Intro to Federated Identity

Transcription

1 Intro to Federated Identity EuroCAMP Training This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License. 1

2 Lets get a federated identity Do you have access to your ? You ll need a valid address Do you have an account from Protect Network or Twitter You can skip ahead! If not, lets create a Feide OpenIdP Account? Visit Firefox Users: Install SAML tracer add-on 2

3 Feide OpenIdP Click on Register a new user account 3

4 Enter your address 4

5 Check your 5

6 Complete your registration Fill in: User ID Given name Surname (already completed) New password (and Retype new password) 6

7 Success! You now have an account you can use for federated authentication. The OpenIdP is your Identity Provider. 7

8 Lets use our federated identity Complete a federated survey Visit (r T o b W) 8

9 Login with your account This is the Feide OpenIdP (but you could use Twitter, Protect Network or 675 other sites). 9

10 Consent Screen This feature of the Feide OpenIdP tells you about the information you are sending to a service. 10

11 Now complete the survey Secret Survey Questions will be revealed! You can even add a comment. 11

12 What just happened? You visited a Service Provider (SP) Foodle But this service required you to login Then asked to choose a federated account You could have selected from a range of accounts Logged in using an Identity Provider (IdP) Which asked whether you wanted your details sent back to Foodle Returned to Foodle to access the survey 12

13 What just happened? As a diagram 1. Access SP (x) 2. Choose IdP (1) 3. Login 4. Consent 5. Access WARNING: Technical explanation! or skip ahead. Install SAML tracer Firefox Plugin and follow along 13

14 Identity Provider Architecture SAML/Shibboleth v2.x HTTP redirect HTTP interaction DS Shibboleth module x User Agent/Browser Identity Provider Shibboleth service Service Provider SAML2.0 profile: Web browser SSO + HTTP POST binding Initial request from UA to document X No active Shibboleth session, UA redirected to DS 14

15 Identity Provider Architecture SAML/Shibboleth v2.x HTTP redirect HTTP interaction DS SP takes back control Shibboleth module x User Agent/Browser Identity Provider Shibboleth service Service Provider DS asks UA to choose an IdP (if not already set in cookie) Redirect UA back to SP with selected IdP as parameter. 15

16 Identity Provider Architecture SAML/Shibboleth v2.x HTTP redirect HTTP interaction DS Shibboleth module x User Agent/Browser Identity Provider Shibboleth service Service Provider SP sends SAML Authentication request to the IdP. IdP prompts the UA for credentials, if necessary. IdP uses backend to verify credentials (LDAP, ADDS, SQL, etc) 16

17 Identity Provider Architecture SAML/Shibboleth v2.x HTTP redirect HTTP interaction DS Shibboleth module x Identity Provider User Agent/Browser SAML response Authentication statement Attribute statement Shibboleth service Service Provider The IdP resolves and filters the principal s attribute information and constructs a SAML assertion. This assertion can optionally be signed and/or encrypted. Next, the IdP POSTs a response to the SP. 17

18 Identity Provider Architecture SAML/Shibboleth v2.x HTTP redirect HTTP interaction DS Shibboleth module x User Agent/Browser Identity Provider No callback! Shibboleth service Service Provider The Shibboleth service decrypts, verifies and filters the response and gives it to the Shibboleth module (via RPC or TCP). The Shibboleth module or will authorise the principal. 18

19 Identity Provider Architecture SAML/Shibboleth v2.x HTTP redirect HTTP interaction DS Shibboleth module x User Agent/Browser Identity Provider Shibboleth service Service Provider 2 Again, the active sessions with every component will provide the single sign-on experience. 19

20 What s next? I have a federated account? Can I go home? No! Time to build a federated environment for yourself and your organisation. We ll cover: Setting up an Identity Provider Adding modules like Consent Protecting content with a Service Provider Managing the metadata of IdPs and SPs 20