Seminar: Security / Identity Management Presentation: Elke Weber WS 09/10 Seminar: Security / Identity Management Single Sign-on Shibboleth Presentation: Elke Weber 01 December 2009

Structure Single sign-on Introduction Pros & Cons Overview Shibboleth Applications, federations Functionality: Single sign-on / Single logout Discussion Summary

What is single sign-on? Access control of multiple, related, but independent software systems User logs in once and gains access to all systems → Single sign-out

Pros & Cons Uniform authentication meachanism Users only have to remind one login name and password Password can be chosen more complex Reduction of costs (easier to maintain) Single Point of Failure (security problems and traffic load) Central storing of personal data (data protection laws) Data tracking

Solutions Central sign-on server e.g. Passwort-Manager, e.g. Yahoo!, MSN(Passport), Central Authentication Servie (CAS) e.g. Passwort-Manager, Microsoft's Identity Metasystem Circle of Trust e.g. Kerberos, Liberty Alliance Project

Single sign-on to multiple services PEP = "Policy Enforcement Point"

Shibboleth Standards based, open source software package for web single sign-on released under the Apache Software License Implements OASIS'1 Security Assertion Markup Language (SAML) Extended privacy functionality allowing the browser user and their home site to control the attributes released to each application → Attribute-Based Access Control (ABAC) 1Organization for the Advancement of Structured Information Standards

Shibboleth The term originates from the Hebrew word "shibbólet" Book of Judges, chapter 12: Gilead then cut Ephraim off from the fords of the Jordan, and whenever Ephraimite fugitives said, 'Let me cross,' the men of Gilead would ask, 'Are you an Ephraimite?' If he said, 'No,' they then said, 'Very well, say Shibboleth.' If anyone said, 'Sibboleth', because he could not pronounce it, then they would seize him and kill him by the fords of the Jordan. Forty-two thousand Ephraimites fell on this occasion.

Shibboleth

Shibboleth Federations universities, companies and government agencies DFN-AAI (Germany) InCommon (US) SWITCHaai (Switzerland) The UK federation Federation Education-Recherche (France) ...

Shibboleth® Enabled Applications and Services Information Providers: American Chemical Society Elsevier ScienceDirect H.W. Wilson National Science Digital Library (NSDL) Online Computer Library Center (OCLC) Schweizerisches Bundesgericht ... Learning Management Systems: Blackboard Moodle OLAT - Online Learning and Training WebAssign WebCT ... Other Systems: DokuWiki Google Apps/Email GridShib Horde Microsoft Napster WordPress ...

Shibboleth Requirements and Specifications No modification of client software Identity Provider (IdP) is written in Java Service Provider (SP) runs in Apache, Internet Locator Server (IIS) or Netscape Server Application Programming Interface (NSAPI) → can be proxied into Java and other web servers Supports the SAML 2.0 Web Browser SSO Profile, Cardspace, Shibboleth Profile, SAML 1.1, LDAP, Kerberos ...

Shibboleth Login Procedure – Simple Overview 1

Shibboleth Login Procedure – Simple Overview 2 wayf-test.switch.ch dukono.switch.ch kohala.switch.ch/secure/ DEMO! Identity Provider Service Provider

Shibboleth Situation Overview

Shibboleth Discovery STEP 2: STEP 3: GET https://wayf-test.switch.ch/SWITCHaai/WAYF ?entityID=https://aai-demo.switch.ch/shibboleth &return=https://aai-demo.switch.ch/Shibboleth.sso/DS?SAMLDS=1&target=cookie STEP 3: POST https://wayf-test.switch.ch/SWITCHaai/WAYF POSTDATA entityID=https://aai-demo.switch.ch/shibboleth return=https://aai-demo.switch.ch/Shibboleth.sso/DS?SAMLDS=1&target=cookie user_idp=https://aai-demo-idp.switch.ch/idp/shibboleth STEP 2: 200 OK [WAYF DROPDOWN HTML PAGE] STEP 3: 302 FOUND (REDIRECT) Location: https://aai-demo.switch.ch/Shibboleth.sso/DS? ?SAMLDS=1 &target=cookie &entityID=https://aai-demo-idp.switch.ch/idp/shibboleth STEP 1: GET https://aai-demo.switch.ch/secure STEP 1: 302 FOUND (REDIRECT) Set-Cookie: _shibstate_64656661756c7468747470733a2f2... value=https://aai-demo.switch.ch/secure path=/ Location: https://wayf-test.switch.ch/SWITCHaai/WAYF ?entityID=https://aai-demo.switch.ch/shibboleth &return=https://aai-demo.switch.ch/Shibboleth.sso/DS?SAMLDS=1&target=cookie

