Single Sign On In A CORBA-Based

Transcription

1 Single Sign On In A CORBA-Based Based Distributed System Igor Balabine IONA Security Architect

2 Outline A standards-based framework approach to the Enterprise application security Security framework example: IONA Security Framework (isf) Security framework based SSO solutions Summary

3 Why A Security Framework? Security Framework: insulates middleware applications from the diverse and changing enterprise security infrastructures. provides a uniform, vendor-neutral, standards-based approach to communicating security-related requests across the enterprise. provides applications a single access point to multiple security services such as authentication, authorization, SSO, PKI, management, and notification services. Security Framework binds applications with any enterprise security infrastructure!

4 Security Framework vs Super-Directory Enterprise Security Service B Super Directory Enterprise Security Service A APP 1 APP k APP n Intermediate Security Server 1 Intermediate Security Server m Security framework approach avoids performance bottlenecks suffered by a centralized approach such as Super Directory!

5 Security Framework Architecture Request/Response messages over IIOP/http(s): support for distributed and co-located deployments J2EE or WS Application App SF Adapter Security Service (S2) S2 ESS Adapter Native API calls: no changes in the application code! Native API example: EJBContext.getCallerPrincipal() EJBContext.isCallerInRole() Enterprise Security System (ESS) Third party security system native protocol

6 Authentication and Authorization Services Authentication and authorization services are supported via dedicated adapters. Internal protocol: SAML satisfies purposes and allows extensibility. Could be easily replaced if necessary if internal interface in the application SDK is generic. Required authorization models: coarse grain RBAC (e.g. J2EE, Web Services), fine grain DAC (e.g. CORBASEC, B2Bi). SAML protocol allows communicating arbitrary security assertions between applications and the Security Server!

7 PKI Services PKI services are supported via dedicated adapters. Internal protocol: XKMS powerful and extensible. Endorsed by industry leaders (Verisign, Entrust, Microsoft). Common use: integration with certificate stores. Advanced use: certificate validation services. Many PKI vendors are expected to adopt XKMS: in such installations S2 PKI adapter becomes (almost) a pass through!

8 Framework Administration Solutions integrated with 3rd party systems are managed using native administrative tools, e.g. SiteMinder console for an enterprise which uses Netegrity SiteMinder. Framework provides out of the box facilities for Single Sign- On and authorization (RBAC and DAC) services for environments devoid of such functionality, e.g. Windows Domain. Framework Auditing Component co-located with the Security Server (S2) provides logs in standard formats (syslog, NT Event Log, Snort) easily consumable by event monitoring systems. Framework offloads administrative tasks to 3rd party tools where possible and provides components to manage custom security information!

9 Single Sign-on and End-to to-end Security Auth. tokens are passed in http header or in SOAP message SSO: User seamlessly logs into multiple services after authenticating once to Enterprise Security System via is2 Web Service J2EE application server Realm A Realm B S2 SSO facility Realm C CORBA middleware application Security Server A2 Adapter E2E Security: Services validate authentication tokens with is2 and receive fine grain user authorization information Realm D Enterprise Backend System, e.g. UNIX Servers Enterprise Directory, e.g. RACF Auth. tokens are passed in CSI v2 context

10 Crossing The Chasm S2 Az Manager S2 SSO Facility A2 Adapter Alice Credentials 1,000,000 users Web Services Gateway Authenticate + Authorize User=Alice URL= GetInfo J2EE application server Realm B Enterprise Security System, e.g. Netegrity Authorize User=Alice action= Get info Authorize Authorize Security Server B CORBA middleware application Realm C Sys101 action= Get info origin= Alice Security Server A A2 Adapter Authorize ~100 Technical accounts Realm D Enterprise Backend System, e.g. OS/390 Enterprise Security System, e.g. RACF

11 Framework Scalability and Fail-over Authentication Token structure: { issuer id, [backup id,] <unique value>} m,n Authorization Interceptor This interceptor is configured to access is2 instance k Session info is replicated upon session creation m,n Primary m,n 1 is2 m is2 k Backup is2 n m,n 2 Authorization Info Security framework clustering schema guarantees that principal s authorization information is no more than two hops away!

12 Security Platform Example: IONA Security Framework (isf)

13 IONA Security Framework Components Custom Application, Web Service, Application Server - provided by IONA - optionally provided by IONA - custom component Orbix E2A, XMLBus, Orbix E2A J2EE Server Product specific adapter IONA C/C++ SAML/XKMS Library Product specific adapter IONA Java SAML/XKMS Library Product specific interface example: EJBContext.getCallerPrincipal() EJBContext.isCallerInRole() 3 rd party A2 system adapter: Netegrity, Windows Domain, LDAP, Evidian, etc. To Au+Az system IIOP Interface IONA Security Server (is2) SAML/A2 adapter A2 System Adapter http/https Interface IONA ART or App Server XKMS/PKI adapter PKI System Adapter 3 rd party PKI system adapter: Entrust Authority, Baltimore, Verisign, etc. To PKI system

14 Optional is2 Components - provided by IONA - optionally provided by IONA - custom component IONA ART or App Server IONA Security Service iazmgr Facility SSO Facility is2 Adapter Optional: Implements Role Based Access Control model Optional: Provides session management functions Interacts with Enterprise Security Service isf provides optional built-in components which augment the existing ESS functionality or provide mechanisms absent in the existing ESS!

15 Single Sign On (SSO) Facility Provides session management features to is2 client applications. Issues authentication tokens which clients can use for subsequent access to the services provided by is2 client applications. Authentication token is valid for a certain period configured by SysAdmin. Authentication token expires if idle period between two subsequent service requests exceeds maximum configured by SysAdmin. is2 SSO facility provides single sign on functionality across Enterprise security domains!

