Infocard and Eduroam. Enrique de la Hoz, Diego R. López, Antonio García, Samuel Muñoz

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Infocard and Eduroam. Enrique de la Hoz, Diego R. López, Antonio García, Samuel Muñoz"

Transcription

1 Infocard and Eduroam Enrique de la Hoz, Diego R. López, Antonio García, Samuel Muñoz

2 Index Introduction to Infocard Infocard usage usso using Infocard in eduroam Questions

3 Infocard Artifact with a unique identifier from an identity provider that users can employ to visualize their digital relationship with the identity provider in user interfaces and request security tokens with claims from the identity provider. An Information Card is a XML document that can be used as an artifact to get security tokens containing the value of the requested claims Token agnostic: OpenID SAML1.1 Claims-based application Build upon WS-* protocols

4 Infocard support Client side: Microsoft CardSpace Bandit project: Digitalme: Azigo: Safari, Firefox Identity selectors Server side (RP / IP): Geneva Project,.NET Higgins Project: Shibboleth: Sun OpenSSO: SimpleSAMLphp (coming soon)

5 Identity Selector Identity Provider RP s key is not known to IP Token is not encrypted Request security token Response security token Decrypt Encrypt token with RP s key Token requirements Generate message Relying Party Generate a response message Encrypt to the client

6 Client Application WS-* Metasystem Protocol Identity Selector Relying Party Identity Provider WS-MEX GetMetadata Request WS-MEX GetMetadata Response GetToken(RP Policy) 4 Select Identity Policy WS-Security Policy 9 10 Identity needs credentials Return security token Access Resource with security token (WS-Security) WS-MEX GetMetadata Request WS-MEX GetMetadata Response WS-Trust RST Request (user credentials) WS-Trust RSTR Response (security token) Token

7 Infocard Architecture Elements User app (usually a web browser but not necessarily) Identity Selector Relying Party (RP): token consumer IP/STS: token issuer and Infocard Issuer

8 Infocard Usage Authentication Secure OpenID: OpenID Information Cards ( Self-issued cards as a replacement for user/password authentication Plugin for wordpress: Windows Live ID: Control of Information disclosure Easier management of digital identity

9 eduroam? What! Infocard as a key technology for usso. We do have working IdP Either RADIUS or IdP in edugain We could issue Infocards We have claims-based apps We could issue tokens containing those claims on request

10 Architecture Description

11 Step by step 1 - Radius Authentication Request 2 - RADIUS Response 3 (Optional) Information Card retrieval 4 - SP Access 5 - Redirection to Home IdP 6 - Infocard Authentication: (WS-*) 7 - Acces granted / rejected

12 RADIUS (step 1 and 2) User is authenticated to RADIUS as usual. Communication channel between RADIUS and Infocard STS Infocard STS generates an Information Card for the user Information Card itself could be contained in the RADIUS response (EAP-TLV) or user could download the Information Card from an URI specified in an attribute of the RADIUS response (step 3 then) What then? Supplicant will be in charge of importing the received Information Card into Information Card store No sensitive information in the Information Card

13 User Privacy What about user privacy? Infocard does not contain any info about user attributes Attributes disclosure is under strict control of end user

14 Service Provider Access What for? Service access -> Information Card Model Access to SP, redirection to home institution IdP IdP will act as a RP in the InfoCard architecture https access It will require Information Card for access Policy:» With a trusted issuer» Containing a certain set of attributes

15 Information Card (step 6) STS will be located in the home domain of each user STS will issue a token containing the required attributes It could be a signed SAML token. If and only if user is connected. As soon as user logs out, STS will stop token issuance for him. IP/STS may o may not know about who is requesting the attributes

16 Step 6 Explained How? WS-Trust, WS-Security, WS-MetadataExchange, WS- SecurityPolicy RP<->STS communication Information Card Validation User consent User MUST be connected to eduroam User not connected -> validation will fail Covert channel between RADIUS and STS SAML token issuance

17 Requirements How would this affect existing infraestructure? Minor changes New RADIUS attributes: EAP TLV to exchange Information Card Minor modifications to supplicant IdP side: OpenSSO, Shibboleth support InfoCard model And simplesamlphp ; (see you tomorrow!)

18 Thank you Questions/comments?

19 Further Info Contact me at:

An Infocard-based proposal for unified SSO to eduroam

An Infocard-based proposal for unified SSO to eduroam An Infocard-based proposal for unified SSO to eduroam Enrique de la Hoz, Antonio García, Diego López, Samuel Muñoz University of Alcala (Spain), RedIRIS (Spain) TNC2009, Málaga (Spain), June 9 th 2009

More information

Distributed Identification and Consumer Data Protection. Khaja Ahmed Microsoft Corporation

Distributed Identification and Consumer Data Protection. Khaja Ahmed Microsoft Corporation Distributed Identification and Consumer Data Protection Khaja Ahmed Microsoft Corporation Threats to Online Safety Consumer privacy has steadily declined as internet use grew over the years Greater use

More information

Negotiating Trust in Identity Metasystem

Negotiating Trust in Identity Metasystem Negotiating Trust in Identity Metasystem Mehmud Abliz Department of Computer Science University of Pittsburgh Pittsburgh, Pennsylvania 15260 mehmud@cs.pitt.edu Abstract Many federated identity management

