University of Stuttgart University of Murcia

Slides:

Advertisements

Similar presentations

Lousy Introduction into SWITCHaai

Advertisements

RadSec – A better RADIUS protocol

Federated Identity for Grid Architects Tom Scavo NCSA

Connect. Communicate. Collaborate Click to edit Master title style MODULE 1: perfSONAR TECHNICAL OVERVIEW.

TF-EMC2 February 2006, Zagreb Deploying Authorization Mechanisms for Federated Services in the EDUROAM Architecture (DAME) -Technical Project Proposal-

Connect. Communicate. Collaborate The eduGAIN Way Diego R. Lopez - RedIRIS.

December 19, 2006 Solving Web Single Sign-on with Standards and Open Source Solutions Trey Drake AssetWorld 2007 Albuquerque, New Mexico November 2007.

A Heterogeneous Network Access Service based on PERMIS and SAML Gabriel López Millán University of Murcia EuroPKI Workshop 2005.

Web-based Portal for Discovery, Retrieval and Visualization of Earth Science Datasets in Grid Environment Zhenping (Jane) Liu.

Module 10: Designing an AD RMS Infrastructure in Windows Server 2008.

EuroPKI 2008 Manuel Sánchez Óscar Cánovas Gabriel López Antonio F. Gómez Skarmeta University of Murcia Levels of Assurance and Reauthentication in Federated.

1 Multi Cloud Navid Pustchi April 25, 2014 World-Leading Research with Real-World Impact!

Connect. Communicate. Collaborate First steps in federation peering: eduGAIN and eduroam Diego R. Lopez - RedIRIS.

Federated Identity Management for HEP David Kelsey WLCG GDB 9 May 2012.

EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Interoperability Shibboleth - gLite Christoph.

Serving society Stimulating innovation Supporting legislation Danny Vandenbroucke & Ann Crabbé KU Leuven (SADL) AAA-architecture for.

Connect. Communicate. Collaborate eduGAIN in Real Life! Ajay Daryanani, RedIRIS TERENA Networking Conference Brugge, 20th May 2008.

ShibGrid: Shibboleth access to the UK National Grid Service University of Oxford and STFC.

Connect. Communicate. Collaborate Place organisation and project logos in this area Usage of SAML in eduGAIN Stefan Winter, RESTENA Foundation TERENA Networking.

Connect. Communicate. Collaborate Federation Interoperability Made Possible By Design: eduGAIN Diego R. Lopez (RedIRIS)

Shibboleth Akylbek Zhumabayev September Agenda Introduction Related Standards: SAML, WS-Trust, WS-Federation Overview: Shibboleth, GSI, GridShib.

Kerberos and Identity Federations Daniel Kouřil, Luděk Matyska, Michal Procházka, Tomáš Kubina AFS & Kerberos Best Practices Worshop 2008.

AAI WG EMI Christoph Witzig on behalf of EMI AAI WG.

MAT U M A T U Middleware Assisted Take-Up Service For JISC Funded Early Adopters.

Technical Break-out group What are the biggest issues form past projects – need for education about standards and technologies to get everyone on the same.

EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Security Token Service Valéry Tschopp - SWITCH.

INTRODUCTION: THE FIRST TRY InCommon eduGAIN Policy and Community Working Group.

Connect. Communicate. Collaborate The authN and authR infrastructure of perfSONAR MDM Ann Arbor, MI, September 2008.

Connect. Communicate. Collaborate The MetaData Service Distributing trust in AAI confederations Manuela Stanica, DFN.

Connect. Communicate. Collaborate AAI scenario: How AutoBAHN system will use the eduGAIN federation for Authentication and Authorization Simon Muyal,

Connect. Communicate. Collaborate Federated peering the NREN way: eduGAIN and eduroam Diego R. Lopez (RedIRIS) Klaas Wierenga (SURFnet)

Connect. Communicate. Collaborate Universität Stuttgart A Client Middleware for Token- Based Unified Single Sign On to eduGAIN Sascha Neinert, University.

