmethod Algorithm=" <ds:signaturemethod Algorithm=" <ds:reference URI="#idvalue "> <ds:transforms> <ds:transform Algorithm=" </ds:transforms> <ds:digestmethod Algorithm=" <ds:digestvalue>tcdvsug6grhyhbzhqfwfzgrxipe=</ds:digestvalue> </ds:reference> </ds:signedinfo> <ds:signaturevalue> x/gypbzmfee85pgd3c1axg4vspb9v9jgcjwcrckrtwps6vdvnccy5rhafpywkf+5 EIYcPzx+pX1h43SmwviCqXRjRtMANWbHLhWAptaK1ywS7gFgsD01qjyen3CP+m3D w6vkhaqledl0byyrizb4kkho4ahnybvxbjwqv5puae4= </ds:signaturevalue> <ds:keyinfo> <ds:x509data> <!-- The Identity Provider's OCES Certificate -->
4 <ds:x509certificate> MIICyjCCAjOgAwIBAgICAnUwDQYJKoZIhvcNAQEEBQAwgakxCzAJBgNVBAYTAlVT MRIwEAYDVQQIEwlXaXNjb25zaW4xEDAOBgNVBAcTB01hZGlzb24xIDAeBgNVBAoT F1VuaXZlcnNpdHkgb2YgV2lzY29uc2luMSswKQYDVQQLEyJEaXZpc2l... </ds:x509certificate> </ds:x509data> </ds:keyinfo> </ds:signature> <saml:subject> <saml:nameid Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName"> C=DK,O=Pølsevognen,CN=Hans Jensen </saml:nameid> <saml:subjectconfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:subjectconfirmationdata Recipient=" NotOnOrAfter=" T12:00:00" InResponseTo="Authn_request_identifier_ "> </saml:subjectconfirmationdata> </saml:subjectconfirmation> </saml:subject> <saml:conditions> <saml:audiencerestriction> <saml:audience> </saml:audiencerestriction> </saml:conditions> <saml:authnstatement AuthnInstant=" T12:00:00Z" SessionIndex=" "> <saml:authncontext> <saml:authncontextclassref>
5 urn:oasis:names:tc:saml:2.0:ac:classes:x509 </saml:authncontextclassref> </saml:authncontext> </saml:authnstatement> Statement> <!-- Sur Name Core Attribute --> Name="urn:oid: " FriendlyName="surName"> Value xsi:type="xs:string"> Jensen <!-- Common Name Core Attribute --> Name="urn:oid: " FriendlyName="CommonName"> Value xsi:type="xs:string"> Hans Jensen <!-- Uid Core Attribute this is the Subject Serial Number --> Name="urn:oid: "> Value xsi:type="xs:string">
6 PID: <!-- Core Attribute --> Name="urn:oid: " FriendlyName=" "> Value xsi:type="xs:string"> <!-- Assurance Level Core Attribute --> Name="dk:gov:saml:attribute:AssuranceLevel"> Value xsi:type="xs:string">2 <!-- SpecVer Core Attribute --> Name="dk:gov:saml:attribute:SpecVer"> Value xsi:type="xs:string">dk-saml-2.0
7 <!-- Now comes attributes from the OCES attribute profile --> <!--- Certificate Serial Number Attribute --> Name="urn:oid: " FriendlyName="serialNumber"> Value xsi:type="xs:string"> <!--- PID Number Attribute --> Name="dk:gov:saml:attribute:PidNumberIdentifier"> Value xsi:type="xs:string"> <!--- CPR Number Attribute --> Name="dk:gov:saml:attribute:CprNumberIdentifier"> Value xsi:type="xs:string"> </saml:attributestatement> </saml:assertion>
8 3 Assertion with Persistent Pseudonym The second example shows an assertion with a persistent pseudonym (without encryption): <saml:assertion ID="idvalue " IssueInstant=" T12:00:00" Version="2.0" xmlns:saml="urn:oasis:names:tc:saml:2.0:assertion" xmlns:xsi=" xmlns:ds=" <saml:issuer> <saml:subject> <!-- Here we have the persistent, opaque identifier --> <saml:nameid Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"> 005a06e0-ad82-110d-a b13a2b </saml:nameid> <saml:subjectconfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:subjectconfirmationdata Recipient=" NotOnOrAfter=" T12:00:00" InResponseTo="Authn_request_identifier_ "> </saml:subjectconfirmationdata> </saml:subjectconfirmation> </saml:subject> <saml:conditions> <saml:audiencerestriction> <saml:audience> </saml:audiencerestriction> </saml:conditions>
9 <saml:authnstatement AuthnInstant=" T12:00:00Z" SessionIndex=" "> <saml:authncontext> <saml:authncontextclassref> urn:oasis:names:tc:saml:2.0:ac:classes:x509 </saml:authncontextclassref> </saml:authncontext> </saml:authnstatement> Statement> <!-- Assurance Level Core Attribute --> Name="dk:gov:saml:attribute:AssuranceLevel"> Value xsi:type="xs:string">4 <!-- SpecVer Core Attribute --> Name="dk:gov:saml:attribute:SpecVer"> Value xsi:type="xs:string">dk-saml-2.0 </saml:attributestatement> </saml:assertion>
10 4 Authentication Request Below is shown a signed authentication request sent from a Service Provider: <samlp:authnrequest xmlns:samlp="urn:oasis:names:tc:saml:2.0:protocol" xmlns:saml="urn:oasis:names:tc:saml:2.0:assertion" xmlns:ds=" ID="Authn_request_identifier_ " Version="2.0" IssueInstant=" T09:21:59Z" AssertionConsumerServiceIndex="1"> <saml:issuer> <ds:signature> <ds:signedinfo> <ds:canonicalizationmethod Algorithm=" <ds:signaturemethod Algorithm=" <ds:reference URI="#Authn_request_identifier_ "> <ds:transforms> <ds:transform Algorithm=" </ds:transforms> <ds:digestmethod Algorithm=" <ds:digestvalue>tcdvsug6grhyhbzhqfwfzgrxipe=</ds:digestvalue> </ds:reference> </ds:signedinfo> <ds:signaturevalue> x/gypbzmfee85pgd3c1axg4vspb9v9jgcjwcrckrtwps6vdvnccy5rhafpywkf+5 EIYcPzx+pX1h43SmwviCqXRjRtMANWbHLhWAptaK1ywS7gFgsD01qjyen3CP+m3D w6vkhaqledl0byyrizb4kkho4ahnybvxbjwqv5puae4= </ds:signaturevalue> <ds:keyinfo>