More information

Federated Identity Management Solutions

Federated Identity Management Solutions Federated Identity Management Solutions Jyri Kallela Helsinki University of Technology jkallela@cc.hut.fi Abstract Federated identity management allows users to access multiple services based on a single

More information

Privacy in Cloud Computing Through Identity Management

Privacy in Cloud Computing Through Identity Management Privacy in Cloud Computing Through Identity Management Bharat Bhargava 1, Noopur Singh 2, Asher Sinclair 3 1 Computer Science, Purdue University 2 Electrical and Computer Engineering, Purdue University

More information

Title: A Client Middleware for Token-Based Unified Single Sign On to edugain

Title: A Client Middleware for Token-Based Unified Single Sign On to edugain Title: A Client Middleware for Token-Based Unified Single Sign On to edugain Sascha Neinert Computing Centre University of Stuttgart, Allmandring 30a, 70550 Stuttgart, Germany e-mail: sascha.neinert@rus.uni-stuttgart.de

More information

Information Security Group Active-client based identity management

Information Security Group Active-client based identity management Active-client based identity management Chris Mitchell Royal Holloway, University of London www.chrismitchell.net 1 Acknowledgements This is joint work with Haitham Al-Sinani, also of Royal Holloway. 2

More information

Flexible Identity Federation

Flexible Identity Federation Flexible Identity Federation Quick start guide version 1.0.1 Publication history Date Description Revision 2015.09.23 initial release 1.0.0 2015.12.11 minor updates 1.0.1 Copyright Orange Business Services

More information

Разработка программного обеспечения промежуточного слоя. TERENA BASNET Workshop, 16-17 November 2009 Joost van Dijk - SURFnet

Разработка программного обеспечения промежуточного слоя. TERENA BASNET Workshop, 16-17 November 2009 Joost van Dijk - SURFnet Разработка программного обеспечения промежуточного слоя TERENA BASNET Workshop, 16-17 November 2009 Joost van Dijk - SURFnet Contents - SURFnet Middleware Services department: - eduroam, SURFfederatie,

More information

Single Sign On. SSO & ID Management for Web and Mobile Applications

Single Sign On. SSO & ID Management for Web and Mobile Applications Single Sign On and ID Management Single Sign On SSO & ID Management for Web and Mobile Applications Presenter: Manish Harsh Program Manager for Developer Marketing Platforms of NVIDIA (Visual Computing

More information

Federated Identity Opportunities & Risks

Federated Identity Opportunities & Risks Federated Identity Opportunities & Risks Dominick Baier Former ERNW employee Security consultant at thinktecture application security in distributed systems identity management mostly Windows &.NET http://www.leastprivilege.com

More information

Identity Management in Telcos. Jörg Heuer, Deutsche Telekom AG, Laboratories. Munich, April 2008

Identity Management in Telcos. Jörg Heuer, Deutsche Telekom AG, Laboratories. Munich, April 2008 Identity Management in Telcos Jörg Heuer, Deutsche Telekom AG, Laboratories. Munich, April 2008 1 Agenda. Introduction User-centric Identity and Telcos Comprehensive Identity Models IDM Reference Architecture

More information

Introducing Infocards in NGN to enable user-centric identity management

Introducing Infocards in NGN to enable user-centric identity management Introducing Infocards in NGN to enable user-centric identity management Davide Proserpio, Fabio Sanvido, Patricia Arias Cabarcos, Rosa Sánchez Guerrero, Florina Almenárez-Mendoza, Daniel Díaz-Sánchez and

More information

Boosting interoperability and collaboration across mixedtechnology

Boosting interoperability and collaboration across mixedtechnology Boosting interoperability and collaboration across mixedtechnology environments Standards-based identity federation solutions from Microsoft and Novell May 2009 Executive summary Despite remarkable gains

More information

Enhancing User Authentication in Claim-Based Identity Management

Enhancing User Authentication in Claim-Based Identity Management Enhancing User Authentication in Claim-Based Identity Management Waleed A. Alrodhan and Chris J. Mitchell Information Security Group Royal Holloway, University of London {W.A.Alrodhan, C.Mitchell}@rhul.ac.uk

More information

Evaluation of different Open Source Identity management Systems

Evaluation of different Open Source Identity management Systems Evaluation of different Open Source Identity management Systems Ghasan Bhatti, Syed Yasir Imtiaz Linkoping s universitetet, Sweden [ghabh683, syeim642]@student.liu.se 1. Abstract Identity management systems

More information

An Efficient Windows Cardspace identity Management Technique in Cloud Computing

An Efficient Windows Cardspace identity Management Technique in Cloud Computing IOSR Journal of Computer Engineering (IOSR-JCE) e-issn: 2278-0661, p- ISSN: 2278-8727Volume 16, Issue 3, Ver. VII (May-Jun. 2014), PP 61-66 An Efficient Windows Cardspace identity Management Technique

More information

Web Services Security: OpenSSO and Access Management for SOA. Sang Shin Java Technology Evangelist Sun Microsystems, Inc. javapassion.

