It is I, SAML. Ana Mandić Development Five Minutes Ltd

Transcription

1 It is I, SAML Ana Mandić Development Five Minutes Ltd

2 About Five Minutes We design and develop top notch mobile apps for leading mobile platforms 50 full-time employees Offices in Zagreb, Osijek and New York Privately owned, founded in Platforms we master:

3 SAML SAML - Security Assertion Markup Language SAML addresses the web browser single sign-on (SSO) problem IdP Identity provider SP Service provider OpenID protocol

4 The SAML Use Case

5 OpenAM OpenAM is an open source access management, entitlements and federation server platform History: OpenSSO - announced by Sun Microsystems in July 2005 In February 2010 Oracle completed their acquisition of Sun Microsystems and shortly thereafter removed OpenSSO ForgeRock announced in February 2010 that they would continue to develop and support OpenSSO and renamed the product OpenAM

6 Fedlet Fedlet is a small web application that can do federation in your service provider application with OpenAM acting as the identity provider Redirects to OpenAM for single sign on and retrieves SAML assertions Three ways of integration with Java Web Applications

7 Structure of Fedlet zip conf/ - folder with configuration files which needs to be copied on your server and added to classpath fedlet.war saml2/jsp/ - JSPs to initiate single sign on and single logout, to handle error and for obtaining Fedlet metadata /WEB-INF/classes/ - set of properties files /WEB-INF/lib/ - opensso-sharedlib.jar, openfedlib.jar

8 Fedlet integration Steps to include Fedlet inside your own application: include content from folders: classes, lib and saml2/jsp map saml2 servlets defined in jsps create SAMLAssertionLandingServlet

9 Example of web.xml <servlet> <servlet-name>samlassertionlandingservlet</servlet-name> <servlet-class> eu.fiveminutes.web.servlets.web_samlassertionlandingservlet </servlet-class> </servlet> <servlet> <servlet-name>fedletsloinit</servlet-name> <jsp-file>/jsp/saml2/spsinglelogoutinit.jsp</jsp-file> </servlet> <servlet> <servlet-name>fedletlogout</servlet-name> <jsp-file>/jsp/saml2/logout.jsp</jsp-file> </servlet>

10 Example of SAML response <samlp:response Version="2.0"> <samlp:status> <samlp:statuscode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /> </samlp:status> <saml:assertion> <saml:attributestatement> <saml:attribute Name="id"> <saml:attributevalue xsi:type="xs:string">123</saml:attributevalue> </saml:attribute> </saml:attributestatement> </saml:assertion> </samlp:response>

11 Reading SAML response There is a single object within the Fedlet API that the Service Provider must use to consume the SAML Assertion and retrieve the attributes from it. Class - com.sun.identity.saml2.profile.spacsutils Method java.util.map processresponseforfedlet(httpservletrequest request, HttpServletResponse response) com.sun.identity.saml2.common.saml2constants

12 Configuration files FederationConfig.properties fedlet.cot idp.xml idp-extended.xml sp.xml sp-extended.xml

13 Spring Security SAML Extension The component enables both new and existing applications to act as a Service Provider in federations based on SAML 2.0 protocol and enable Web Single Sign-On. Easy for integration with existing Spring Security in the project by adding custom SAML filter in SpringSecurityFilterChain. SAML configuration files: idp.xml sp.xml

14 Spring Security configuration Base package org.springframework.security.saml Beans samlfilter - org.springframework.security.web.filterchainproxy samlentrypoint - org.springframework.security.saml.samlentrypoint samlwebssoprocessingfilter - org.springframework.security.saml.samlprocessingfilter

15 Spring Security configuration samllogoutfilter - org.springframework.security.saml.samllogoutfilter samllogoutprocessingfilter - org.springframework.security.saml.samllogoutprocessing Filter metadata - org.springframework.security.saml.metadata.cachingmeta datamanager samlauthenticationprovider - org.springframework.security.saml.samlauthenticationpr ovider

16 Spring Security configuration processor - org.springframework.security.saml.processor.samlprocess orimpl beans for bindings, encoders and decoders used for creating and parsing messages

17 User details Configuration for SAMLAuthenticationProvider defines bean that can be used to load user data after SSO Custom class which implements SAMLUserDetailsService and overrides method loaduserbysaml(final SAMLCredential credential)

18 Load Balancer SAML Extension RC2 implements SAMLContextProviderLB Older versions use server instance name which can create a problem in SAML response validation

19 References OpenSSO and OpenAM Spring Security

20 Thank you

21 Contact Ana Mandić Five Minutes Ltd, Development Lead gsm mail skype twitter web