11 <ds:x509data> <ds:x509certificate> MIICyjCCAjOgAwIBAgICAnUwDQYJKoZIhvcNAQEEBQAwgakxCzAJBgNVBAYTAlVT MRIwEAYDVQQIEwlXaXNjb25zaW4xEDAOBgNVBAcTB01hZGlzb24xIDAeBgNVBAoT F1VuaXZlcnNpdHkgb2YgV2lzY29uc2luMSswKQYDVQQLEyJEaXZpc2l... </ds:x509certificate> </ds:x509data> </ds:keyinfo> </ds:signature> </samlp:authnrequest>
12 5 Authentication Response Below is shown a signed response to an authentication response. Note that the actual assertion is left out for brevity (examples of assertions can be found earlier in this document): <samlp:response xmlns:samlp="urn:oasis:names:tc:saml:2.0:protocol" xmlns:saml="urn:oasis:names:tc:saml:2.0:assertion" xmlns:ds=" ID="identifier_2" InResponseTo="Authn_request_identifier_ " Version="2.0" IssueInstant=" T09:22:05Z" Destination=" <saml:issuer> <ds:signature> <ds:signedinfo> <ds:canonicalizationmethod Algorithm=" <ds:signaturemethod Algorithm=" <ds:reference URI="#identifier_2"> <ds:transforms> <ds:transform Algorithm=" </ds:transforms> <ds:digestmethod Algorithm=" <ds:digestvalue>tcdvsug6grhyhbzhqfwfzgrxipe=</ds:digestvalue> </ds:reference> </ds:signedinfo> <ds:signaturevalue> x/gypbzmfee85pgd3c1axg4vspb9v9jgcjwcrckrtwps6vdvnccy5rhafpywkf+5 EIYcPzx+pX1h43SmwviCqXRjRtMANWbHLhWAptaK1ywS7gFgsD01qjyen3CP+m3D w6vkhaqledl0byyrizb4kkho4ahnybvxbjwqv5puae4=
13 </ds:signaturevalue> <ds:keyinfo> <ds:x509data> <ds:x509certificate> MIICyjCCAjOgAwIBAgICAnUwDQYJKoZIhvcNAQEEBQAwgakxCzAJBgNVBAYTAlVT MRIwEAYDVQQIEwlXaXNjb25zaW4xEDAOBgNVBAcTB01hZGlzb24xIDAeBgNVBAoT F1VuaXZlcnNpdHkgb2YgV2lzY29uc2luMSswKQYDVQQLEyJEaXZpc2l... </ds:x509certificate> </ds:x509data> </ds:keyinfo> </ds:signature> <samlp:status> <samlp:statuscode </samlp:status> Value="urn:oasis:names:tc:SAML:2.0:status:Success"/> <saml:assertion> <!-- Left out for brevity --> </saml:assertion> </Response>
14 6 Attribute Query Examples This chapter contains a number of example request / response messages illustrating different scenarios with attribute queries. The examples only show SAML messages conforming to the profile and do not detail the encapsulation in SOAP envelopes. Please note that: Details of XML digital signatures and encryptions have been omitted from the examples for the sake of clarity. Some attribute names have been invented for the examples. These should not be regarded as official identifiers. Further standardization of attributes names should occur within the Danish egovernment sector. 6.1 Requesting one attribute The first example shows a request of a Production Site Number attribute (P-number). The request identifies the Subject via the DN from the OCES certificate and the uid core attribute which contains the subject serial number. Request message: <samlp:attributequery ID="idvalue " IssueInstant=" T12:00:00" Version="2.0" Consent="urn:oasis:names:tc:SAML:2.0:consent:current-explicit" xmlns:saml="urn:oasis:names:tc:saml:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:saml:2.0:protocol" xmlns:xsi=" xmlns:ds=" <saml:issuer> <ds:signature>... </ds:signature> <! - Here is the subject in this case the DN from the OCES certificate -->
15 <saml:subject> <saml:nameid Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName"> C=DK,O=Pølsevognen,CN=Hans Jensen </saml:nameid> </saml:subject> <! - Here is the Uid Core Attribute which contains the OCES Subject Serial Number --> Name="urn:oid: "> Value xsi:type="xs:string"> CVR: RID: <! - Here is the attribute we request (no value) --> Name="dk:gov:saml:attribute:ProductionSiteNumberIdentifier"> </samlp:attributequery> Response message from the Attribute Service: <samlp:response ID="idvalue " IssueInstant=" T12:10:00" Version="2.0" Consent="urn:oasis:names:tc:SAML:2.0:consent:current-implicit" xmlns:saml="urn:oasis:names:tc:saml:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:saml:2.0:protocol" xmlns:xsi="