Web Services Security: OpenSSO and Access Management for SOA. Sang Shin Java Technology Evangelist Sun Microsystems, Inc. javapassion. Web Services Security: OpenSSO and Access Management for SOA Sang Shin Java Technology Evangelist Sun Microsystems, Inc. javapassion.com 1 Agenda Need for Identity-based Web services security Single Sign-On

More information

Computer Systems Security 2013/2014. Single Sign-On. Bruno Maia ei09095@fe.up.pt. Pedro Borges ei09063@fe.up.pt

Computer Systems Security 2013/2014. Single Sign-On. Bruno Maia ei09095@fe.up.pt. Pedro Borges ei09063@fe.up.pt Computer Systems Security 2013/2014 Single Sign-On Bruno Maia ei09095@fe.up.pt Pedro Borges ei09063@fe.up.pt December 13, 2013 Contents 1 Introduction 2 2 Explanation of SSO systems 2 2.1 OpenID.................................

More information

A Federated Authorization and Authentication Infrastructure for Unified Single Sign On

A Federated Authorization and Authentication Infrastructure for Unified Single Sign On A Federated Authorization and Authentication Infrastructure for Unified Single Sign On Sascha Neinert Computing Centre University of Stuttgart Allmandring 30a 70550 Stuttgart sascha.neinert@rus.uni-stuttgart.de

More information

Introduction to Identity Management. Sam Lee, Outblaze Ltd.

Introduction to Identity Management. Sam Lee, Outblaze Ltd. Introduction to Identity Management Sam Lee, Outblaze Ltd. Agenda Background Identity Management Single Sign-On Federation Future s Identity management Conclusions 2 Background Why identity management?

More information

An Oracle White Paper Dec 2013. Oracle Access Management Security Token Service

An Oracle White Paper Dec 2013. Oracle Access Management Security Token Service An Oracle White Paper Dec 2013 Oracle Access Management Security Token Service Disclaimer The following is intended to outline our general product direction. It is intended for information purposes only,

More information

Author. Ginés Dólera Tormo. Advisors Dr. Félix Gómez Mármol (NEC Laboratories Europe) Prof. Dr. Gregorio Martínez Pérez (University of Murcia)

Author. Ginés Dólera Tormo. Advisors Dr. Félix Gómez Mármol (NEC Laboratories Europe) Prof. Dr. Gregorio Martínez Pérez (University of Murcia) Systems with Faculty of Computer Science ENHANCING USER CENTRIC IDENTITY MANAGEMENT SYSTEMS WITH REPUTATION MODELS IN DISTRIBUTED ENVIRONMENTS Author Advisors Dr. Félix Gómez Mármol (NEC Laboratories Europe)

More information

INTRODUCING GENEVA AN OVERVIEW OF THE GENEVA SERVER, CARDSPACE GENEVA, AND THE GENEVA FRAMEWORK DAVID CHAPPELL OCTOBER 2008

INTRODUCING GENEVA AN OVERVIEW OF THE GENEVA SERVER, CARDSPACE GENEVA, AND THE GENEVA FRAMEWORK DAVID CHAPPELL OCTOBER 2008 INTRODUCING GENEVA AN OVERVIEW OF THE GENEVA SERVER, CARDSPACE GENEVA, AND THE GENEVA FRAMEWORK DAVID CHAPPELL OCTOBER 2008 SPONSORED BY MICROSOFT CORPORATION CONTENTS Understanding Claims-Based Identity...

More information

IGI Portal architecture and interaction with a CA- online

IGI Portal architecture and interaction with a CA- online IGI Portal architecture and interaction with a CA- online Abstract In the framework of the Italian Grid Infrastructure, we are designing a web portal for the grid and cloud services provisioning. In following

More information

Les technologies de gestion de l identité

Les technologies de gestion de l identité Commission Identité Numérique Groupe de travail Gestion des identités Les technologies de gestion de l identité ATELIER 1 Paul TREVITHICK, CEO de Parity Responsable projet Higgins Président Fondation Infocard

More information

Microsoft Dynamics CRM Server 2011 software requirements

Microsoft Dynamics CRM Server 2011 software requirements Microsoft Dynamics CRM Server 2011 software requirements This section lists the software and application requirements for Microsoft Dynamics CRM Server 2011. Windows Server operating system: Microsoft

More information

000-575. IBM Tivoli Federated Identity Manager V6.2.2 Implementation. Version: Demo. Page <<1/10>>

000-575. IBM Tivoli Federated Identity Manager V6.2.2 Implementation. Version: Demo. Page <<1/10>> 000-575 IBM Tivoli Federated Identity Manager V6.2.2 Implementation Version: Demo Page 1.What is the default file name of the IBM Tivoli Directory Integrator log? A. tdi.log B. ibmdi.log C. ibmdisrv.log

More information

The increasing popularity of mobile devices is rapidly changing how and where we

The increasing popularity of mobile devices is rapidly changing how and where we Mobile Security BACKGROUND The increasing popularity of mobile devices is rapidly changing how and where we consume business related content. Mobile workforce expectations are forcing organizations to

More information

DAMe Deploying Authorization Mechanisms for Federated Services in the eduroam Architecture

DAMe Deploying Authorization Mechanisms for Federated Services in the eduroam Architecture DAMe Deploying Authorization Mechanisms for Federated Services in the eduroam Architecture Sascha Neinert Marseille, 06.02.2008, Sascha Neinert, 06.02.2008 Seite 1 Overview Project Goals Partners Network

More information

Intro to Federated Identity

Intro to Federated Identity Intro to Federated Identity EuroCAMP Training This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License. 1 Lets get a federated identity Do you have access to your email?

