Security Token Service (STS) Status Update Henri Mikkonen, Helsinki Institute of Physics EGI Technical Forum 2012 20.9.2012, Prague, Czech Republic

Henri Mikkonen @ EGI Technical Forum 2012 Current Status The following security token formats are currently functional Incoming token formats: Username/Password SAML assertion Outgoing token formats: X.509 certificate VOMS proxy certificate WS-Trust Interoperability profile is followed See http://www.switch.ch/grid/support/documents 20/09/2012 Henri Mikkonen @ EGI Technical Forum 2012

Henri Mikkonen @ EGI Technical Forum 2012 Username/Password <soap11:Header> <wsse:Security> <wsse:UsernameToken wsu:Id="UsernameToken-0001"> <wsse:Username> ... </wsse:Username> <wsse:Password Type="..."> ... </wsse:Password> <wsse:Nonce EncodingType="..."> ... </wsse:Nonce> <wsu:Created> ... </wsu:Created> </wsse:UsernameToken> </wsse:Security> </soap11:Header> Currently supports plaintext passwords Hashing, optionally by exploiting Nonce and Created –elements can be supported 20/09/2012 Henri Mikkonen @ EGI Technical Forum 2012

Henri Mikkonen @ EGI Technical Forum 2012 SAML Assertion <soap11:Header> <wsse:Security> <saml2:Assertion ID="_064090d66352b278a7cbfd95f345fec0" IssueInstant="2012-08-28T07:33:47.224Z" Version="2.0"> … </saml2:Assertion> </wsse:Security> </soap11:Header> Contents of the SAML attribute statements is used for the certificate to be issued How can the clients obtain the assertion? The assertion must be targeted to STS ECP Profile, SAML delegation 20/09/2012 Henri Mikkonen @ EGI Technical Forum 2012

Henri Mikkonen @ EGI Technical Forum 2012 X.509 issuance Currently supports CMP protocol with CRMF Very suitable for our use cases Access to the private key corresponding to the upcoming certificate is not needed by STS STS can construct the CSR itself <soap11:Header> <wsse:Security> <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#Base64Binary" wsu:Id="X509SecurityToken"> … BASE64-encoded certificate … </wsse:BinarySecurityToken> </wsse:Security> </soap11:Header> 20/09/2012 Henri Mikkonen @ EGI Technical Forum 2012

Henri Mikkonen @ EGI Technical Forum 2012 VOMS proxy issuance End-entity certificate obtained from the online CA is used for the proxy initialization Access to the private key corresponding to the user certificate required for issuing the proxy certificate VOMS Java API used for the communication Minimal customization was needed A method for communicating the VOMS request params from the client was needed GridProxyRequest –extension to the RST 20/09/2012 Henri Mikkonen @ EGI Technical Forum 2012

GridProxyRequest - example <soap11:Body> <wst:RequestSecurityToken wsu:Id=“…“ Context=“…"> <wst:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue</wst:RequestType> <wst:TokenType>urn:glite.org:sts:GridProxy</wst:TokenType> … <gridProxy:GridProxyRequest xmlns:gridProxy="urn:glite.org:sts:proxy" lifetime="86400"> <gridProxy:VomsAttributeCertificates> <gridProxy:FQAN>testers.eu-emi.eu:/testers.eu-emi.eu</gridProxy:FQAN> </gridProxy:VomsAttributeCertificates> </gridProxy:GridProxyRequest> </wst:RequestSecurityToken> </soap11:Body> This RST requests a VOMS proxy with Lifetime of 86400 seconds (24 hours) VO attributes from the EMI testbed 20/09/2012 Henri Mikkonen @ EGI Technical Forum 2012

GridProxyRequest - schema <xs:schema targetNamespace="urn:glite.org:sts:proxy” xmlns="urn:glite.org:sts:proxy" elementFormDefault="qualified" attributeFormDefault="unqualified"> <xs:complexType name="GridProxyRequestType"> <xs:sequence> <xs:element name="VomsAttributeCertificates” type="VomsAttributeCertificatesType" minOccurs="0" maxOccurs="1"/> <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/> </xs:sequence> <xs:attribute name="lifetime" type="xs:int" use="required" /> <xs:attribute name="proxyType" type="xs:int" use="optional" /> <xs:attribute name="delegationType" type="xs:int" use="optional" /> <xs:attribute name="policyType" type="xs:int" use="optional" /> </xs:complexType> <xs:complexType name="VomsAttributeCertificatesType"> <xs:element name="FQAN" type="xs:string" minOccurs="1” maxOccurs="unbounded"/> <xs:attribute name="ordering" type="xs:string" use="optional"/> <xs:attribute name="targets" type="xs:string" use="optional"/> <xs:attribute name="verificationType" type="xs:int" use="optional"/> <xs:anyAttribute namespace="##other" processContents="lax"/> <xs:element name="GridProxyRequest" type="GridProxyRequestType"/> </xs:schema> Contents of the AttributeStatements can be used for the certificate 20/09/2012 Henri Mikkonen @ EGI Technical Forum 2012

Henri Mikkonen @ EGI Technical Forum 2012 Additional features Other token formats? Kerberos ticket? X.509 as an incoming token format? SAML assertion as an outgoing token format? Other CA protocols? MyProxy CA? 20/09/2012 Henri Mikkonen @ EGI Technical Forum 2012

Thank you! Questions? Henri Mikkonen <henri.mikkonen@hip.fi>