16 xmlns:ds=" <saml:issuer> <ds:signature>... </ds:signature> <samlp:status> <samlp:statuscode Value="samlp:Success"/> <samlp:statusmessage>success</samlp:statusmessage> </samlp:status> <! - Here is the subject in this case the DN from the OCES certificate --> <saml:subject> <saml:nameid Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName"> C=DK,O=Pølsevognen,CN=Hans Jensen </saml:nameid> </saml:subject> <saml:assertion ID="idvalue " IssueInstant=" T12:12:00" Version="2.0"> <saml:issuer> <! - Here is the subject in this case the DN from the OCES certificate --> <saml:subject> <saml:nameid Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName"> C=DK,O=Pølsevognen,CN=Hans Jensen </saml:nameid> </saml:subject>
17 <saml:conditions> <saml:audiencerestriction> <saml:audience> </saml:audiencerestriction> </saml:conditions> Statement> <! - Here is the Uid Core Attribute which contains the Subject serialnumber --> Name="urn:oid: "> Value xsi:type="xs:string"> CVR: RID: <! - The returned attribute with the P-Number Identifier --> Name="dk:gov:saml:attribute:ProductionSiteNumberIdentifier"> Value xsi:type="xs:string"> </saml:attributestatement> </saml:assertion> </samlp:response>
18 6.2 Requesting a set of attributes Multiple attributes can be requested by simply including multiple > elements in the request (one for each requested attribute): <samlp:attributequery ID="idvalue " IssueInstant=" T12:00:00" Version="2.0" Consent="urn:oasis:names:tc:SAML:2.0:consent:current-explicit" xmlns:saml="urn:oasis:names:tc:saml:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:saml:2.0:protocol" xmlns:xsi=" xmlns:ds=" <saml:issuer> <ds:signature>... </ds:signature> <! - Here is the subject in this case the DN from the OCES certificate --> <saml:subject> <saml:nameid Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName"> C=DK,O=Pølsevognen,CN=Hans Jensen </saml:nameid> </saml:subject> <! - Here is the Uid Core Attribute which contains the Subject serialnumber --> Name="urn:oid: "> Value xsi:type="xs:string">
19 CVR: RID: <! - Here is an attribute we request (no value) --> Name="dk:gov:saml:attribute:ProductionSiteNumberIdentifier"> <! - Here is an attribute we request (no value) --> Name="dk:gov:saml:attribute:IsManager"> <! - Here is an attribute we request (no value) --> Name="dk:gov:saml:attribute:IsAdministrator"> </samlp:attributequery> 6.3 Requesting all attributes All attributes can be requested by omitting > elements from the query. However, an attribute specifying the uid core attribute for identification of the subject can still be included.
20 6.4 Requester doesn t have access to all attributes When a requester queries for an attribute he is not authorized to receive, the Attribute Service returns a second-level status code being: urn:oasis:names:tc:saml:2.0:status:requestdenied followed by a sequence <StatusDetail> elements describing the reason for not disclosing the attribute:... <samlp:status> <samlp:statuscode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"> <samlp:statuscode Value="urn:oasis:names:tc:SAML:2.0:status:RequestDenied"> </samlp:statuscode> <samlp:statusdetail>requested attribute CPR is reserved for government organizations </samlp:statusdetail> <samlp:statuscode/> </samlp:status> Values do not exist for all requested attributes Suppose attributes with names attr_a and attr_b have been requested. Both are recognized by the Attribute Service but the value of attr_a is unknown for this subject. In this situation an empty <AttributeValue> element is returned and the reserved xsi:nil attribute is set:... Statement> Name="attr_A"> Value xsi:nil= true >
21 Name="attr_B"> Value xsi:type="xs:string">foobar </saml:attributestatement>... <end of examples>
OIOIDWS for Healthcare Token Profile for Authentication Tokens
OIOIDWS for Healthcare Token Profile for Authentication Tokens Common Web Service Profile for Healthcare in the Danish Public Sector, version 2.0 Content Document History...3 Introduction...4 Notation...
Configuring SAML2 for Single Sign-On to Smartsheet (Enterprise Only)
Configuring SAML2 for Single Sign-On to Smartsheet (Enterprise Only) This document is intended for technical professionals who are familiar with SAML and have access to the Identity Provider that will
Configuring SAML2 for Single Sign-On to Smartsheet (Enterprise Only)
Configuring SAML2 for Single Sign-On to Smartsheet (Enterprise Only) This document is intended for technical professionals who are familiar with SAML and have access to the Identity Provider that will
VETUMA SAML SAMPLE MESSAGES
Page 1 Version: 3.5 4.11.2015 VETUMA SAML SAMPLE MESSAGES 1 (7) Page 2 Version: 3.5 4.11.2015 Table of Contents 1. Introduction... 3 2. Authentication... 4 2.1 Single sign-on... 4 2.1.1 Request message...
