The EUMETSAT EO Portal User Management Concept

Transcription

1 The EUMETSAT EO Portal User Management Concept Second Workshop on the use of GIS/OGC standards in meteorology Météo-France International Conference Center 42 avenue Gaspard Coriolis, Toulouse, France November 2009 Marko Reiprecht con terra GmbH, Germany 24. November 2009

2 Agenda Introduction Base Ideas Components Web application SSO Web Service Integration Summary

3 Introduction EO Portal provides a single point of online access to EUMETSAT data and dissemination services Past: several applications with self contained user management Users had to register with every application and to memorise different user ids and passwords EO Portal encapsulates the legacy applications and offers a harmonised user interface to discover, search, order / subscribe to data and services Clearinghouse: allows users to access data and services of partner agencies (e.g. CNES Altimetry products, NOAA, WMO, ESA) vice versa: allows partner agencies to discover, search, order and subscribe to EUMETSAT data and services via a set of programmatic, interoperable services Services are based on OGC/HMA and INSPIRE EU specifications

4 Introduction Some Services (e.g. ordering) require user details passed using security concepts In order to implement this between different organizations: >> A harmonized, sophisticated, standards based security concept is required

5 Base Ideas Base Ideas Brokered Trust via one or more trusted central authentication partners (Identity Provider) Integrate business partners as Service Provider entities Build up on already available federated user management and security specifications (SAML 2 + WS-Security) Explicit differentiation of web application SSO and the secure access to web services

6 Base Ideas Terms Identity Provider (IdP) Brokers the trust Encapsulates user authentication Service Provider (SP) Provides web services and web applications Both are Business Entities IdP and SPs work together to maximize their business volume Circle of Trust

7 Base Ideas Complex Trust and Business Relationships

8 Base Ideas Complex Trust and Business Relationships

9 FUM Components cmp eum usermanagement User with Browser IdP entity central login UI indirect indirect SP entity IdP User Registry sso account s are linked via pseudonyms SP User Registry «saml 2» SingleSignOnServ ice share federation metadata (public keys, sso endpoints, attribute mappings) share «saml 2» AssertionConsumerServ ice SAML2SecurityTokenServ ice WSC (part of an IdP or a SP) SP Web Serv ice IdP Web Serv ice

10 FUM Components cmp eum usermanagement User with Browser IdP entity Web Application SSO central login UI indirect indirect SP entity IdP User Registry sso account s are linked via pseudonyms SP User Registry «saml 2» SingleSignOnServ ice share federation metadata (public keys, sso endpoints, attribute mappings) share «saml 2» AssertionConsumerServ ice SAML2SecurityTokenServ ice WSC (part of an IdP or a SP) SP Web Serv ice IdP Web Serv ice

11 FUM Components cmp eum usermanagement User with Browser IdP entity central login UI indirect indirect SP entity IdP User Registry sso account s are linked via pseudonyms SP User Registry «saml 2» SingleSignOnServ ice share federation metadata (public keys, sso endpoints, attribute mappings) share «saml 2» AssertionConsumerServ ice SAML2SecurityTokenServ ice WSC (part of an IdP or a SP) SP Web Serv ice IdP Web Serv ice Web Service SSO

12 FUM Components cmp eum usermanagement OpenSSO User with Browser IdP entity central login UI indirect indirect SP entity IdP User Registry sso account s are linked via pseudonyms SP User Registry «saml 2» SingleSignOnServ ice share federation metadata (public keys, sso endpoints, attribute mappings) share «saml 2» AssertionConsumerServ ice SAML2SecurityTokenServ ice WSC (part of an IdP or a SP) SP Web Serv ice IdP Web Serv ice

13 Web Application SSO cmp eum usermanagement User with Browser IdP entity Web Application SSO central login UI indirect indirect SP entity IdP User Registry sso account s are linked via pseudonyms SP User Registry «saml 2» SingleSignOnServ ice share federation metadata (public keys, sso endpoints, attribute mappings) share «saml 2» AssertionConsumerServ ice SAML2SecurityTokenServ ice WSC (part of an IdP or a SP) SP Web Serv ice IdP Web Serv ice

14 Web Application SSO Sample starting from SP User not logged in Can perform anonymous tasks

15 Web Application SSO Sample starting from SP User clicks on Login Redirect to SingleSignOnService at IdP Central login UI form-based redirect SAMLRequest = <saml2:authnrequest/> RelayState = <start-url>

16 Web Application SSO Sample starting from SP Redirect to the AssertionConsumerService of the SP Now the user is authenticated form-based redirect SAMLResponse = <saml:assertion/> RelayState = <start-url>

17 Web Application SSO Web application SSO SAML 2 Web Browser SSO Profile HTTP-Redirect mechanism (HTTP-Post and/or Artifact Binding) Central login at the EO-Portal A user has a personal account at least at one identity provider and optional accounts on service provider level, these accounts are linked via special ids (pseudonyms) per IdP/SP pair The user accounts can be linked dynamically, during a user initiated web application SSO process or via offline batch processing

18 Web Service Integration cmp eum usermanagement User with Browser IdP entity central login UI indirect indirect SP entity IdP User Registry sso account s are linked via pseudonyms SP User Registry «saml 2» SingleSignOnServ ice share federation metadata (public keys, sso endpoints, attribute mappings) share «saml 2» AssertionConsumerServ ice SAML2SecurityTokenServ ice WSC (part of an IdP or a SP) SP Web Serv ice IdP Web Serv ice Web Service SSO

19 Web Service Integration Result of Web Application SSO Authenticated User at a Web Service Client (WSC) Problem: How to retrieve a valid security token for an user to authenticate the user at the target web service? sd use web service consider part of IdP or SP entity consider part of IdP entity consider part of IdP or SP entity WSC «IdP» SAML2SecurityTokenService Web Service par Obtain valid SecurityToken AuthnRequest :security token par Secure communication with web service sendrequest(security token) :response

20 Web Service Integration sd use web service consider part of IdP or SP entity consider part of IdP entity consider part of IdP or SP entity WSC «IdP» SAML2SecurityTokenService Web Service par Obtain valid SecurityToken AuthnRequest :security token par Secure communication with web service sendrequest(security token) :response GetTicket ( User-ID, Requestor-Entity, Target entity) Validate Ticket Signature Validate Request Signature (Holder Of Key) WS-Security SAML Token Profile

21 Web Service Integration REST Service Integration Proprietary Mechanism due to the lack of official specifications HTTP-Header SAML2Token base 64 encoded <saml2:assertion/> doesn t change any domain protocols not visible within URLs Additional Request Parameter SAML2Token base 64 encoded <saml2:assertion/> only useable if Key-Value-Pair encoding is used visible in URLs

22 HMA User Management Integration EO-Portal Supports the Specification OGC r1 User Management Interfaces for Earth Observation Services V0.0.4 Extension of the OpenSSO Server to support the HMA- AuthenticationService interface Support for the HMA Security Token Format (SAML1) EO-Portal Services can be consumed by HMA-Clients

23 Summary Based on OASIS SAML 2 and WS-Security Identity Federation Approach Web Application SSO (SAML2 & Domain Cookie) SOAP/REST Web Service Integration HMA User Management Integration Flexible and Extensible Security Model

24 Finish Thank you! Questions?