More information

Federated Identity and Trust Management

Federated Identity and Trust Management Redpaper Axel Buecker Paul Ashley Neil Readshaw Federated Identity and Trust Management Introduction The cost of managing the life cycle of user identities is very high. Most organizations have to manage

More information

Federated Identity Architectures

Federated Identity Architectures Federated Identity Architectures Uciel Fragoso-Rodriguez Instituto Tecnológico Autónomo de México, México {uciel@itam.mx} Maryline Laurent-Maknavicius CNRS Samovar UMR 5157, GET Institut National des Télécommunications,

More information

Get Success in Passing Your Certification Exam at first attempt!

Get Success in Passing Your Certification Exam at first attempt! Get Success in Passing Your Certification Exam at first attempt! Exam : C2150-575 Title : IBM Tivoli Federated Identity Manager V6.2.2 Implementation Version : Demo 1.What is the default file name of the

More information

Comparing Identity Management Frameworks in a Business Context

Comparing Identity Management Frameworks in a Business Context Comparing Identity Management Frameworks in a Business Context Jaap-Henk Hoepman, Rieks Joosten, and Johanneke Siljee jaap-henk.hoepman@tno.nl, rieks.joosten@tno.nl, johanneke.siljee@tno.nl TNO, the Netherlands

More information

Digital Identity and Identity Management Technologies.

Digital Identity and Identity Management Technologies. I. Agudo, Digital Identity and Identity Management Technologies, UPGRADE - The European Journal of the Informatics Professional, vol. 2010, pp. 6-12, 2010. NICS Lab. Publications: https://www.nics.uma.es/publications

More information

Moodle and Office 365 Step-by-Step Guide: Federation using Active Directory Federation Services

Moodle and Office 365 Step-by-Step Guide: Federation using Active Directory Federation Services Moodle and Office 365 Step-by-Step Guide: Federation using Active Directory Federation Services This document is provided as-is. Information and views expressed in this document, including URL and other

More information

ALF SSO: Security Framework for Tool Integration. Brian Carroll, Eclipse ALF Project Lead bcarroll@serena.com

ALF SSO: Security Framework for Tool Integration. Brian Carroll, Eclipse ALF Project Lead bcarroll@serena.com ALF SSO: Security Framework for Tool Integration Brian Carroll, Eclipse ALF Project Lead bcarroll@serena.com 2008 by Brian Carroll, Serena; made available under the EPL v1.0 March 2008 ALF: Is About Process

More information

Ameritas Single Sign-On (SSO) and Enterprise SAML Standard. Architectural Implementation, Patterns and Usage Guidelines

Ameritas Single Sign-On (SSO) and Enterprise SAML Standard. Architectural Implementation, Patterns and Usage Guidelines Ameritas Single Sign-On (SSO) and Enterprise SAML Standard Architectural Implementation, Patterns and Usage Guidelines 1 Background and Overview... 3 Scope... 3 Glossary of Terms... 4 Architecture Components...

More information

Identity Management. Audun Jøsang University of Oslo. NIS 2010 Summer School. September 2010. http://persons.unik.no/josang/

Identity Management. Audun Jøsang University of Oslo. NIS 2010 Summer School. September 2010. http://persons.unik.no/josang/ Identity Management Audun Jøsang University of Oslo NIS 2010 Summer School September 2010 http://persons.unik.no/josang/ Outline Identity and identity management concepts Identity management models User-centric

More information

OpenAM All-In-One solution to securely manage access to digital enterprise and customer services, anytime and anywhere.

OpenAM All-In-One solution to securely manage access to digital enterprise and customer services, anytime and anywhere. OpenAM All-In-One solution to securely manage access to digital enterprise and customer services, anytime and anywhere. OpenAM, the only all-in-one open source access management solution, provides the

More information

Federated Wikis Andreas Åkre Solberg andreas@uninett.no

Federated Wikis Andreas Åkre Solberg andreas@uninett.no Federated Wikis Andreas Åkre Solberg andreas@uninett.no Wikis in the beginning...in the beginning wikis were wide open. Great! - But then the spammers arrived. Password protected wikis Create yet another

More information

Federated AAA middleware and the QUT SSO environment

Federated AAA middleware and the QUT SSO environment Federated AAA middleware and the QUT SSO environment Bradley Beddoes Senior Network Programmer AAA eview Project Manager b.beddoes@qut.edu.au Shaun Mangelsdorf Network Programmer s.mangelsdorf@qut.edu.au

More information

Federated Identity Management Technologies and Systems

Federated Identity Management Technologies and Systems Federated Identity Management Technologies and Systems David Chadwick 15 June 2011 2010-11 TrueTrust Ltd 1 Some Early FIM Systems Microsoft s Passport UK Athens Some More Recent FIM Systems Shibboleth

