Implementing secure SSO! with OpenSAML

Transcription

1 Implementing secure SSO! with OpenSAML Barcelona, November 2013 Jan Alfresco #SummitNow

2 Quick intro Jan Vonka Senior Software Alfresco Core Repository Cloud & Hybrid Services Fly balloons

3 Contents SAML overview SAML configuration & flows Using OpenSAML Alfresco implementation Futures? Quick recap

4 SAML: Overview

5 Identity

6 Identity Management Access authentication & authorisation Federation partnership & trust Provisioning user lifecycle Governance risk & compliance

7 Security Assertion Markup Lang! SAML is an XML-based open standard from OASIS for exchanging authentication and authorization data for example to enable web-based (browser) multi-domain SSO between parties; User, Identity Provider & Service Provider

8 Some Abbreviations IdP Identity Provider SP Service Provider CoT Circle Of Trust PKI Public Key Infrastructure SAML Security Assertion Markup Language SSO / SLO Single SignOn, Single LogOut HTTPS HTTP over SSL/TLS

9 Key Use-Case SSO + SLO Login to one or more apps Use Alfresco to Put Your Content to Work J Logout - from (all) apps Variation deep linking Access SP resource link (eg. bookmark, in ) If not already SSO ed then follow above

10 SSO example IdP-initiated SSO SP-initiated SSO Login IdP DS SAML Assertion DS IdP SAML Assertion SP SAML Auth request SP LI LI Login entrypoint (or access SP resource) #SummitNow #SummitNow

11 SSO example! Centrify & Alfresco partner to bring Cloud and Mobile SSO to Business Content Solutions h)p://

12 Who uses SAML? (some OASIS members)

13 Who uses SAML? (more examples)

14 SAML v2.0 overview Convergence OASIS standard ref [1] Executive/Technical overviews

15 Anatomy of SAML Profiles eg. Web Browser SSO / SLO, (pp66) Metadata (pp43) Bindings eg. HTTP Post, (pp46) Core (Assertions & Protocols) (pp86) Authn Context (pp70) Glossary (pp16) Conformance (pp19)

16 SAML: Configuration & flows

17 Configure Circle of Trust IdP metadata (Public Key) Certificate SSO/SLO urls IdP asserting party (SAML authority) SP relying party (SAML consumer) SP metadata (Public Key) Certificate SSO/SLO urls Federated Identity ( attribute)

18 Example IdPs (*) (*) not exhaustive & not necessarily supported by Alfresco

19 SAML connection (Cloud Ent) IdP- N3 IdP- N5 N1 N2 N3 N4 N5 mul$- tenant SaaS

20 Web Browser SSO (SP-initiated) SP Client IdP 2. Generate SAML auth request (with optional RelayState) 1. User requests SP resource 3. Post to IdP SSO URL Browser 5. Authenticate 4. Parse (& verify) SAML auth request 8. Parse (& verify) SAML assertion Assertion Consumer Service 9. User is logged in 7. Post to SP SSO (ACS) URL 6. Generate SAML assertion (auth response) & return RelayState (if supplied)

21 Web Browser SLO (SP-initiated) SP1 Client IdP 2. Generate SAML logout request 1. User requests SP1 logout 3. Post to IdP SLO URL Browser 4. Verify SAML logout request 12. Parse (& verify) SAML logout response SP2 SPn 7. Parse SAML request, logout of local session & generate SAML response 13. User is logged out 6. Post to SP SLO URL (repeated for all session participants ) 11. Post to SP SLO URL 5. Generate SAML logout request 8. Post to IdP SLO URL 9. Verify SAML logout response) 10. Generate SAML logout response (& send to originating SP)

22 SAML: Using OpenSAML

23 What is OpenSAML? open source library (Java or C++) produce & consume SAML messages create & validate digital signatures generate & parse SAML metadata warning: read the FAQ - see ref [2]

24 OpenSAML - metadata IdP Open SAML SAML metadata (SP) Open SAML SP SAML metadata (IdP) log4j.logger.org.opensaml=debug

25 OpenSAML metadata Public Key Certificate SSO/SLO service URLs Attribute(s)

26 OpenSAML messages IdP Open SAML SAML messages (HTTP POST) - SSO request / response - SLO request / response Open SAML SP - (digitally sign & validate) log4j.logger.org.opensaml=debug

27 HTTP Post Binding Content-Type: application/x-www-form-urlencoded eg. name1=value1&name2=value2&name3=value3 Auth request (+RelayState) Assertion (+ RelayState)

28 OpenSAML SSO messages Authn request Signature Authn response Assertion / Signature(s) NameID / Attr(s) ~ Session Index

29 OpenSAML SLO messages Logout request ID Signature Session Index Logout response In Response To

30 Use a test IdP eg. OpenAM OpenAM Open SAML SP

31 SAML: Alfresco implementation

32 Alfresco Implementation SSO but not as we know it J no SSO trusted header (remote user) or External Auth mode multi-tenant per-enabled Enterprise Network Share acts as pass-through for encoded/signed messages Expose new trusted Repo API (via OpenSAML) rely on SAML / PKI => Circle of Trust decode & validate digitally-signed message ( assertion ) extract subject/principal =>

33 Alfresco SAML connection setup see ref [3]

34 Alfresco JIT user provisioning If user does not exist yet then auto-provision Just In Time IdP-initiated SAML assertion (new userid) allow user to complete profile page & activate

35 Alfresco SAML SSO / SLO IdP Share Alfresco SP Repo SSO Req (SP-init): JSON: SSO Resp (SP/IdP-init): userid, sessionindex JSON: userid, ticket, sessionindex OpenSAML SLO Req (SP-init): sessionindex JSON: sessionindex SLO Resp: userid SLO Req (IdP-init): userid SLO Resp: userid JSON: userid userid 35

36 SAML: Futures?

37 Futures: Enterprise SAML? Alfresco OnPremise SSO using SAML? In theory, yes re-purpose code for Enterprise stack(s) allow configurable NameID / Attribute Share Admin (-> Repo Admin?) please contact us with your feedback J

38 Other futures (*) Allow IdP metadata to be imported Disable non-saml logins Extract more Attributes (eg. profile info) Identity Mgmt API (eg. SCIM v2 wip??) Mobile / Desktop apps (eg. SAML+OAuth) (*) caveat: speculaove, non- exhausove

39 SAML: Quick recap

40 In summary SAML is a mature OASIS standard Configure circle of trust between SP & IdP by exchanging metadata certs & urls OpenSAML provides library to implement Web Browser Profile for SSO & SLO Available now

41 References [1] OASIS SAML v [2] Shibboleth OpenSAML [3] Alfresco managing SAML SSO

42 Thank you Questions?

43 #SummitNow