Shibboleth Architecture
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 Shibboleth Architecture Technical Overview Working Draft 02, 8 June 2005 Document identifier: draft-mace-shibboleth-tech-overview-02 Location: http://shibboleth.internet2.edu/shibboleth-documents.html
GFIPM Web Browser User-to-System Profile Version 1.2
About the Document Justice organizations are looking for ways to provide secured access to multiple agency information systems with a single logon. The Global Federated Identity and Privilege Management
MLSListings Single Sign On Implementation Guide. Compatible with MLSListings Applications
MLSListings Single Sign On Implementation Guide Compatible with MLSListings Applications February 2010 2010 MLSListings Inc. All rights reserved. MLSListings Inc. reserves the right to change details in
Single Sign-On Implementation Guide
Single Sign-On Implementation Guide Salesforce, Winter 16 @salesforcedocs Last updated: November 4, 2015 Copyright 2000 2015 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark
Single Sign-On Implementation Guide
Single Sign-On Implementation Guide Salesforce, Summer 15 @salesforcedocs Last updated: July 1, 2015 Copyright 2000 2015 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of
National Identity Exchange Federation. Web Browser User-to-System Profile. Version 1.0
National Identity Exchange Federation Web Browser User-to-System Profile Version 1.0 August 18, 2014 Table of Contents TABLE OF CONTENTS 1 1. TARGET AUDIENCE AND PURPOSE 2 2. TERMINOLOGY 2 3. REFERENCES
Standalone SAML Attribute Authority With Shibboleth
CESNET Technical Report 5/2013 Standalone SAML Attribute Authority With Shibboleth IVAN NOVAKOV Received 10. 12. 2013 Abstract The article defines what a standalone attribute authority is and how it can
Web Services Security: SAML Token Profile 1.1
1 2 3 4 5 6 7 8 9 10 11 12 13 Web Services Security: SAML Token Profile 1.1 OASIS Standard, 1 February 2006 Document Identifier: wss-v1.1-spec-os-samltokenprofile OASIS Identifier: {WSS: SOAP Message Security
IAM Application Integration Guide
IAM Application Integration Guide Date 03/02/2015 Version 0.1 DOCUMENT INFORMATIE Document Title IAM Application Integration Guide File Name IAM_Application_Integration_Guide_v0.1_SBO.docx Subject Document
Design and Implementaion of a Single Sign-On Library Supporting SAML (Security Assertion Markup Language) for Grid and Web Services Security
Design and Implementaion of a Single Sign-On Library Supporting SAML (Security Assertion Markup Language) for Grid and Web Services Security Dongkyoo Shin, Jongil Jeong, and Dongil Shin Department of Computer
Web Access Management and Single Sign-On
Web Access Management and Single Sign-On Ronnie Dale Huggins In the old days of computing, a user would sit down at his or her workstation, login to the desktop, login to their email system, perhaps pull
Security Assertion Markup Language (SAML)
CS 595G 02/14/06 Security Assertion Markup Language (SAML) Vika Felmetsger 1 SAML as OASIS Standard OASIS Open Standard SAML V2.0 was approved in March, 2005 Blending of two earlier efforts on portable
Feide Technical Guide. Technical details for integrating a service into Feide
Feide Technical Guide Technical details for integrating a service into Feide May 2015 Document History Version Date Initials Comments 1.0 Nov 2009 TG First issue 1.2 Nov 2009 TG Added SLO description 1.3
Security Assertion Markup Language (SAML) V2.0 Technical Overview
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 Security Assertion Markup Language (SAML) V2.0 Technical Overview Working Draft 10, 9 October 2006 Document
Biometric Single Sign-on using SAML Architecture & Design Strategies
Biometric Single Sign-on using SAML Architecture & Design Strategies Ramesh Nagappan Java Technology Architect Sun Microsystems Ramesh.Nagappan@sun.com 1 Setting Expectations What you can take away! Understand
Single Sign-On Implementation Guide
Version 27.0: Spring 13 Single Sign-On Implementation Guide Last updated: February 1, 2013 Copyright 2000 2013 salesforce.com, inc. All rights reserved. Salesforce.com is a registered trademark of salesforce.com,
Tusker IT Department Tusker IT Architecture
Tusker IT Department System Overview Documents Tusker IT Department Tusker IT Architecture Single Sign On Overview Page 1 Document Information and Approvals VERSION HISTORY Version # Date Revised By Reason
Security Assertion Markup Language (SAML) 2.0 Technical Overview
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Security Assertion Markup Language (SAML) 2.0 Technical Overview Working Draft 03, 20 February 2005 Document identifier:
Web Single Sign-On Authentication using SAML
IJCSI International Journal of Computer Science Issues, Vol. 2, 2009 ISSN (Online): 1694-0784 ISSN (Print): 1694-0814 41 Web Single Sign-On Authentication using SAML Kelly D. LEWIS, James E. LEWIS, Ph.D.