More information

Addressing threats to real-world identity management systems

Addressing threats to real-world identity management systems Addressing threats to real-world identity management systems Wanpeng Li and Chris J Mitchell Information Security Group Royal Holloway, University of London Agenda Single sign-on and identity management

More information

QR-SSO : Towards a QR-Code based Single Sign-On system

QR-SSO : Towards a QR-Code based Single Sign-On system QR-SSO : Towards a QR-Code based Single Sign-On system Syamantak Mukhopadhyay School of Electronics and Computer Science University of Southampton Southampton, UK sm19g10@ecs.soton.ac.uk David Argles School

More information

Federated Identity Management

Federated Identity Management Federated Identity Management David Chadwick University of Kent FOSAD 29-30 Aug 08 2008 David Chadwick 1 1 Some Definitions What is Identity? A whole set of attributes that uniquely characterise a person

More information

Open Source Identity Integration with OpenSSO

Open Source Identity Integration with OpenSSO Open Source Identity Integration with OpenSSO April 19, 2008 Pat Patterson Federation Architect pat.patterson@sun.com blogs.sun.com/superpat Agenda Web Access Management > The Problem > The Solution >

More information

PROVIDING SINGLE SIGN-ON TO AMAZON EC2 APPLICATIONS FROM AN ON-PREMISES WINDOWS DOMAIN

PROVIDING SINGLE SIGN-ON TO AMAZON EC2 APPLICATIONS FROM AN ON-PREMISES WINDOWS DOMAIN PROVIDING SINGLE SIGN-ON TO AMAZON EC2 APPLICATIONS FROM AN ON-PREMISES WINDOWS DOMAIN CONNECTING TO THE CLOUD DAVID CHAPPELL DECEMBER 2009 SPONSORED BY AMAZON AND MICROSOFT CORPORATION CONTENTS The Challenge:

More information

CONFIGURATION GUIDE WITH MICROSOFT ACTIVE DIRECTORY FEDERATION SERVER

CONFIGURATION GUIDE WITH MICROSOFT ACTIVE DIRECTORY FEDERATION SERVER UMANTIS CLOUD SSO CONFIGURATION GUIDE WITH MICROSOFT ACTIVE DIRECTORY FEDERATION SERVER THIS DOCUMENT DESCRIBES THE REQUIREMENTS TO SETUP A SINGLE SIGN ON (SSO) CONFIGURATION ON UMANTIS CLOUD BASED SOLUTIONS

More information

NIST s Guide to Secure Web Services

NIST s Guide to Secure Web Services NIST s Guide to Secure Web Services Presented by Gaspar Modelo-Howard and Ratsameetip Wita Secure and Dependable Web Services National Institute of Standards and Technology. Special Publication 800-95:

More information

New Single Sign-on Options for IBM Lotus Notes & Domino. 2012 IBM Corporation

New Single Sign-on Options for IBM Lotus Notes & Domino. 2012 IBM Corporation New Single Sign-on Options for IBM Lotus Notes & Domino 2012 IBM Corporation IBM s statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM s sole

More information

INTEGRATE SALESFORCE.COM SINGLE SIGN-ON WITH THIRD-PARTY SINGLE SIGN-ON USING SENTRY A GUIDE TO SUCCESSFUL USE CASE

INTEGRATE SALESFORCE.COM SINGLE SIGN-ON WITH THIRD-PARTY SINGLE SIGN-ON USING SENTRY A GUIDE TO SUCCESSFUL USE CASE INTEGRATE SALESFORCE.COM SINGLE SIGN-ON WITH THIRD-PARTY SINGLE SIGN-ON USING SENTRY A GUIDE TO SUCCESSFUL USE CASE Legal Marks No portion of this document may be reproduced or copied in any form, or by

More information

An Anti-Phishing mechanism for Single Sign-On based on QR-Code

An Anti-Phishing mechanism for Single Sign-On based on QR-Code An Anti-Phishing mechanism for Single Sign-On based on QR-Code Syamantak Mukhopadhyay School of Electronics and Computer Science University of Southampton Southampton, UK sm19g10@ecs.soton.ac.uk David

More information

Using SAML for Single Sign-On in the SOA Software Platform

Using SAML for Single Sign-On in the SOA Software Platform Using SAML for Single Sign-On in the SOA Software Platform SOA Software Community Manager: Using SAML on the Platform 1 Policy Manager / Community Manager Using SAML for Single Sign-On in the SOA Software

More information

Authentication Methods

Authentication Methods Authentication Methods Overview In addition to the OU Campus-managed authentication system, OU Campus supports LDAP, CAS, and Shibboleth authentication methods. LDAP users can be configured through the

More information

2015-11-30. Web Based Single Sign-On and Access Control

2015-11-30. Web Based Single Sign-On and Access Control 0--0 Web Based Single Sign-On and Access Control Different username and password for each website Typically, passwords will be reused will be weak will be written down Many websites to attack when looking

More information

HMA AWG Meeting Proposal for a Security Token Service - 29. September 2009 Marko Reiprecht con terra GmbH, Germany