Workshop roaming services: eduroam / govroam

Module 11: Designing an Active Directory Federation Services Implementation in Windows Server 2008.

Connect. Communicate. Collaborate Deploying Authorization Mechanisms for Federated Services in the eduroam architecture (DAMe)* Antonio F. Gómez-Skarmeta.

Authentication and Authorisation in eduroam Klaas Wierenga, AA Workshop TNC Lyngby, 20th May 2007.

Deploying Authorization Mechanisms for Federated Services in eduroam Klaas Wierenga, EuroCAMP Helsinki, 17&18th April 2007.

EGI-InSPIRE RI EGI-InSPIRE EGI-InSPIRE RI Evolution of AAI for e- infrastructures Peter Solagna Senior Operations Manager.

RadSec Proxy Stig Venaas RadSec Proxy Generic proxy, any number of UDP and/or TLS clients and/or servers Can run on same host as a.

University of Murcia Gabriel López.  Network authentication in eduroam and SSO token distribution ◦ RADIUS hierarchy ◦ Token based on SAML  Network.

INFSO-RI Enabling Grids for E-sciencE NPM Security Alistair K Phipps (NeSC) JRA4 Face To Face, CERN, Geneva.

European Grid Initiative AAI in EGI Status and Evolution Peter Solagna Senior Operations Manager

Connect. Communicate. Collaborate Applying eduGAIN to network operations The perfSONAR case Diego R. Lopez (RedIRIS) Maurizio Molina (DANTE)

Authentication and Authorisation for Research and Collaboration AARC/CORBEL Workshop for Life Sciences AAI AARC Draft Blueprint.

Authentication and Authorisation for Research and Collaboration Taipei - Taiwan Mechanisms of Interfederation 13th March 2016 Alessandra.

Géant-TrustBroker Dynamic inter-federation identity management Daniela Pöhn TNC2014 Dublin, Ireland May 19 th, 2014.

The IGTF to eduGAIN Bridge

Applying eduGAIN to network operations The perfSONAR case

Cross-sector and user-centric AAI

Mechanisms of Interfederation

EGI Updates Check-in Matthew Viljoen – EGI Foundation

Analyn Policarpio Andrew Jazon Gupaal

First steps in federation peering: eduGAIN and eduroam

Identity Federations - Overview

Géant-TrustBroker Dynamic inter-federation identity management

Securing the Network Perimeter with ISA 2004

Federation peering à la European The eduGAIN way

Identity Federations - Installation and operation

Federation peering à la European The eduGAIN way

ESA Single Sign On (SSO) and Federated Identity Management

Server-to-Client Remote Access and DirectAccess

The DAMe’s First Steps: eduroam and NAS-SAML

SharePoint Online Hybrid – Configure Outbound Search

Multi-Domain User Applications Research (JRA3)

Mechanisms for Distributed Global Authentication David R Newman.

Community AAI with Check-In

Implement Web Application Proxy (WAP)

eIDAS-enabled Student Mobility

Check-in Identity and Access Management solution that makes it easy to secure access to services and resources.

Presentation transcript:

University of Stuttgart University of Murcia RadSec and DAMe University of Stuttgart University of Murcia Vienna, 18.02.2010 Sascha Neinert

Overview DAMe Project RadSec and DAMe: Dynamic Server Discovery DAMe Testbed Next Steps Vienna, 18.02.2010 Sascha Neinert

DAMe Project DAMe stands for: Deploying Authorization Mechanisms for Federated Services in the eduroam Architecture Subproject of GÉANT2 Partners: DFN, RedIRIS, University of Murcia, University of Stuttgart Goals: Adding attribute-based Authorization to eduroam Unified Single Sign On, using eduToken in SAML format Vienna, 18.02.2010 Sascha Neinert

Attribute-based Authorization in eduroam Note: NO DIAMETER!  Vienna, 18.02.2010 Sascha Neinert