SAML 2.0 INT SSO Deployment Profile
1 2 3 4 5 6 SAML 2.0 INT 7 8 9 Version: 0.1 Date: 2011-12-2 10 Editor: TBD 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 Contributors: The full list of contributors can be referenced here: URL Status: This
Federation architectures for mobile applications OAuth 2.0 Drivers OAuth 2.0 Overview Mobile walkthrough
Agenda Federation architectures for mobile applications OAuth 2.0 Drivers OAuth 2.0 Overview Mobile walkthrough Enter OAuth 2.0 Defines authorization & authentication framework for RESTful APIs An open
Kantara egov and SAML2int comparison
Kantara egov and SAML2int comparison 17.8.2010/mikael.linden@csc.fi This document compares the egovernment Implementation profile of SAML 2.0, created by the egovernment WG of Kantara Initiative, and the
Single Sign on Using SAML
Single Sign on Using SAML Priyank Rajvanshi, Subhash Chand Gupta Abstract- With the proliferation of SaaS and other web-based applications, identity management is becoming a major concern for businesses.
Revised edition. OIO Web SSO Profile V2.0.8 (also known as OIOSAML 2.0.8) Includes errata and minor clarifications
OIO Web SSO Profile V2.0.8 (also known as OIOSAML 2.0.8) Revised edition Includes errata and minor clarifications Danish Agency for Digitisation December 2011 Contents > 1 Introduction 8 1.1 Referenced
DocuSign Information Guide. Single Sign On Functionality. Overview. Table of Contents
DocuSign Information Guide Single Sign On Functionality Overview The DocuSign Single Sign On functionality allows your system administrators to maintain user information in one location and your users
Revised edition. OIO Web SSO Profile V2.0.9 (also known as OIOSAML 2.0.9) Includes errata and minor clarifications
OIO Web SSO Profile V2.0.9 (also known as OIOSAML 2.0.9) Revised edition Includes errata and minor clarifications Danish Agency for Digitisation September 2012 Contents > 1 Introduction 8 1.1 Referenced
Technik und Informatik. SOAP Security. Prof. Dr. Eric Dubuis Berner Fachhochschule Biel. Version April 11, 2012
SOAP Security Prof. Dr. Eric Dubuis Berner Fachhochschule Biel Version April 11, 2012 Overview Motivation Transport security versus SOAP Security WS-Security stack overview Structure of secured SOAP messages
Secure Services withapache CXF
Karlsruher Entwicklertag 2014 Secure Services withapache CXF Andrei Shakirin, Talend ashakirin@talend.com ashakirin.blogspot.com/ Agenda Introduction in Apache CXF Security Requirements Apply security
Electronic Bank Account Management - EBAM
Electronic Bank Account Management - EBAM EBAM and Digital Signature This guide provides an overview of how to use a digital signature in the EBAM solution to sign the XML messages and the potential attachments.
Federal Identity, Credential, and Access Management Security Assertion Markup Language (SAML) 2.0 Web Browser Single Sign-on (SSO) Profile
Federal Identity, Credential, and Access Management Security Assertion Markup Language (SAML) 2.0 Web Browser Single Sign-on (SSO) Profile Version 1.0 September 27, 2010 Document History This is the first
Federal Identity, Credentialing, and Access Management Security Assertion Markup Language (SAML) 2.0 Web Browser Single Sign-on (SSO) Profile
Federal Identity, Credentialing, and Access Management Security Assertion Markup Language (SAML) 2.0 Web Browser Single Sign-on (SSO) Profile Version 1.0.2 December 16, 2011 Document History Status Release
SAML Profile for Privacy-enhanced Federated Identity Management
SAML Profile for Privacy-enhanced Federated Identity Management Rainer Hörbe, Identinetics GmbH Abstract This profile for the SAML WebSSO use case specifies an enhancement that allows users to limit their
02267: Software Development of Web Services
02267: Software Development of Web Services Week 11 Hubert Baumeister huba@dtu.dk Department of Applied Mathematics and Computer Science Technical University of Denmark Fall 2015 1 Contents WS-Policy Web
SAML Security Analysis. Huang Zheng Xiong Jiaxi Ren Sijun
SAML Security Analysis Huang Zheng Xiong Jiaxi Ren Sijun outline The intorduction of SAML SAML use case The manner of SAML working Security risks on SAML Security policy on SAML Summary my course report
Digital Evidence Certification Recommendation
UNITED NATIONS E Economic and Social Council Distr. GENERAL ECE/TRADE/TBG/CEFACT/2010/xx 19 February 2010 Original: ENGLISH ECONOMIC COMMISSION FOR EUROPE COMMITTEE ON TRADE Centre for Trade Facilitation
SAML 2.0 protocol deployment profile
SAML 2.0 protocol deployment profile FOR THE FINNISH PUBLIC SECTOR Version Date Changes 1.0 8.12.2010 Implementation by Ubisecure Solutions, Fujitsu Services and CSC IT Center for Science. Approved by
GCSS-AF SOA and Web Services Infrastructure & Support
