Networks ∙ Services ∙ People Jean Marie THIA GN4-1 Symposium, Vienna A case study GÉANT AuthN / AuthZ 9 march 2016 Solutions Architect - CNRS

Networks ∙ Services ∙ People SharePoint authN & authZ principle Item STS People Picker SharePoint Custom claim provider ti* Bob needs access to a SharePoint item Alice gives Bob access with a claim Alice sets authorizations with the people picker. A custom claim provider makes the picker behave the way we want. The Secure Token Service handles authentication, claims definition and provider declaration.

Networks ∙ Services ∙ People Roles Repositories Roles Repositories Roles Repositories Roles Repositories 3 The puzzle Item STS People Picker ADFS IdP Directory Roles Repositories Roles Repositories Does that claim value exist for this claim type ? Give me all the roles For this identity SharePoint SAML attributes My Claims OID are transformed to claim type. 2.Claims augmentation with attribute stores. 1.OID are transformed to claim type. 2.Claims augmentation with attribute stores. Custom claim provider ti* * ti = Trusted Identity Token Issuer Authorise access to the selected claim type and value Claim values are only checked when using a custom claim provider. 1 2

Networks ∙ Services ∙ People 4 A view of GÉANT intranet Grouper LDAP IdP ADFS SAML attributes My Claims Sympa CoManage User is enrolled prior access SharePoint Custom claim provider ti*

Networks ∙ Services ∙ People Handles authentication Talks SAML 1.1 (WS-Federation) only Needs a Trusted Identity Token Issuer Needs a gateway to SAML 2 (ADFS) Lives inside SharePoint Security Token Service (STS)

Networks ∙ Services ∙ People Gateway for SAML2 -> SAML 1.1 Atribute ID to Claim Type mapping Realm Home Discovery (WAYF) Claims augmentation SILA script to automate federation metadata loading (IdP) the RHD Page refresh Claim type mapping Sila.codeplex.com New branch for adfs3 CNRSrhd.codeplex.com for ADFS3 UI 6 Active Directory Federation Service (ADFS)

Networks ∙ Services ∙ People Claims augmentation with attribute store LDAP Grouper CoManage SQL … 7 ADFS – Attribute store

Networks ∙ Services ∙ People Claim pipeline Claim Engine Retrieve AD group sample 8 ADFS – Claims rule language

Networks ∙ Services ∙ People Open source project In production Still need work CNRSccp.codeplex.com Lookup in LDAP SQL Grouper (VOOT) Must be configured in the token issuer 9 Custom Claim Provider : CNRSccp

Networks ∙ Services ∙ People Projects sila.codeplex.com : federation medata loading in ADFS CNRSrhd.codeplex.com : ADFS 3 UI tweak for autocomplete IdP selector CNRSccp.codeplex.com : Custom claim provider CNRSgaas.codeplex.com : Grouper attribute store for ADFS CNRSlas.codeplex.com : Ldap attribute store for ADFS jmITnotes.wordpress.com 10 Takeaway links

Networks ∙ Services ∙ People Thank you Networks ∙ Services ∙ People This work is part of a project that has received funding from the European Union’s Horizon 2020 research and innovation programme under Grant Agreement No (GN4-1). 11

Networks ∙ Services ∙ People Thank you Networks ∙ Services ∙ People 12