HMA AWG Meeting Proposal for a Security Token Service - 29. September 2009 Marko Reiprecht con terra GmbH, Germany HMA AWG Meeting Proposal for a Security Token Service - 29. September 2009 Marko Reiprecht con terra GmbH, Germany Goal Show the differences of two alternative federated user management specifications

More information

SAML Single-Sign-On (SSO)

SAML Single-Sign-On (SSO) C O L A B O R A T I V E I N N O V A T I O N M A N A G E M E N T Complete Feature Guide SAML Single-Sign-On (SSO) 1. Features This feature allows administrators to setup Single Sign-on (SSO) integration

More information

The saga of WebFTS and Federated Identity

The saga of WebFTS and Federated Identity The saga of WebFTS and Federated Identity Andrey Kiryanov IT/SDC 15/12/2014 The Reason: 2 What is a Federated Identity? It is the means of linking a person's electronic identity and attributes, stored

More information

Federation Proxy for Cross Domain Identity Federation

Federation Proxy for Cross Domain Identity Federation Proxy for Cross Domain Identity Makoto Hatakeyama NEC Corporation, Common Platform Software Res. Lab. 1753, Shimonumabe, Nakahara-Ku, Kawasaki, Kanagawa 211-8666, Japan +81-44-431-7663 m-hatake@ax.jp.nec.com

More information

Secure the Web: OpenSSO

Secure the Web: OpenSSO Secure the Web: OpenSSO Sang Shin, Technology Architect Sun Microsystems, Inc. javapassion.com Pat Patterson, Principal Engineer Sun Microsystems, Inc. blogs.sun.com/superpat 1 Agenda Need for identity-based

More information

Browser Extension-based Interoperation Between OAuth and Information Card-based Systems

Browser Extension-based Interoperation Between OAuth and Information Card-based Systems Browser Extension-based Interoperation Between OAuth and Information Card-based Systems Haitham S. Al-Sinani Technical Report RHUL MA 2011 15 24 September 2011 Department of Mathematics Royal Holloway,

More information

Enabling Federation and Web-Single Sign-On in Heterogeneous Landscapes with the Identity Provider and Security Token Service Supplied by SAP NetWeaver

Enabling Federation and Web-Single Sign-On in Heterogeneous Landscapes with the Identity Provider and Security Token Service Supplied by SAP NetWeaver Enabling Federation and Web-Single Sign-On in Heterogeneous Landscapes with the Identity Provider and Security Token Service Supplied by SAP NetWeaver SAP Product Management, SAP NetWeaver Identity Management

More information

User Guide. The AMF's File Transfer Service (FTS)

User Guide. The AMF's File Transfer Service (FTS) User Guide The AMF's File Transfer Service (FTS) TABLE OF CONTENTS 1 INTENDED USERS... 3 2 SCOPE OF GUIDE... 3 3 BACKGROUND... 3 4 REQUIRED CONFIGURATION... 3 5 CONTACT INFORMATION FOR SUPPORT... 4 6 SECURITY...

More information

Trend of Federated Identity Management for Web Services

Trend of Federated Identity Management for Web Services 30 Trend of Federated Identity Management for Web Services Chulung Kim, Sangyong Han Abstract While Web service providers offer different approaches to implementing security, users of Web services demand

More information

The Identity Metasystem: A User-Centric, Inclusive Web Authentication Solution

The Identity Metasystem: A User-Centric, Inclusive Web Authentication Solution The Identity Metasystem: A User-Centric, Inclusive Web Authentication Solution Position paper for the W3C Workshop on Transparency and Usability of Web Authentication New York City, March 2006 Michael

More information

Egnyte Single Sign-On (SSO) Installation for OneLogin

Egnyte Single Sign-On (SSO) Installation for OneLogin Egnyte Single Sign-On (SSO) Installation for OneLogin To set up Egnyte so employees can log in using SSO, follow the steps below to configure OneLogin and Egnyte to work with each other. 1. Set up OneLogin

More information

RUHR-UNIVERSITÄT BOCHUM. On the Insecurity of Microsoft s Identity Metasystem

RUHR-UNIVERSITÄT BOCHUM. On the Insecurity of Microsoft s Identity Metasystem RUHR-UNIVERSITÄT BOCHUM Horst Görtz Institute for IT Security Technical Report TR-HGI-2008-003 On the Insecurity of Microsoft s Identity Metasystem Sebastian Gajek, Jörg Schwenk, and Chen Xuan Chair for

More information

EXTENDING SINGLE SIGN-ON TO AMAZON WEB SERVICES

EXTENDING SINGLE SIGN-ON TO AMAZON WEB SERVICES pingidentity.com EXTENDING SINGLE SIGN-ON TO AMAZON WEB SERVICES Best practices for identity federation in AWS Table of Contents Executive Overview 3 Introduction: Identity and Access Management in Amazon

More information

Efficiency of the Single Sign On mechanism in a tactical network environment

Efficiency of the Single Sign On mechanism in a tactical network environment Efficiency of the Single Sign On mechanism in a tactical network environment Joanna Śliwa, Tomasz Podlasek C4I Systems Division Military Communication Institute Zegrze, Poland {j.sliwa, t.podlasek}@wil.waw.pl

