The Challenges of Web single sign-on

Size: px

Start display at page:

Download "The Challenges of Web single sign-on"

Coleen Gilbert
8 years ago
Views:

1 Serge Vereecke Security Architect IBM Security Services The Challenges of Web single sign-on GSE Event September 7, 2012

2 Agenda Single sign-on technology Why single sign-on Challenges of single sign-on Technology journey of SSO SSO use case Lessons learned Summary

3 Single sign-on technologies Single sign-on Goal of SSO Technology failed to live up to consumer expectations

4 Single sign-on technologies Terminology & synonyms Definition & properties

5 Single sign-on : user perspective BEFORE Access Manager Security Services AFTER Unified policy SSingle user registry Centralized audit and other J2EE Figure 1. Unified, Policy-Based Security for the Web 5

SSingle user registry Centralized audit and other

6 Single sign-on : IT perspective 6

7 Single sign-on technologies Classes of SSO

8 Technology shifts Technology shift impact on SSO

9 SSO Technology journey Kerberos technology

10 SSO Technology journey Web access management technology

11 SSO Technology journey Federated Identity technology

Scenario: Provide Federated SSO to employees and customers, using internal and partner applications Customers Existing Web Access Management Solution Employee Portal Travel Services Provider 401K

12 Scenario: Provide Federated SSO to employees and customers, using internal and partner applications Customers Existing Web Access Management Solution Employee Portal Travel Services Provider 401K Federated Identity Management (e.g. TAMeb) Portal Server Customer Portal Billing Processing We all use this everyday! Tax/Salary information Education Financial/401K/Benefits Travel Bookings Regional Insurance Providers

13 SSO Technology journey Web services technology

SSO Technology journey Policy 1. Get Token Security Token Service Policy Security Token Claims Requestor 3. Validate Token Claims Security Token 2.

14 SSO Technology journey Policy 1. Get Token Security Token Service Policy Security Token Claims Requestor 3. Validate Token Claims Security Token 2. Send Message (including token) Provider Policy Security Token Claims Identity Federation and Web Services requires trust This trust is based on agreements between partners & expressed as policies Trust can be enabled by technology Trust requirements expressed as infrastructure policies and requirements Security tokens include identity information; Cryptographic keys used to sign Security Tokens Technology needs to be standards based Standard ways to express and exchange policies that reflect trust relationships Agreed token format, information content, signing and encryption methods

as policies Trust can be enabled by technology Trust requirements expressed as infrastructure policies and requirements Security tokens include identity information; Cryptographic keys

15 SSO Technology journey User centric identity technology

16 OAuth What is it? User wants to share information (Resource Owner) OAuth Service Provider Provides Access based on Resource Owner s authorization User wants to access information (Consumer or Client) Delegated Authorization for enabling the sharing of information

Provider Provides Access based on Resource Owner s authorization

17 OAuth What is it? Delegated Authorization for enabling the sharing of information

18 SSO Technology journey

19 Customer example: Securing access and SSO to banking applications

20 Customer example: Securing access and SSO to banking applications

21 Customer example: Securing access and SSO to banking applications

22 Customer example: Securing access and SSO to banking applications TAMeB WebSEAL server Proof of server identity User identity Credential Proof of server identity Credential WebSphere Application Server Web Authenticator Java Subject PDPrincipal Credential Build credential Forwarded request Credential Proof of server identity Credential PDPrincipal Java Subject ETAI Validate origin Return identity

Customer example: Securing access and SSO to banking applications Browser WebSEAL instance LRR application (SharePoint 2010) Request Need to Local Response

23 Customer example: Securing access and SSO to banking applications Browser WebSEAL instance LRR application (SharePoint 2010) Request Need to Local Response Redirect to Local Response Redirect URL handler.aspx?tam_op=value?macro=value Request to Local Response Redirect URL Generate page Response

24 Customer example: Securing access and SSO to banking applications

25 SSO Architecture - TAI++ Web Application TAI++ Web Application User management system HTTP(S) TAM WebSEAL HTTP(S) EAI TFIM STS SharePoint 2010 Browser TMRP++ STS 25

26 SSO use case : lessons learned

27 Scenario: Securing access to SaaS and Services in Cloud SMB A FIM BG Enterprise B FIM BG SAML SAML Google Apps Partners/Consumers Merged Companies Application Providers Tivoli Federated Identity Manager Single Sign On to Salesforce.com CRM resources based on authentication to the enterprise directory only Access Salesforce.com CRM resources in context and based on web & launch points (providing the user with seamless navigation across applications)

28 Summary

29 Questions?

Securing WebFOCUS A Primer. Bob Hoffman Information Builders

Securing WebFOCUS A Primer. Bob Hoffman Information Builders Securing WebFOCUS A Primer Bob Hoffman Information Builders 1 Agenda Gain an understanding of the WebFOCUS Architecture Where can security be implemented? Review the internal WebFOCUS repository and resource