GCSS-AF SOA and Web Services Infrastructure & Support May 2009 Mike Acton Lockheed Martin 0 Agenda Building the GCSS-AF SOA Infrastructure The SOA Journey GCSS-AF SOA Infrastructure Data Power SOA Appliance
Open Source Identity Integration with OpenSSO
Open Source Identity Integration with OpenSSO April 19, 2008 Pat Patterson Federation Architect pat.patterson@sun.com blogs.sun.com/superpat Agenda Web Access Management > The Problem > The Solution >
23.11.2012 Martin Käser. Single Sign-on mit OpenSAML
23.11.2012 Martin Käser Single Sign-on mit OpenSAML SAML Überblick l SAML = Security Assertion Markup Language v1.1 OASIS Standard 2003 v2.0 OASIS Standard 2005 l Rollen: User agent (Principal) Identity
IBM WebSphere Application Server
IBM WebSphere Application Server SAML 2.0 web single-sign-on 2012 IBM Corporation This presentation describes support for SAML 2.0 web browser Single Sign On profile included in IBM WebSphere Application
How To Make A Multi-Party Communication Secure On A Microsoft Cloud (Minware) System (Plm) (For Free) (Power) (Web) (Netware) (Cloud) (Monetar) (Free) (
Nicolai M. Josuttis IT-communication.com Stand: 12/09 2009 by IT-communication.com 1 Independent consultant continuously learning since 1962 Nicolai M. Josuttis Systems Architect, Technical Manager finance,
Practical Security Evaluation of SAML-based Single Sign-On Solutions
Practical Security Evaluation of SAML-based Single Sign-On Solutions Vladislav Mladenov, Andreas Mayer, Marcus Niemietz, Christian Mainka, Florian Feldmann, Julian Krautwald, Jörg Schwenk 1 Single Sign-On
SAML basics A technical introduction to the Security Assertion Markup Language
SAML basics A technical introduction to the Security Assertion Markup Language WWW2002 Eve Maler, XML Standards Architect XML Technology Center Sun Microsystems, Inc. Agenda The problem space SAML concepts
Brief History of Software
Web Services Security Presentation by Gunnar Peterson www.arctecgroup.net Brief History of Software 1 Mission Accomplished! Software Security 1995 CGI/PERL Network firewall & SSL 2 Mission Accomplished!
OIO Web SSO Profile V2.0.5
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
FEDERATED IDENTITY MANAGEMENT:
FEDERATED IDENTITY MANAGEMENT: An Overview of Concepts and Standards Eve Maler Sun Microsystems, Inc. Last updated 5 January 2006 maler-fed-id 1/5/06 Page 1 Originally presented at XML 2005 in Atlanta,
Разработка программного обеспечения промежуточного слоя. TERENA BASNET Workshop, 16-17 November 2009 Joost van Dijk - SURFnet
Разработка программного обеспечения промежуточного слоя TERENA BASNET Workshop, 16-17 November 2009 Joost van Dijk - SURFnet Contents - SURFnet Middleware Services department: - eduroam, SURFfederatie,
SAML and XACML Overview. Prepared by Abbie Barbir, abbieb@nortel.com Nortel Canada April 25, 2006
SAML and XACML Overview Prepared by Abbie Barbir, abbieb@nortel.com Nortel Canada April 25, 2006 Acknowledgements Some slides are provided by > Eve Maler, Sun Microsystems > Hal Lockhart, BEA 2 Agenda
OIO SAML Profile for Identity Tokens
> OIO SAML Profile for Identity Tokens Version 1.0 IT- & Telestyrelsen October 2009 Content > Document History 3 Introduction 4 Related profiles 4 Profile Requirements 6 Requirements 6
MONDESIR Eunice WEILL-TESSIER Pierre FEDERATED IDENTITY. ASR 2006/2007 Final Project. Supervisers: Maryline Maknavicius-Laurent, Guy Bernard
MONDESIR Eunice WEILL-TESSIER Pierre FEDERATED IDENTITY ASR 2006/2007 Final Project Supervisers: Maryline Maknavicius-Laurent, Guy Bernard Federated Identity Project topic Superviser: Maryline Maknavicius
A Signing Proxy for Web Services Security
A Signing Proxy for Web Services Security Ingo Melzer DaimlerChrysler AG paper@ingo-melzer.de Mario Jeckle FH Furtwangen mario@jeckle.de Abstract: Web Services offer a way for very different systems to
OSCI-Transport, Version 2.0
1 2 3 OSCI-Transport, Version 2.0 Web Services Profiling and Extensions Specification 4 OSCI Steering Office 5 6 Status: Final Edition 4 Last edited on 14 th of December, 2010 OSCI-Transport 2.0 Specification,
Bindings for the OASIS Security Assertion Markup Language (SAML) V2.0
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 Bindings for the OASIS Security Assertion Markup Language (SAML) V2.0 OASIS Standard,
SAML Federated Identity at OASIS
International Telecommunication Union SAML Federated Identity at OASIS Hal Lockhart BEA Systems Geneva, 5 December 2006 SAML and the OASIS SSTC o SAML: Security Assertion Markup Language A framework for
Using XACML and SAML for Authorisation messaging and assertions: XACML and SAML standards overview and usage examples
Using XACML and SAML for Authorisation messaging and assertions: XACML and SAML standards overview and usage examples Draft version 0.2. - March 28, 2005 Yuri Demchenko Abstracts