Shibboleth Session initiation and authentication request STEP 5: POST https://aai-demo-idp.switch.ch/idp/profile/SAML2/POST/SSO POSTDATA RelayState=cookie SAMLRequest=PHNhbWxwOkF1dGhuUmVxdWVzdCB4bWxuczp... STEP 4: GET https://aai-demo.switch.ch/Shibboleth.sso/DS ?SAMLDS=1 &target=cookie &entityID=https://aai-demo-idp.switch.ch/idp/shibboleth Cookie: _shibstate_64656661756c7468747470733a2f2... value=https://aai-demo.switch.ch/secure STEP 6: GET https://aai-demo-idp.switch.ch/idp/Authn/UserPassword Cookie: JSESSIONID value=C22C16A197CB9606067A1A577EF5D996 STEP 6: 302 MOVED TEMPORARILY (REDIRECT) Location: https://aai-demo-idp.switch.ch/idp/login.jsp ?actionUrl=/idp/Authn/UserPassword STEP 5: 302 MOVED TEMPORARILY (REDIRECT) Set-Cookie: JSESSIONID value=C22C16A197CB9606067A1A577EF5D996 Path=/idp Secure Location: https://aai-demo-idp.switch.ch/idp/Authn/UserPassword STEP 4: 200 OK [AUTHN REQUEST POST FORM HTML PAGE] STEP 7: GET https://aai-demo-idp.switch.ch/idp/login.jsp? actionUrl=/idp/Authn/UserPassword Cookie: JSESSIONID value=C22C16A197CB9606067A1A577EF5D996 STEP 7: 200 OK [USERNAME PASSWORD LOGIN FORM HTML PAGE]

Shibboleth Authentication, attribute statement and access STEP 9: POST https://aai-demo.switch.ch/Shibboleth.sso/SAML2/POST POSTDATA RelayState=cookie SAMLResponse=PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGl... Cookie: _shibstate_64656661756c7468747470733a2f2... value=https%3A%2F%2Faai-demo.switch.ch%2Fsecure STEP 10: GET https://aai-demo.switch.ch/secure Cookie: _shibstate_64656661756c7468747470733a2f2... value= Cookie: _shibsession_64656661756c7468747470733a2f2... value=_0b6d4e89d2e9c4481738094f2a2c9de0 STEP 8: 200 OK Set-Cookie: _idp_session value=4m2ETlKYtvbNEmBzVNo3UHLuKSdo3HqTUqAmeZiar94= Path=/idp [ASSERTION POST FORM HTML PAGE] STEP 10: 200 OK [RESOURCE HTML PAGE] STEP 8: POST https://aai-demo-idp.switch.ch/idp/Authn/UserPassword POSTDATA j_username=demouser j_password=demo Cookie: JSESSIONID value=C22C16A197CB9606067A1A577EF5D996 STEP 9: 302 FOUND (REDIRECT) Set-Cookie: _shibstate_64656661756c7468747470733a2f2... value= path=/ Set-Cookie: _shibsession_64656661756c7468747470733a2f2... value=_0b6d4e89d2e9c4481738094f2a2c9de0 Location: https://aai-demo.switch.ch/secure STEP 10: # content of secure/.htaccess AuthType shibboleth ShibRequireSession On require valid-user

Shibboleth The whole login procedure

Shibboleth Single Logout 1 SAML2 Single Logout profile IdP-initiated & SP-initiated Logout UI is located in two JSP files: sloQuestion.jsp (logout one/all service providers?) sloController.jsp (session participants, logout status) SLOServlet Rendering the logout question and controller page Initiating logout to one SP Front-channel → browser via HTTP POST or Redirect Back-channel → direct IdP/SP SOAP messages Returning the logout status as a JSON string

Shibboleth Single Logout 2 With javascript: iframe for every active session participant logout request is issued for the given session participant front-channel SAML message exchange logout status: LOGGED_IN, LOGOUT_ATTEMPTED, LOGOUT_FAILED, LOGOUT_UNSUPPORTED, LOGOUT_TIMED_OUT, LOGOUT_SUCCEEDED Without javascript: one link for each session participant → initiate the logout process for that particular SP Logout failed message, Logout succeeded message

Shibboleth Single Logout 3 Security: SAML Single Logout Profile requires the logout requests and responses to be signed or otherwise authenticated Session lifetime: IdP session lifetime must be longer than any SP session lifetime Optional: limit the maximum lifetime of the SP session

Shibboleth – Meets requirements? Easy to implement? Maintenance effort? Data protection? Security? Service provider → trust in identity provider? User → understanding of SSO/SLO concepts? ...

Summary Shibboleth Useful in some szenarios (universities, libraries...) Installing & configuring quite extensive Easy to maintain Participants have to agree on policies, ... Crucial factor: Trust in identity provider!

References Single sign-on: Shibboleth: http://de.wikipedia.org/wiki/Single_Sign-on http://entwickler.de/zonen/portale/psecom,id,101,online,910,p,0.html http://it-republik.de/jaxenter/artikel/Single-Sign-On-Systeme-1499.html Shibboleth: http://shibboleth.internet2.edu/ http://www.switch.ch/aai/demo/ https://spaces.internet2.edu/display/SHIB2/SLOIssues https://wiki.aai.niif.hu/index.php/ShibIdpSLO