Unified Single Sign On Vienna, 18.02.2010 Sascha Neinert

DAMe-2 Project Additional Goals: Support for Level of Assurance (LoA): Including LoA in the eduToken, in the AuthNContext Protocol extended for Re-Authentication with higher LoA Integration of RadSec Adding RadSec proxy servers in front of both remote (SP) and home (IdP) institution eduToken transport over RadSec Inclusion of Attribute Conversion in DAMe Vienna, 18.02.2010 Sascha Neinert

RadSec and DAMe: Dynamic Server Discovery RadSec: RADIUS over TCP and TLS Implementations: radsecproxy and Radiator eduroam with RadSec mutual authentication with valid server certificates from a trusted CA (eduGAIN CA / SCA, others) subjectAltName (URI) specifying the role of a server (e.g. urn:geant:eduroam:component:sp:ABC may act as a RadSec client, urn:geant:eduroam:component:idp:XYZ may act as a server) RadSec enables dynamic server discovery: Lookup for a RadSec server serving a specific home domain Mutual authentication using server certificates TLS connection is established Vienna, 18.02.2010 Sascha Neinert

RadSec and DAMe: Dynamic Server Discovery Dynamic Discovery can be done... Using DNS radsecproxy can query for _radsec._tcp.<domain-name> Radiator can also use this mechanism Using MDS radsecproxy calls radsec2mds tool SAML metadata is retrieved from eduGAIN MDS MDS is part of DAMe / eduGAIN already MDS is flexible + secure (efficient? reliable?) Vienna, 18.02.2010 Sascha Neinert

RadSec and DAMe: Dynamic Server Discovery (MDS) Vienna, 18.02.2010 Sascha Neinert

RadSec and DAMe: Dynamic Server Discovery (MDS) Meta data snippet: <md:EntityDescriptor ID=“…" entityID=“…"> <md:IDPSSODescriptor ID="USTUTT-RADSEC"> <md:SingleSignOnService Location="radsec (*) ://ksat124.rus.uni-stuttgart.de:2083"/> </md:IDPSSODescriptor> <md:Organization> <md:Extensions> <egmd:HLPattern egmd:MatchingAlgo="urn:geant:edugain:metadata:homelocator:matchingalgo:exact" egmd:Type="HomeDomain">uni-stuttgart.de</egmd:HLPattern> </md:Extensions> </md:Organization> </md:EntityDescriptor> Vienna, 18.02.2010 Sascha Neinert

DAMe Testbed – Overall View DNS AP Client RADIUS RadSec Proxy RadSec Proxy RADIUS Shib IdP DAMe- BE XACML PDP Most test cases can be done in both directions: UMU  USTUTT and USTUTT  UMU eduGAIN MDS USTUTT („home“) UMU („remote“) Vienna, 18.02.2010 Sascha Neinert

DAMe Testbed – UMU Client Network SP wpa_supplicant FreeRADIUS 1.1.3 with dame-dictionary radsecproxy 1.3.1 eduGAINSCA certificate including eduroam URN (urn:geant:eduroam:component: ...) Testbed has been moved from freeradius 1 to freeradius 2 Vienna, 18.02.2010 Sascha Neinert

DAMe Testbed – USTUTT Network IdP SAML IdP FreeRADIUS 2.0.2 with dame-enabled peap-module and dame-dictionary radsecproxy 1.3.1 can be discovered querying DNS for _radsec._tcp.dame.uni-stuttgart.de eduGAINSCA certificate including eduroam URN (urn:geant:eduroam:component: ...) SAML IdP Shibboleth IdP 1.3.2 + DAMe-BE Issuing eduTokens Vienna, 18.02.2010 Sascha Neinert

Next Steps USTUTT: separate network SP and network IdP Finish deployment of DAMe including dynamic discovery components Publish metadata to mds.edugain.org Run federated tests UMU  USTUTT Optimize radsec2mds tool Measure performance of DNS-based and MDS-based discovery Compare both methods Vienna, 18.02.2010 Sascha Neinert

Any questions or comments? DAMe website: http://dame.inf.um.es/ Vienna, 18.02.2010 Sascha Neinert