OIOSAML Rich Client to Browser Scenario Version 1.0
> OIOSAML Rich Client to Browser Scenario Version 1.0 Danish Agency for Digitization December 2011 Contents > 1 Introduction 4 1.1 Purpose 1.2 Background 4 4 2 Goals and Assumptions 5 3 Scenario Details
Liberty Technology Tutorial
Liberty Technology Tutorial Introduction to Liberty What is the Liberty Alliance? The Liberty Alliance is the only global body working to define and drive open technology standards, privacy and business
SAML Single-Sign-On (SSO)
C O L A B O R A T I V E I N N O V A T I O N M A N A G E M E N T Complete Feature Guide SAML Single-Sign-On (SSO) 1. Features This feature allows administrators to setup Single Sign-on (SSO) integration
SAML (Security Assertion Markup Language) Security Model for RESTful Web Services
SAML (Security Assertion Markup Language) Security Model for RESTful Web Services By: Shazia Sadiq 352-FBAS/MSCS/F07 Supervised by: Prof Dr.Muhammad Sher Department of Computer Science and Software Engineering
Single Sign-On Implementation Guide
Salesforce.com: Salesforce Winter '09 Single Sign-On Implementation Guide Copyright 2000-2008 salesforce.com, inc. All rights reserved. Salesforce.com and the no software logo are registered trademarks,
Automatic Penetration Test Tool for Detection of XML Signature Wrapping Attacks in Web Services
Master Thesis Automatic Penetration Test Tool for Detection of XML Signature Wrapping Attacks in Web Services Ruhr-Universität Bochum Christian Mainka 22. May 2012 Lehrstuhl für Netz- und Datensicherheit
Authenticating Distributed Data using Web Services and XML Signatures *
Authenticating Distributed Data using Web Services and XML Signatures * Daniel J. Polivy, Roberto Tamassia Department of Computer Science Brown University Providence, RI 02912-1910 {dpolivy, rt}@cs.brown.edu
ORACLE TALEO BUSINESS EDITION SINGLE SIGN ON SERVICE PROVIDER REFERENCE GUIDE RELEASE 15.A2
ORACLE TALEO BUSINESS EDITION SINGLE SIGN ON SERVICE PROVIDER REFERENCE GUIDE RELEASE 15.A2 APR. 17 TH., 2015 Part Number: E50271-02 Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores,
Grid Working Draft - Informational, GWD-I-XXX Network Service Interface (NSI) Working Group (WG) September 1, 2010
Inter-Domain Controller (IDC) Protocol Specification Status of this Document This document is provided to the Open Grid Forum (OGF) Network Service Group (NSI) as an informational document. Distribution
Authenticating users through a Security Token Service
Authenticating users through a Security Token Service Translation of user credentials Carolina Lindqvist Förnamn Efternamn Degree Thesis Information and Media Technology 2013 DEGREE THESIS Arcada Degree
Test Plan for Liberty Alliance SAML Test Event Test Criteria SAML 2.0
1 2 3 4 5 6 7 8 9 10 11 Test Plan for Liberty Alliance SAML Test Event Test Criteria SAML 2.0 Version 3.2.2 Editor: Kyle Meadors, Drummond Group Inc. Abstract: This document describes the test steps to
2015-11-30. Web Based Single Sign-On and Access Control
0--0 Web Based Single Sign-On and Access Control Different username and password for each website Typically, passwords will be reused will be weak will be written down Many websites to attack when looking
Authentication Context Classes for Levels of Assurance for the Swedish eid Framework
Authentication Context Classes for Levels of Assurance for the Swedish eid Framework Version 1.0 2013-07-01 1 (5) 1 INTRODUCTION 3 2 DEFINED AUTHENTICATION CONTEXT CLASSES 3 2.1 LEVEL OF ASSURANCE LEVEL
WebObjects Web Services Programming Guide. (Legacy)
WebObjects Web Services Programming Guide (Legacy) Contents Introduction to WebObjects Web Services Programming Guide 6 Organization of This Document 6 See Also 6 Web Services Overview 8 What Are Web Services?
Identity Assurance Hub Service SAML 2.0 Profile v1.2a
1 2 3 4 Identity Assurance Hub Service SAML 2.0 Profile v1.2a Identity Assurance Programme, 07 August 2015 5 6 7 8 9 10 11 12 13 14 15 16 17 18 Document identifier: IDAP/HubService/Profiles/SAML Editors:
Message Implementation Guidelines
C/ Santa María Magdalena 16, 28016 Madrid ICS Import Control System Message Implementation Guidelines Author: S.G.A.A Date: 17/01/2013 Release: 1.8 Ed. Rev. Date Description A(*) Pages 1 0 01/02/2010 Document
Ameritas Single Sign-On (SSO) and Enterprise SAML Standard. Architectural Implementation, Patterns and Usage Guidelines
Ameritas Single Sign-On (SSO) and Enterprise SAML Standard Architectural Implementation, Patterns and Usage Guidelines 1 Background and Overview... 3 Scope... 3 Glossary of Terms... 4 Architecture Components...
Web Services Security Tutorial
Web Services Security Tutorial A Web Services Security Overview and Implementation Tutorial Jorgen Thelin Chief Scientist Cape Clear Software Inc. 1 Copyright Notice Copyright 2003 Cape Clear Software.