More information

Core Feature Comparison between. XML / SOA Gateways. and. Web Application Firewalls. Jason Macy jmacy@forumsys.com CTO, Forum Systems

Core Feature Comparison between. XML / SOA Gateways. and. Web Application Firewalls. Jason Macy jmacy@forumsys.com CTO, Forum Systems Core Feature Comparison between XML / SOA Gateways and Web Application Firewalls Jason Macy jmacy@forumsys.com CTO, Forum Systems XML Gateway vs Competitive XML Gateways or Complementary? and s are Complementary

More information

Addressing threats to real-world identity management systems

Addressing threats to real-world identity management systems Addressing threats to real-world identity management systems Wanpeng Li and Chris J Mitchell Information Security Group Royal Holloway, University of London Agenda Single sign-on and identity management

More information

OpenSSO: Cross Domain Single Sign On

OpenSSO: Cross Domain Single Sign On OpenSSO: Cross Domain Single Sign On Version 0.1 History of versions Version Date Author(s) Changes 0.1 11/30/2006 Dennis Seah Contents Initial Draft. 1 Introduction 1 2 Single Domain Single Sign-On 2

More information

VMware Identity Manager Integration with Active Directory Federation Services 2.0

VMware Identity Manager Integration with Active Directory Federation Services 2.0 VMware Identity Manager Integration with Active Directory Federation Services 2.0 VMware Identity Manager J ULY 2015 V 2 Table of Contents Active Directory Federation Services... 2 Configuring AD FS Instance

More information

Tenrox. Single Sign-On (SSO) Setup Guide. January, 2012. 2012 Tenrox. All rights reserved.

Tenrox. Single Sign-On (SSO) Setup Guide. January, 2012. 2012 Tenrox. All rights reserved. Tenrox Single Sign-On (SSO) Setup Guide January, 2012 2012 Tenrox. All rights reserved. About this Guide This guide provides a high-level technical overview of the Tenrox Single Sign-On (SSO) architecture,

More information

Get a Whiff of WIF Windows Identity Foundation. Keith Brown www.pluralsight.com/keith

Get a Whiff of WIF Windows Identity Foundation. Keith Brown www.pluralsight.com/keith Get a Whiff of WIF Windows Identity Foundation Keith Brown www.pluralsight.com/keith Authentication is challenging on the Web Lots of technologies Lots of APIs Important to get it right The old way: per-app

More information

Apache Server Implementation Guide

Apache Server Implementation Guide Apache Server Implementation Guide 340 March Road Suite 600 Kanata, Ontario, Canada K2K 2E4 Tel: +1-613-599-2441 Fax: +1-613-599-2442 International Voice: +1-613-599-2441 North America Toll Free: 1-800-307-7042

More information

Cloud Security: Yesterday, Today, and Tomorrow

Cloud Security: Yesterday, Today, and Tomorrow Cloud Security: Yesterday, Today, and Tomorrow Presentation by Gunnar Peterson www.arctecgroup.net 2005-9 Arctec Group Everything we think of as a computer today is really just a device that connects to

More information

Internet-Scale Identity Systems: An Overview and Comparison

Internet-Scale Identity Systems: An Overview and Comparison Internet-Scale Identity Systems: An Overview and Comparison Overview An Internet-scale identity system is an architecture that defines standardized mechanisms enabling the identity attributes of its users

More information

Economics of Identity Management Systems - Towards an Economically Adaptive User-Centric IdMS. Mohammed H. Almeshekah

Economics of Identity Management Systems - Towards an Economically Adaptive User-Centric IdMS. Mohammed H. Almeshekah Economics of Identity Management Systems - Towards an Economically Adaptive User-Centric IdMS Mohammed H. Almeshekah Supervisor: Dr. Geraint Price Submitted as part of the requirements for the award of

More information

This way, Bluewin will be able to offer single sign-on for service providers within the circle.

This way, Bluewin will be able to offer single sign-on for service providers within the circle. Clareity Security and The National Association of Realtors Develop a SAML Toolkit for the Real Estate Industry Ask any REALTOR about the systems they use and the passwords they deploy. The word mess will

More information

Microsoft Office 365 Using SAML Integration Guide

Microsoft Office 365 Using SAML Integration Guide Microsoft Office 365 Using SAML Integration Guide Revision A Copyright 2013 SafeNet, Inc. All rights reserved. All attempts have been made to make the information in this document complete and accurate.

More information

Enabling Digital Identity. David Recordon Innovator for Advanced Products & Research

Enabling Digital Identity. David Recordon Innovator for Advanced Products & Research Enabling Digital Identity David Recordon Innovator for Advanced Products & Research DC PHP Conference 2006 Overview + Web 2.0 + Identity so what? + Identity 2.0 + Competitive Overview + Digging into OpenID

More information

This chapter describes how to use the Junos Pulse Secure Access Service in a SAML single sign-on deployment. It includes the following sections:

This chapter describes how to use the Junos Pulse Secure Access Service in a SAML single sign-on deployment. It includes the following sections: CHAPTER 1 SAML Single Sign-On This chapter describes how to use the Junos Pulse Secure Access Service in a SAML single sign-on deployment. It includes the following sections: Junos Pulse Secure Access

