InCommon Affiliate Webinar Series

Transcription

1 InCommon Affiliate Webinar Series Aegis Identity Case Study: Just-in-Time Provisioning and IDP Proxy Management November 19, 2014

2 CASE STUDY IN JUST-IN-TIME PROVISIONING AND IDP PROXY MANAGEMENT Jim Faut Director of Software Development Ames Fowler Solutions Engineering and Support

3 CREATE A MECHANISM TO ALLOW AN ORGANIZATION TO PARTICIPATE IN A FEDERATION WITH LOW BARRIER TO ENTRY AND DATA PRIVACY CONTROL The problem

4 Organization a IdP App A Organization b IdP App B Organization c IdP App C Common Edu Data Repo Local Repos of Identity Data BEFORE Federation Agreements - Legal (data use & Persistence) - Technical (metadata) Local Repos of Identity, Edu & PII Data

5 Individual organizations have to stand up their own IdPs Stand up and configure IdP (i.e Shibboleth) Acquire meta data from federation or SP directly if published Configure attribute contract and connectivity Resolve certificate issues Agreements must be unified between IdPs and SPs Potential for multiple IdP <> SP configuration SLOW ADOPTION

6 Organization a App A Organization b IdP App B Organization c App C Common Edu Data Repo Local Repos of Identity Data (DBs, Directories) Proxy IdP with real time provisioning with federation registration -data -legal DESIRED SOLUTION Local Repos of Identity, Edu & PII Data

7 No changes to business processes Control at the organization Centralized agreement Option for SP / IdP individual agreement adoption Stand up a single IdP so Organizations don t have to invest in deployment Pre-loaded metadata and certificate trust A common standardized assertion and attribute definition RAPID ADOPTION AND VALUE

8

9 Dynamic IDP Authentication Sequence Dynamic IDP User Service Provider Shibboleth Trident MySQL Organization Redirect to IDP for Authentication Display login form Enter Username and Password Retrieve Tenant config using OrgDN Return tenant config Query for tenant config Return tenant config Authenticate User against user's organization repository Login Success IDP PROXY SEQUENCE Dynamically building the assertion Initiate Trident User Synch Query User Attributes from AD User attributes Write attributes to DB Attributes Retrieved From Trident AuthN success Success ** edu_person_affiliation, ** edu_person_org_dn, ** edu_person_org_unit_dn, ** edu_person_primary_org_unit_dn ** edu_person_principal_name ** edu_person_entitlement Retrieve eduperson Attributes Return eduperson Attributes** Create SAML Assertion with SAMLResponse Requested application returned to user

10 Dynamic IDP Authentication Sequence User Service Provider Shibboleth Dynam IDP PROXY SEQUENCE Dynamically building the assertion 302 Redirect to IDP for Authentication Display login form Enter Username and Password Retrieve Te using

11 Dynamic IDP Shibboleth Trident MySQL IDP PROXY SEQUENCE Dynamically building the assertion Retrieve Tenant config using OrgDN Return tenant config Query for tenant config Return tenant config

12 Dynamic IDP hibboleth Trident MySQL Organization IDP PROXY SEQUENCE Retrieve Tenant config using OrgDN Return tenant config Query for tenant config Return tenant config Dynamically building the assertion Authenticate User against user's organization repository Login Success Initiate Trident User Synch Query User Attributes from AD User attributes Write attributes to DB Success AuthN success

13 FEDERATION REGISTRATION Register your Organization

14 FEDERATION REGISTRATION Register tenancy with the IdP proxy and define authentication repository

15 FEDERATION REGISTRATION Approval confirmation and notification

16 FEDERATION REGISTRATION Operator approvals

17 FEDERATION REGISTRATION Multiple auth sources available

18 FEDERATION REGISTRATION Defining attributes based on the eduperson schema subset

19 IDP PROXY SEQUENCE SP registration

20 IDP PROXY SEQUENCE SP registration requested attributes terms of use

21 IDP PROXY SEQUENCE SP Summary

22 Organization a App A Organization b IdP App B Organization c App C Common Edu Data Repo Local Repos of Identity Data (DBs, Directories) Proxy IdP with real time provisioning FUTURE: RICH PROVISIONING Local Repos of Identity, Edu & PII Data

23 InCommon Affiliate Webinar Series Aegis Identity Case Study: Just-in-Time Provisioning and IDP Proxy Management November 19, 2014