Разработка программного обеспечения промежуточного слоя. TERENA BASNET Workshop, 16-17 November 2009 Joost van Dijk - SURFnet

Разработка программного обеспечения промежуточного слоя TERENA BASNET Workshop, 16-17 November 2009 Joost van Dijk - SURFnet

Contents - SURFnet Middleware Services department: - eduroam, SURFfederatie, DNS, DNSSEC, Certificate Service, honeyspider network, IDS, IPv6, RADIUS, edugain, Mobile PKI, OpenID, CERT,... - Today s topics: - SURFfederatie: Identity Federation for Web Single Signon - eduroam: network roaming - TCS: TERENA Certificate Service 2

Identity Federations for Web Single Sign-on and beyond Joost van Dijk - SURFnet 17/11/2009

What is Federation? 4

Identity Federation - Idea: - Users log in at their Identity Provider (IDP), - using their own credentials, - to access resources at Service Providers (SPs) - Identity Federation components: - (A) technical infrastructure - (B) contracts/policies - (A) can be minimal - (B) is needed for SPs to trust IDPs (and vice versa) 5 - The federation operator (eg. NREN) is a Trusted Third Party

Towards federation Local External Federative DB DB LDAP SP LDAP IDP LDAP SP HTTP SP SAML (HTTP) IDP HTTP B HTTP HTTP B B 6

Demo: google Apps

SAML authn request <AuthnRequest Destination="http://idp.org/sso/SSORedirect/etc" IssueInstant="2008-05-28T20:12:35.971Z" ID="..."... xmlns:saml="urn:oasis:names:tc:saml:2.0:assertion"> <saml:issuer>sp.example.com</saml:issuer>... </AuthnRequest> 8

SAML authn response <Response InResponseTo="..." IssueInstant="2008-06-03T09:46:55.934Z"...> <saml:issuer>idp.example.org</saml:issuer> <Status><StatusCode Value="...:Success"/></Status> <saml:assertion IssueInstant="2008-06-03T09:46:55.947Z"...> <saml:issuer>idp.example.org</saml:issuer> <ds:signature>...</ds:signature> <saml:subject> <saml:nameid...>...</saml:nameid> <saml:subjectconfirmation Method="..."> <saml:subjectconfirmationdata... Recipient="https://foodle.feide.no/simplesaml/saml2/sp/acs.php"/> </saml:subjectconfirmation> </saml:subject> <saml:conditions NotOnOrAfter="2008-06-03T09:51:55.947Z" NotBefore="2008-06-03T09:41:55.947Z">... </saml:conditions> <saml:authnstatement AuthnInstant="2008-06-03T09:46:55.946Z"...>... </saml:authnstatement> <saml:attributestatement...> <saml:attribute... Name="...:displayName"> <saml:attributevalue>joost van Dijk</saml:AttributeValue> </saml:attribute> </saml:attributestatement> 9 </saml:assertion> </Response>

Federation Architecture 1-1 n x n n + n IDP SP IDP SP IDP SP IDP SP IDP SP IDP SP IDP CFC SP 10

IDP Discovery Where are you from? 11

SP Metadata <EntityDescriptor... entityid="http://sp.org/saml2/sp/metadata.php"> <SPSSODescriptor...>... <AssertionConsumerService... Location="http://sp.org/saml2/sp/AssertionConsumerService.php"/> </SPSSODescriptor> </EntityDescriptor> 15

IDP Metadata <EntityDescriptor... entityid="http://idp.org/saml2/idp/metadata.php"> <IDPSSODescriptor...> <KeyDescriptor> <ds:keyinfo...>... </ds:keyinfo> </KeyDescriptor>... <SingleSignOnService... Location="http://idp.org/saml2/idp/SSOService.php"/> </IDPSSODescriptor>... </EntityDescriptor> 16

Federation Metadata <EntityDescriptor... entityid='sfs.surfnet.nl' ID='...'> <ds:signature>...</ds:signature> <SPSSODescriptor...> <KeyDescriptor use='signing'> <ds:keyinfo>...</ds:keyinfo> </KeyDescriptor>... <AssertionConsumerService... Location='https://SP.esample.org/saml20'/> </SPSSODescriptor> <IDPSSODescriptor...> <KeyDescriptor use='signing'> <ds:keyinfo>...</ds:keyinfo> </KeyDescriptor>... <SingleSignOnService Location='https://IDP.example.org/saml20'/> </IDPSSODescriptor> </EntityDescriptor> 17

18 Case study:

SURFfederatie: Identity Providers 19

SURFfederatie: Service Providers 20

Federation Gateway IDP SURFfederation Service SP A-Select Cross A-Select Cross SAML 2.0 Gateway Shibboleth SAML 2.0 WS-Fed / ADFS WS-Fed / ADFS 21

Connections 8 - Federation Protocols - IDP: - SAML 2.0 (5), - ADFS (15), - A-Select (10) - SP: - SAML 2.0 (5), - Shibboleth 1.3 (5), - A-Select (3) - Federation Products - Microsoft ADFS, - Shibboleth (1/2), - A-Select, - Novell Access Manager, - simplesamlphp, - Oracle IdM, - PingFederate

Authentication Redirect Flow web service SP SFS IDP authentication backend browser request auth request SSO 1 request SSO 2 request LDAP/Radius/.. SSO 2 response SSO 1 response auth response access & attributes 23 (C) 2007-2009 SURFnet B.V.

Experiences - Multi-protocol abilities speed up institutional deployment: fits in their home ICT environment (!= JAVA, = Microsoft) - Identity-As-A-Service: service provider issues (metadata updates, attribute release policies) are handled for IDPs - SAML 2.0 implementations are hard (specs/products/ knowledge) -> slow SP take-up - Scalability is ok: up to national level - Trust model of centralized federation is functionally equivalent to distributed federations: federationoperator is TTP (signed responses vs. signed metadata) 11

Future Developments - Web-services (gateway as WS-Trust STS!) - Cross-layer identity (unified SSO) - Identity-as-a-Service extensions - User Centric privacy extensions: user consent - Microsoft Geneva - SURFnet services: OpenID - Confederations: Kennisnet, EduGAIN 12

Key Benefits - For users: - Single Login, Single Sign-on - For IDPs: - use credentials within own domain exclusively - For SPs: - out-sourcing of authentication and authorisation based on pre-established trust 26