More information

SAML-Based SSO Solution

SAML-Based SSO Solution About SAML SSO Solution, page 1 SAML-Based SSO Features, page 2 Basic Elements of a SAML SSO Solution, page 2 SAML SSO Web Browsers, page 3 Cisco Unified Communications Applications that Support SAML SSO,

More information

Identity Management in Liferay Overview and Best Practices. Liferay Portal 6.0 EE

Identity Management in Liferay Overview and Best Practices. Liferay Portal 6.0 EE Identity Management in Liferay Overview and Best Practices Liferay Portal 6.0 EE Table of Contents Introduction... 1 IDENTITY MANAGEMENT HYGIENE... 1 Where Liferay Fits In... 2 How Liferay Authentication

More information

OpenSSO: Simplify Your Single-Sign-On Needs. Sang Shin Java Technology Architect Sun Microsystems, inc. javapassion.com

OpenSSO: Simplify Your Single-Sign-On Needs. Sang Shin Java Technology Architect Sun Microsystems, inc. javapassion.com OpenSSO: Simplify Your Single-Sign-On Needs Sang Shin Java Technology Architect Sun Microsystems, inc. javapassion.com 1 Agenda Enterprise security needs What is OpenSSO? OpenSSO features > > > > SSO and

More information

CS 6393 Lecture 7. Privacy. Prof. Ravi Sandhu Executive Director and Endowed Chair. March 8, 2013. ravi.sandhu@utsa.edu www.profsandhu.

CS 6393 Lecture 7. Privacy. Prof. Ravi Sandhu Executive Director and Endowed Chair. March 8, 2013. ravi.sandhu@utsa.edu www.profsandhu. CS 6393 Lecture 7 Privacy Prof. Ravi Sandhu Executive Director and Endowed Chair March 8, 2013 ravi.sandhu@utsa.edu www.profsandhu.com Ravi Sandhu 1 Privacy versus Security Privacy Security I think this

More information

Identity Management. Critical Systems Laboratory

Identity Management. Critical Systems Laboratory Identity Management Critical Systems What is Identity Management? Identity: a set of attributes and values, which might or might not be unique Storing and manipulating identities Binding virtual identities

More information

The Primer: Nuts and Bolts of Federated Identity Management

The Primer: Nuts and Bolts of Federated Identity Management The Primer: Nuts and Bolts of Federated Identity Management Executive Overview For any IT department, it is imperative to understand how your organization can securely manage and control users identities.

More information

Authentication Integration

Authentication Integration Authentication Integration VoiceThread provides multiple authentication frameworks allowing your organization to choose the optimal method to implement. This document details the various available authentication

More information

Interwise Connect. Working with Reverse Proxy Version 7.x

Interwise Connect. Working with Reverse Proxy Version 7.x Working with Reverse Proxy Version 7.x Table of Contents BACKGROUND...3 Single Sign On (SSO)... 3 Interwise Connect... 3 INTERWISE CONNECT WORKING WITH REVERSE PROXY...4 Architecture... 4 Interwise Web

More information

Network-based Access Control

Network-based Access Control Chapter 4 Network-based Access Control 4.1 Rationale and Motivation Over the past couple of years, a multitude of authentication and access control technologies have been designed and implemented. Although

More information

CICS Web Service Security. Anthony Papageorgiou IBM CICS Development March 13, 2012 Session: 10282

CICS Web Service Security. Anthony Papageorgiou IBM CICS Development March 13, 2012 Session: 10282 Web Service Security Anthony Papageorgiou IBM Development March 13, 2012 Session: 10282 Agenda Web Service Support Overview Security Basics and Terminology Pipeline Security Overview Identity Encryption

More information

Integral Federated Identity Management for Cloud Computing

Integral Federated Identity Management for Cloud Computing Integral Federated Identity Management for Cloud Computing Maicon Stihler, Altair Olivo Santin, Arlindo L. Marcon Jr. Graduate Program in Computer Science Pontifical Catholic University of Paraná Curitiba,

More information

Single Sign-On: Reviewing the Field

Single Sign-On: Reviewing the Field Outline Michael Grundmann Erhard Pointl Johannes Kepler University Linz January 16, 2009 Outline 1 Why Single Sign-On? 2 3 Criteria Categorization 4 Overview shibboleth 5 Outline Why Single Sign-On? Why

More information

PARTNER INTEGRATION GUIDE. Edition 1.0

PARTNER INTEGRATION GUIDE. Edition 1.0 PARTNER INTEGRATION GUIDE Edition 1.0 Last Revised December 11, 2014 Overview This document provides standards and guidance for USAA partners when considering integration with USAA. It is an overview of

More information

The Primer: Nuts and Bolts of Federated Identity Management

The Primer: Nuts and Bolts of Federated Identity Management The Primer: Nuts and Bolts of Federated Identity Management Overview For any IT department, it is imperative to understand how your organization can securely manage and control users identities. With so

More information

The Top 5 Federated Single Sign-On Scenarios

The Top 5 Federated Single Sign-On Scenarios The Top 5 Federated Single Sign-On Scenarios Table of Contents Executive Summary... 1 The Solution: Standards-Based Federation... 2 Service Provider Initiated SSO...3 Identity Provider Initiated SSO...3

More information