16 is2 Authorization Manager iazmgr keeps information which supports implementation of the Role Based Access Control (RBAC) model by IONA or third party products. iazmgr stores information about Principals, Roles and privilege scopes called Realms. iazmgr answers a simple question: Which Roles are assigned to this Principal in a given Realm? iazmgr database of Principals, Roles and Realms is stored in an abstract repository accessed via JDBC. iazmgr keeps authorization information in environments devoid of robust authorization facilities such as Windows Domain!

17 iazmgr Feature: Scoped Roles Realm HR Engineering Accounting Role Employee Manager Administrator Operator Principal Alice Bob Carol Alice HR: Employee Accounting: Manager isf implements a superset of the proposed NIST RBAC standard compatible with the J2EE requirements!

18 isf Adapter Example: OS/390 SAF passwd(name, pwd, null) SAML(name, pwd) is2 check_resource_auth_np() Invoke for the FACILITY class and all known ISF.xxx.yyy resources to determine a subset available to the user. In the FACILITY class use resource id syntax: ISF.<realm>.<role> Example: ISF.FINANCIALAPP.CLERK OS/390 (z/os) OS/390 SAF adapter SSL(IIOP( OK +AzInfo)) SSL(IIOP(name, pwd)) SAF RACF/ ACF2 SAF CORBA client List of isf.*.* resources SAF CORBA server A smart isf adapter allows to use RACF as a RBAC repository!

19 Putting It All Together First invocation: user credentials are passed, e.g. Alice:secret Alice Server implements a credential collector which passes client credentials to isf via the exposed is2 Client SDK interface Authorization: 1. Server maintains a table which maps requested actions to authorizations ( roles ) 2. Server queries the AuthenticatedPrincipal interface provided by isf to determine if the Client possesses a necessary role ( iscallerinrole ). Security Aware Client-side Component Security Aware Server-side Component Next-tier Service Server sends back session authentication token received from isf SSO: Client passes session authentication token for all subsequent invocations or Opaque isf Cloud is2 Client SDK Library is2 Server isfassertionprovider interface End-to-end security: Server propagates Client s session authentication token when delegating the task to the next tier service To Authn + Authz System (3 rd party)

20 Security Framework Based SSO Solutions

21 A Spanish subsidiary of a Swiss Insurance Servlet EJB application Authenticate: Alice Alice is OK! Session token = T(W) Security Platform Server AA Adapter S EJB-Authorization per request iscallerinrole, getcallerprincipal Enterprise Security Store SunOne LDAP

22 Deployment with isf Accessibility list: S11: role1, role2, S2n: role1, role5, {S1} Bank Specific Svc Locator CORBA Services 2 Client Application IIOP Firewall Transport: IIOP only! Maintains a list of available services and makes access control decisions 3 Requests service Optional: Routes authenticated Client s requests and redirects requests without authentication tokens to the Authentication Service. Authenticates clients and caches authorization data 1 Authentication Service is2 is2 CORBA Services {S2} is2 Competence System Adapter Competence Domain 1 A collection of services which requires authorization from CD1 ESS 1 Authorization Interceptor ESS 2 RACF Policy Enforcement Point: ASP CORBA enforces access control to CORBA services Competence Domain 2 A collection of services which requires authorization from CD2

23 SSO For CORBA Clients org.omg.securitylevel2.principalauthenticator.authenticate(, userid= Alice, pass= secret, ) Alice CORBA Login Server Alice, secret 3 1 CORBA Client C O2K CSI v2 plug-in 2 <AT> 5 <AT>, SSO Token 4 LoginUP.login( Alice, secret ) Login.login(<token>) LoginSSLCert.login() CORBA Server S O2K CSI v2 plug-in <AT> 6 To is2 and Authz System isf remedies CSI v2 deficiencies and provides a robust SSO solution for CORBA applications!

24 A Government Agency Requirements: Use Kerberos credentials to authenticate and authorize requests to non-kerberized services Support secure invocation of Kerberized services by non- Kerberized CORBA applications using delegated Kerberos credentials Solution: Use CSI v2 context for transmitting Kerberos service request tokens Use isf to authorize Kerberos users for invoking non-kerberos services

25 Government Agency Deployment Kerberos KDC Kerberos TGS Servers S1 and S2 are registered with Kerberos Alice Kerberos Client (GSS API) Delegated credential (Proxy STkt or TGT) Another Kerberos Service CORBA Client C O2K CSI v2 plug-in Authorization info Alice s delegated Kerberos credential LDAP CORBA Server S1 O2K CSI v2 plug-in is2 Alice s delegated Kerberos credential CORBA Server S2

26 Big Telco is2 Az Manager is2 SSO Facility A2. Adapter Alice Credentials 1,000,000 users User=Alice URL= GetInfo Web Services Gateway Authenticate Web Service J2EE application server Realm B Enterprise Security System, e.g. Netegrity Authorize Realm A User=Alice action= Get info Authorize Authorize Realm C Middleware application IONA Security Server A A2 Adapter IONA Security Server B Authorize Sys101 action= Get info origin= Alice Realm D Enterprise Backend System, e.g. OS/390 Enterprise Security System, e.g. RACF ~100 Technical accounts Map id

27 Summary - Security Platform benefits Security Framework approach provides applications a robust integration broker layer with Enterprise wide security services. Framework based architecture is flexible and allows integration with diverse security solutions from Windows domain to OS/390 RACF. Security framework covers important aspects of security such as authentication, authorization, SSO and PKI services.

28 Additional Information IONA Security Framework (isf) and its application to providing security services to J2EE, CORBA applications and Web Services is described in the Orbix E2A Security white paper. You may download it at