Sébastien BAHLOUL LINAGORA 5 April 2006 – ObjectWeb Meeting - Grenoble The FederID project Sébastien BAHLOUL LINAGORA 5 April 2006 – ObjectWeb Meeting - Grenoble

Table of contents What is it ? Attended audience Technical goals Core components: Presentation Architectures Status / TODO Project planning The communities, the project and ObjectWeb

What is it ?

Attended audience of the project Administrations: How to manage my employees' identities? How to offer services to other well known administrations, companies, associations, etc.? How to offer services with other public entities for the citizens (SSO, global registration, etc.)? How to manage identity federation with private life respect (avoid unique global identifier)? Private companies: How may I share services with my partners without giving all my clients' files? How to offer higher on-line transaction confidence by federating instead of aggregating information?

Technical goals Now, respect standards: LDAP: Advanced Access Controls List System (AACLs) Standard JNDI / JLDAP integration DSML: Through OpenLDAP (ex-Novell) API Liberty Alliance: Native ID-FF 1.2 and ID-WSF implementation (LASSO) And SSO usage: HTTP request headers (LemonLDAP) Support any authentication methods (password, x509v3, biometrics, Radius, etc.)

Technical goals In the future: Implementation: SAMLv2: as Identity and Service provider in a circle of trust SPML: to enable interaction between systems and application that support provisioning through this mark- up language Proposal: Ldap Query Language (LQL): Extends the LDAP simple query standard

What are the core components ? InterLDAP: identity management (directory and access control models, web and web service interfaces, data management) Written in Java on top of Tomcat LASSO: Library that supports Liberty Alliance standards (Identity federation, SSO, attributes sharing) Written in C on top of libXml2, OpenSSL LemonLDAP: Single Sign On reverse proxy providing HTTP request headers to applications Written in Perl as an Apache Handler

InterLDAP architecture

InterLDAP directory organization sample

LASSO architecture

LemonLDAP architecture

InterLDAP status OK: Registration process Dynamic access control model Availability of generic interfaces Dynamic notification of modified information KO: Only generic interfaces available Special developments done in OpenLDAP (extended referrals, etc.) Data selection API Conception errors linked to the monolithic characteristic of the project

InterLDAP status TODO: Rewrite parts the project: AACLs as on OpenLDAP overlay and as an Apache DS module Rewrite the LDAP connection pool Define how to manage generic and specialized web interfaces Improve the LDAP Simple Connector sub project to a true Meta Directory with connectors to (and from): Systems and other directories (AD, eDirectory, etc.) Databases Include nice features like: SASL delegation Proxy authorization X509v3 SPML

LASSO status OK: Liberty Alliance standard implementation Interaction with other product Multilingual bindings through Swig KO: Ease of use Documentation TODO: Implements SAMLv2 support Integrates LASSO with LemonLDAP to create a Service Provider Integrates LASSO with InterLDAP to create an Identity Provider

LemonLDAP status OK: Tested and functional with compatible applications 2 years production experience KO: Scalability of the original version (Use of relational DB) Ease of deployment (LemonLDAP server side) Directory model integration Documentation TODO: Improve documentation Improve new instances integration Include a better directory query engine

Project planning

The community, the project and ObjectWeb The communities are, at this time, small (less than 20 people) The project: Offers one kind of solution to a variety of issues around identity management and federation Is the only Open Source project to solve most of the issues mentioned (at our knowledge) Is Open Source and targets to be highly configurable and integrable ObjectWeb: Involved in FederID project as incubator Using different components like Enhydra Octopus, Shark & JaWE, JOTM

Questions ?

Thanks to ... My company, LINAGORA, which supports part of the development of InterLDAP Entr'ouvert, Thales DSV and ISTASE which trusted us to launch the project Clément Oudot who has improved a lot this presentation Jean-Baptiste Nataf and Alexandre d'Alton without whom InterLDAP would never have been started And many other, for their advices, patches, etc. And You, architects from the ObjectWeb consortium for your questions and points of view