562: Power of Single Sign-On in OpenEdge June 4th – June 7th Manchester, NH Srinivas Munigala – Principal QA Engineer Progress Software Progress

Agenda Introduction to Single Sign-On SSO in OpenEdge SSO for ABL Applications SSO for Web Applications SSO for HTTP Clients SSO Security Best Practices Demo Questions & Answers Progress

Introduction to SSO

Problem: Login… Login… Login… Progress

Solution: SSO Progress

SSO Definition Advantage SSO is property of access control of multiple, related, but independent software systems Advantage Improved user productivity Progress

SSO in OpenEdge Progress

Major categories SSO for ABL Applications Client-Principal Pre-Auth Filter SSO for Web Applications ( Progress Clients ) SSO support for HTTP Clients Progress

SSO for ABL applications Introduction to Client-Principal

The ABL Client-Principal (C-P) OE 10.1A The ABL Client-Principal (C-P) Represents a user login session Sets user id for ABL application Database connection Two states Un-sealed Sealed Authentication System Data PRINCIPAL Domain: LDAP State: Login User-ID: NewUser Login-token: BW3G1&2G1836D872 Login-date: 10/03/06 08:15:33.12 Login-expires: 10/03/06 19:30.00.00 Roles: Accountant App-data: Company=Acme ... User Account Data User Account Restrictions Application Defined Data

Direct Login vs Single Sign-on C-P is NOT sealed Authenticates every time Single Sign-on Authenticated already C-P is sealed Validates integrity Progress

Example: AppServer SSO Physical user account storage ( OE-DB |LDAP |… ) CREATE CLIENT-PRINCIPAL hCP. hCP:INITIALIZE(c_uname,?,?,c_pwd). hCP:SEAL(domain-access-code) SESSION:CURRENT-RESPONSE-INFO:SETCLIENTPRINCIPAL(hCP) ABL SESSION:CURRENT-REQUESTINFO:GetClientPrincipal() VALIDATE-SEAL(domain-access-code) SESSION:CURRENT-REQUESTINFO:GetClientPrincipal() VALIDATE-SEAL(domain-access-code) Inventory Order Shared-secret Progress

SSO for Web Applications Introduction to Pre-Auth filter

Spring security: REST/Web application architecture Pre-Auth Filter Progress

PRE-AUTH filter User has already been reliably authenticated by some external system prior to accessing the REST application Spring security: Identifies the user making the request. Obtains the authorities for the user. Progress

Pre-Authentication Filter configuration Update “enabled” property to to “true” Progress

Example: Rollbase SSO sso OE Realm AppServer REST AppServer Tomcat 1 User account system library OE Realm server class User account system library Request for User account 1 Authn Process login 2 3 User account details 4 Sealed C-P SSO Pre-authenticated REST Request for OE Service 5 “X-OE-CLIENT-CONTEXT-ID” “OECP <base64(C-P)> ” REST AppServer Tomcat OpenEdge DB Business Entity 6 sso Pre-auth Filter OE Webapp hCP = SESSION:CURRENT-REQUEST-INFO:GetClientPrincipal(). Progress

SSO support for HTTP Clients

Use Case Travels.com Cars.com Hotels.com Airline.com Progress

Airline.com Cars.com Travels.com How does it work? Form Login: PUG XXXXX Token Producer / Token Consumer / Both Travels.com (IfRequired or always) /static/auth/j_spring_security_check?OECP=yes { “token_type” : “oecp”,    “access_token” : “<b64-oecp-sso-token>”    , “refresh_token” : “<oecp-ref-token>”    , “expires_in” : <int-seconds> } Authorization: oecp <access token> Token Consumer Token Consumer Airline.com Cars.com /rest/airline /rest/cars Progress

OE 11.7.0 Key Points Extended to Mobile / Browser clients for OE ABL web applications Standard, simple & secure way to generate a Client-Principal by Web Server Generate tokens based on configuration HTTP / HTTPS access control Ability to refresh security tokens when expired Authorize users based on Client-Type Progress

Security Best Practices

Security Best Practices Verify valid Client-Principal with proper roles are coming or not Domain Access Key value should be in the form of “oech1::<hex-string>” Use Activate / De-activate procedures in your AppServer Use SSL/TLS for non-local network connections Progress

Summary Secure user authentication is necessary in today’s world Distributed authentication presents many challenges Single Sign-On operations avoids password fatigue OpenEdge has solution Progress

Progress

Progress