Metadata for the OASIS Security Assertion Markup Language (SAML) V2.0
2 3 4 5 Metadata for the OASIS Security Assertion Markup Language (SAML) V2.0 OASIS Standard, 15 March 2005 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38
Security and Reliability for Web Services
Security and Reliability for Web Services v Takayuki Maeda v Yoshihide Nomura v Hirotaka Hara (Manuscript received June 22, 2003) Web services are expected to become an important information technology
ebinterface 4.1 The Austrian e-invoice standard
ebinterface 4.1 The Austrian e-invoice standard Published: December 16, 2013 Table of contents 1 Introduction... 3 1.1 Subject of this document... 3 1.2 Referenced XML standards and specifications... 3
ebinterface 4.0 The Austrian e-invoice standard
ebinterface 4.0 The Austrian e-invoice standard Note: This documentation is a translation of the German documentation of the ebinterface standard 4.0, available on http://www.ebinterface.at. This documentation
Analyzing the Interoperability of WS-Security and WS-ReliableMessaging Implementations
BAMBERGER BEITRÄGE ZUR WIRTSCHAFTSINFORMATIK UND ANGEWANDTEN INFORMATIK ISSN 0937-3349 Nr. 87 Analyzing the Interoperability of WS-Security and WS-ReliableMessaging Implementations Johannes Schwalb and
OSOR.eu eid/pki/esignature Community Workshop in Brussels, 13. November 2008 IT Architect Søren Peter Nielsen - spn@itst.dk
The OIOSAML Toolkits Accelerating a common egov infrastructure using open source reference implementations OSOR.eu eid/pki/esignature Community Workshop in Brussels, 13. November 2008 IT Infrastructure
INUVIKA OPEN VIRTUAL DESKTOP ENTERPRISE
INUVIKA OPEN VIRTUAL DESKTOP ENTERPRISE SAML 2.0 CONFIGURATION GUIDE Roy Heaton David Pham-Van Version 1.1 Published March 23, 2015 This document describes how to configure OVD to use SAML 2.0 for user
igovt logon service Context Mapping Service (icms) Messaging Specification Release 9.6
igovt logon service Context Mapping Service (icms) Messaging Specification Release 9.6 Subject Client Author Context Mapping Service Messaging Specification for the igovt logon service The Department of
Access Control in Distributed Systems. Murat Kantarcioglu
UT DALLAS Erik Jonsson School of Engineering & Computer Science Access Control in Distributed Systems Murat Kantarcioglu Topics Overview SAML XACML Overview Security for distributed systems has been widely
Flexible authentication for stateless web services
Chair for Network- and Data Security Horst Görtz Institute for IT Security Ruhr-University Bochum Supervisors: Prof. Jörg Schwenk Flexible authentication for stateless web services Student: DI Christian
Server based signature service. Overview
1(11) Server based signature service Overview Based on federated identity Swedish e-identification infrastructure 2(11) Table of contents 1 INTRODUCTION... 3 2 FUNCTIONAL... 4 3 SIGN SUPPORT SERVICE...
Token specification for Energinet.dk DataHub
Token specification for Energinet.dk DataHub Author: Jakob Gadegaard Bendixen, Signaturgruppen A/S Review: Peter Buus, Morten Storm Petersen, Thomas Mostrup Nymand Version: 0.4 Introduction The purpose
Shibboleth Authentication. Information Systems & Computing Identity and Access Management May 23, 2014
Shibboleth Authentication Information Systems & Computing Identity and Access Management May 23, 2014 For every question an answer: Why should I care about SAML? What is a Shibboleth? What is a Federation?
Setting Up Federated Identity with IBM SmartCloud
White Paper March 2012 Setting Up Federated Identity with IBM SmartCloud 2 Setting Up Federated Identity with IBM SmartCloud Notices Contents International Business Machines Corporation provides this publication
Encryption, Signing and Compression in Financial Web Services
Danske Bank Encryption, Signing and Compression in Financial Web Services Details of how to call the Danske Bank financial web service Version 2.4.7 Encryption, Signing and Compression in Financial Web
Developing a Single Sign-On System A Java-based authentication platform aimed at the web.
Developing a Single Sign-On System A Java-based authentication platform aimed at the web. Master of Science Thesis in Software Engineering HENRIK JERNEVAD Department of Computer Science and Engineering
2.2 Federated Identity Technologies
2007 Web Services and Identity 2.2 Federated Identity Technologies Eve Maler, Sun Microsystems www.xmlsummerschool.com Sun Microsystems 2007; licence to publish granted to CSW Group Ltd Introducing myself
How To Create A Web Based Identity Management System
Georg-August-Universität Göttingen Zentrum für Informatik ISSN 1612-6793 Nummer ZFI-BM-2007-39 Masterarbeit im Studiengang "Angewandte Informatik" Diameter WebAuth: An AAA-based Identity Management Framework
Assertions and Protocol for the OASIS Security Assertion Markup Language (SAML) V1.1
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 Assertions and Protocol for the OASIS Security Assertion Markup Language (SAML) V1.1 OASIS Standard,
Authentication & Digital Signature
Authentication & Digital Signature an overview Authentication Authentication Smartcard (UZI pass) with: private key (RSA) X.509 certificate (includes public key) PKI-Government Personal pass guard safely
Appendix 1 Technical Requirements
1 av 13 Appendix 1 Technical Requirements Version 2.4.7 Technical requirements for membership in the Skolfederation The Skolfederation has, like many other federation initiatives, the goal to use the following
Interoperable, Federated Identity Management Frameworks Across Enterprise Architectures. We can do this.
Interoperable, Federated Identity Management Frameworks Across Enterprise Architectures. We can do this. Scott McGrath COO Organization for the Advancement of Structured Information Standards A diverse
MACE-Dir SAML Attribute Profiles
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 MACE-Dir SAML Attribute Profiles April 2008 Document identifier: internet2-mace-dir-saml-attributes-200804a Location: http://middleware.internet2.edu/dir Editors: