S P I E Information Environments Shibboleth and Its Integration into Security Architectures. EDUCAUSE & Internet 2 Security Professionals Conference

Transcription

1 Shibboleth and Its Integration into Security Architectures Christian Fernau, Francisco Pinto University of Oxford EDUCAUSE & Internet 2 Security Professionals Conference Denver, CO April :47:29 1

2 That's the University Slide 16:47:30 2

3 Overview Introducing the SPIE Project Integrating Shibboleth into Applications Demos of Applications using JAAS Integrating ARPs into Applications Demo of SP-side ARP Using Privilege Management with Shibboleth Demo using PERMIS 16:47:32 3

4 Introducing the SPIE Project Overall Aim...investigate seamless authentication and authorisation access across information environments Oxford: Institutional Context Access to Local and Remote Protected Resources Integration with Local Infrastructure Integration with Institutional Applications 16:47:33 4

5 Approaches of Integrating Shibboleth 1.3c (Java & C-SP) Using a Filter (mod_shib, shib-filter) Using Attribute Assertions in the Application the Application's Security Framework the Application Server (container-level) any combination of the above 16:47:35 5

6 Filter approach (string matching URLs) A user Request And/or a Username/Attribute edupersonscopedaffiliation staff@test.edu etc. Is matched with a String require affiliation staff@test.edu staff@other.edu... Or a Regular Expression require affiliation ~ ^staff@.+\.edu$ string match 16:47:36 6

7 Filter approach (using URLs) Internet user entitlement: library :47:37 7

8 Filter approach (using URLs) if (entitlement:library) allow /library* Internet user entitlement: library string match :47:39 8

9 Filter approach (using URLs) if (entitlement:library) allow /library* Internet user entitlement: library string match :47: bypass filter 9

10 Filter Approach (Greyhound Racing) User Tom maxiumbet: 500 etc. if (maxiumbet:500) allow /placebet?amount=500 if (maxiumbet:500) allow /placebet?amount=499 if (maxiumbet:500) allow /placebet?amount=498 if (maxiumbet:500) allow /placebet?amount=497 etc. 16:47:42 10

11 Filter Approach Good for protecting Static Data or for messy webapps you don't want to touch But Easy to make mistakes in matching rules Not appropriate for protecting dynamic content Difficult to integrate with Privilege Management 16:47:44 11

12 Using Attributes in the Application User's name (and attributes) checked against application's security configuration configuration has to be done (machines * applications) times difficult to maintain and change 16:47:45 12

13 Using attributes in the application Attribute assertions Identity Management Application 16:47:46 13

14 Example for Application-based Security Login using University card barcode 16:47:48 14

15 Example for application-based Gives access to restricted facilities Using SQL db for authz security SQL 16:47:49 15

16 Using Attributes in the Application's Security Framework Application Identity Management Framework's API Security Framework shib krb5 ldap... 16:47:51 16

17 Using attributes in the application's security framework 16:47:53 17

18 Using Attributes in the Application's Security Framework 16:47:55 18

19 Using Attributes in the Application Server Apps can use container's API App 2 Application App n Container's API Identity Management Container's Security Framework shib krb5 ldap... Application Server / Container 16:47:57 19

20 Using Attributes in the Application Server (example Servlet-API) 16:47:59 20

21 Using Attributes in the Application Server (example Servlet-API) 16:48:01 21

22 Summary of Application Integration System Management Tools / smaller Apps directly use attributes in code authz rules hardcoded, changes difficult security and applications concerns difficult to separate Larger apps (portals, weblearn,...) typically make use of a security framework often can be shibbolized with no or very minor 16:48:03 changes 22

23 Our approach to integrate Java Applications with Shibboleth Create a reusable security module that can be used with existing applications Store Attribute Release Policy together with user attributes in a LDAP directory Allow users to change their ARPs (currently simplistic jsp-based GUI) Allow applications to request changes to the ARP and attributes 16:48:04 23

24 Shibboleth Java integration with SpieJaas In Java, the security modules typically rely on JAAS JAAS is a Java standard for pluggable security modules 16:48:05 Identity Management App 2 Application App n Container's API Container's Security Framework Application shib krb5 Server ldap / Container... Legend Security Module (JAAS) 24

25 Shibboleth Java integration with 1-6) Normal Shibboleth protocol run 7) User's attributes sent to SpieJaas module 8) Normal login request sent to application 9) User is logged in using Shibboleth SpieJaas 16:48:07 25

26 SP-side ARP editor 16:48:08 26

27 WARP(e) Webservice ARP (e)ditor 16:48:10 27

28 WARP(e) Webservice ARP (e)ditor Very simple WebService API Uses Shib-resolver for read access All (future) attribute plug-ins can be used Uses JNDI for write access LdapArpRepository plug-in creates ARP on the IdP 16:48:12 28

29 N-Tier authn with Shibboleth 1.3 Shibbolize an AuthN System, not the Application login Shib create ticket CAS App 1 currently working to do the same with WebAuth (Kerberos) App 1 App 1 16:48:13 29

30 Open Problems How can the application talk-back to the security services (e.g. request higher assurance level) 16:48:15 30