Fondation RESTENA euroCAMP 04 April 2006 SAML 1.1 and its uses in eduGAIN Stefan Winter <stefan.winter@restena.lu>

Outline SAML 1.1 overview Abstract operations vs. SAML profile Abstract operations: changes since Architecture document SAML 1.1 + eduGAIN profiles general parts (common in all Request / Response) Authentication Home Location Service Attribute Exchange Authorisation

SAML 1.1 Overview XML Schemas for SAML Protocol (exchange of SAML messages) SAML Assertions (information about entities) Rules to use Schemas semantically correct thorough definition of Authentication assertions (NOT the authentication process itself!) Attribute statements Authorisation statements SAML-the-language by itself doesn't do anything for you – you need to fill it with life

Abstract Operations vs. SAML profile eduGAIN Architecture Document (GEANT2 DJ5.2.2) defined a set of abstract operations four services: Authentication assertions Home Location Service Attribute assertion exchange Authorisation assertions generic enough to be mappable to a variety of underlying protocols mapping to SAML 1.1 profile only one “instantiation” of the abstract operations

Abstract Operations Changes since DJ5.2.2 Authentication optional credential transport: defined, but is not going to be used to implement, major changes in SAML 1.1 would be necessary → not implemented Attribute Exchange defined Shibboleth-compatible and extended mode extended mode weakens trust model → only Shib mode used Authorisation Service still questionable: support “Recipient” abstract op?

SAML 1.1 Profiles general parts (Request) AO: RequestID required by SAML 1.1 <Request RequestID MajorVersion MinorVersion IssueInstant> 0..n <RespondWith> <Signature> <Query> - XOR - <SubjectQuery> <AuthenticationQuery> <AttributeQuery> <AuthorizationDecisionQuery> <AssertionIDReference> <AssertionArtifact> type of service

SAML 1.1 Profiles general parts (Response) <Response ResponseID MajorVersion MinorVersion IssueInstant InResponseTo Recipient> <Signature> <Status> AO:ResponseID AO:InResponseTo <StatusMessage> <StatusDetail> <StatusCode Value=”...”> <StatusCode Value =”...”> SAML: Success, Requester, Responder <Assertion MajorVersion MinorVersion AssertionID Issuer IssueInstant> AO: additional Data <Conditions> <Advice> <Signature> <Statement> - XOR - <SubjectStatement> <AuthenticationStatement> <AuthorizationStatement> <AttributeStatement> Success: AO Interfaces Req | Resp: AO errorMessage 1..n Success: AO Result Req | Resp: AO errorReason Content of response

SAML 1.1 Profiles Authentication Request <AuthenticationQuery AuthenticationMethod=”...”> <Subject> AO: AuthenticationMethod <NameIdentifier> - OR - <SubjectConfirmation> AO: AuthenticatingPrincipal <ConfirmationMethod> <SubjectConfirmationData> <KeyInfo> AO: AuthenticationType

SAML 1.1 Profiles Authentication Response <Assertion MajorVersion MinorVersion AssertionID Issuer IssueInstant> <Conditions> <Advice> <Signature> <Statement> - XOR - <SubjectStatement> <AuthenticationStatement> <AuthorizationStatement> <AttributeStatement> 1..n AO: SubjectHandle <Subject> <NameIdentifier> - OR - <SubjectConfirmation> <SubjectLocality> ... <AuthorityBinding> AO: AttributeValueList

SAML 1.1 Profiles Home Location Service (this page intentionally left blank ;-) ) SAML 1.1 assumes that you know whom to ask for assertions No such thing as a lookup service for authoritative assertion sources SAML 2.0 allows this via metadata eduGAIN had two choices extend SAML 1.1 to do this not use SAML 1.1 at all, out-of-band

SAML 1.1 Profiles Attribute Exchange Request: <AttributeQuery Resource=”...”> AO: Resource <Subject> AO: SubjectHandle <NameIdentifier> - OR - <SubjectConfirmation> <ConfirmationMethod> <SubjectConfirmationData> <KeyInfo> AO: HomeSite <AttributeDesignator> AO: AttributeNameList Response: Very similar to the assertion seen in the Authentication Response

SAML 1.1 Profiles Authorisation Requests <AuthorizationDecisionQuery Resource=”...”> <Action Namespace=”...”> 1..n AO: Resource <Subject> AO: Action <NameIdentifier> - OR - <SubjectConfirmation> <ConfirmationMethod> <SubjectConfirmationData> <KeyInfo> AO: CacheReference <Evidence> <AssertionIDReference> - XOR - <Assertion MajorVersion MinorVersion AssertionID Issuer IssueInstant> 1..n ... AO: AttributeValueList, PolicyReference

SAML 1.1 Profiles Authorisation Responses <AuthorizationDecisionStatement Resource Decision> <Action Namespace> 1..n <Subject> AO: Resource AO: Result (*) <NameIdentifier> - XOR - <SubjectConfirmation> <ConfirmationMethod> <SubjectConfirmationData> <KeyInfo> <Evidence> <AssertionIDReference> - XOR - <Assertion MajorVersion MinorVersion AssertionID Issuer IssueInstant> 1..n

That's it SAML is nothing more (and nothing less) than a thoroughly designed XML Schema with usage guidelines for semantics flexible enough to handle complex scenarios If you need to extend it, major changes are necessary Questions?