HMA Identity Management Status HMA-T Final Presentation, Frascati, 14 December 2009 Y. Coene, SPACEBEL P. Denis, SPACEBEL Slide 1

Overview Updated specification OGC 07-118 version v0.0.5 Planned specification OGC 07-118 version v0.0.6 Single Signon scenario (UM-SSO) Authentication service open-source Next steps Slide 2 2

Specification OGC 07-118 version 0.0.4, 30/06/2009 Adding ATS prepared in HMA-T (Intecs, Terradue) Adding authorisation with XACML (HMA-T - Intecs) More consistent terminology (independent from DAIL, HMA etc.) Fixing errors Resolving issue with non-standard <Assertion> tag. User attributes (minimal profile) as example moved to annex.

Specification Issues solved in version 0.0.5: EUMETSAT and con terra comments: MRE-001 (partly), MRE-002 (partly), MRE-005, MRE-008 (partly), MRE-009, MRE-010, MRE-014, MRE-016, MRE-017. HMA-T actions A88, A89 (partly), A91, A93 Cover and first page aligned with latest version received from OGC (IPR issues).

Overview Updated specification OGC 07-118 version v0.0.5 Planned specification OGC 07-118 version v0.0.6 Authentication service open-source Next steps Slide 5 5

Scenarios To contain revised HMA Identity Management Scenarios Additional scenario from UM-SSO

Specification Future work Version 0.0.6: Signature of the service requests by clients, PEP verifies that the client is trusted (MRE-01, MRE-04) Support for multiple federating entities (MRE-02) Integration with Shibboleth / UM-SSO, standardisation of authentication interface through WS-Trust (STS, RST,...) (MRE-06) List of DAIL SAML token attributes to be updated (MRE-08) Add WS-Policy example from INTECS (A89)

New authentication interface(s) Replace "Authenticate" with STS "RequestSecurityToken" and UsertokenProfile as per ws-trust. Security Token Service (STS) which accepts a "token" for one domain and returns a token for a second domain. Operation RequestSecurityToken Compliant with OASIS ws-trust Interoperability Profile "Username Token Profile" from Switch (TBC)

STS Advantages Standardised "authentication service" interface. OASIS STS Commercial and open-source implementations available of STS. Profiled by SWITCH, OIO - Danish eGovernment 2009 (to be analysed) STS interface can be used for: ESA UM-SSO users: UM-SSO ID -> SAML token Other users: user name + password -> SAML token Evolution patch towards SAML 2.0

Overview Updated specification OGC 07-118 version v0.0.5 Planned specification OGC 07-118 version v0.0.6 Single Signon scenario (UM-SSO) Authentication service open-source Next steps Slide 10 10

Concept Paper Purpose: Describe integration of DAIL Portal and DAIL in ESA UM-Single Signon Environment (UM-SSO) based on Shibboleth. ESA users authenticated by UM-SSO Users authenticated by DAIL IDP Users authenticated by G/S through DAIL Users authenticated by G/S directly (not supported by OGC 07-118 v0.0.5) Slide 11 11

UM-SSO security domain Security Domains UM-SSO security domain UM-SSO IdP UM-SSO artifact DAIL security domain SAML token DAIL DAIL Portal

Use Case 1 EO-DAIL EO-DAIL

Use Case 2 Ground Segment 1 Ground Segment 1

Use Case 2 UM-SSO EO-DAIL EO-DAIL UM-SSO-Enabled, E.g. EOLI-SA, DAIL Portal

Baseline Solution - STS DAIL DAIL Portal Security Gateway STS UM-SSO artifact UM-SSO ID or artifact SAML token UM-SSO IdP CP PEP Web Services SOAP request user registry In OGC 07-118 v0.0.5: user name, password In Concept Paper - Baseline: UM-SSO-ID In Concept Paper – Alternative: UM-SSO Artifact

UM-SSO check & sign-on protocol Baseline Solution DAIL Portal DAIL Client Browser UM-SSO IdP WS DAIL Adapter PEP DAIL User UM-SSO check & sign-on protocol CP User Registry GET request RequestSecurityToken Retrieve UM-SSO-ID from HTTP header Prepare and sign RequestSecurityToken request SAML Token Put SAML token in SOAP header Check signature SOAP request Authorize request process request Get user attributes Build up SAML token Sign & encrypt response 1 2 3 4 5 6 7 8 9 10 11 GET request with assertions in HTTP header STS OGC 07-118 Concept Paper UM-SSO / Shibboleth

Overview Updated specification OGC 07-118 version v0.0.5 Planned specification OGC 07-118 version v0.0.6 Authentication service open-source Next steps Slide 19 19

Authentication Service Open-source Available on http://wiki.services.eoportal.org/tiki- index.php?page=HMA+Authentication+Service

Authentication Service Static architecture: Java Naming package to authenticate the given user in the LDAP user registry and to retrieve his attributes, OpenSAML package to build the SAML token from user attributes, Apache XML Security package to sign and encrypt the SAML token, Java Security package to retrieve private and public keys from the keystore, used in signature and encryption steps.

Authentication Service Sequence diagram successful authentication

Authentication Service Configurable Which user attributes from LDAP to be included in SAML assertions using which name (configuration file) Independent of "minimal profile" Associated documents: Software Requirements Document Architectural Design Document Acceptance Test Plan Installation procedure (part of software package).

Overview Updated specification OGC 07-118 version v0.0.5 Planned specification OGC 07-118 version v0.0.6 Authentication service open-source Next steps Slide 24 24

Next Steps Done: Planned: 23/09/2009: Authentication Service software (as per 0.0.4). 30/10/2009: OGC 07-118 version 0.0.5 11/12/2009: Authentication Service software 0.0.5 Planned: 24/12/2009: Outline OGC 07-118 version 0.0.6. XX/01/2010: OGC 07-118 version 0.0.6.