Your web application PDI, January 2017 Shibboleth Your web application PDI, January 2017

Presenter: Adam Warren ACNS employee, previously Web communications, previously ACNS  Middleware developer Administer 100,000 Google accounts in @Rams and @Alumni Involved in the 2007 rewrite of EID from cold fusion to .NET Been using eID Webauth for a long time…

Agenda eID Webauth review Shibboleth basics Protecting your pages/sites Shibboleth metadata One Way to Manage Session Store metadata Do early timeouts redirects: for web apps

But First… Authentication (AuthN) vs Authorization (AuthZ)

eID WebAuth > eID WebAuth only does AuthN < Setting up eID WebAuth: Preregistered eService – get a Token ID and set a “return” page Two web forms (login and login-proc) Two round trips to the server Must do something with “invalid” logins Must do AuthZ

eID WebAuth (2) Authenticating on a web app – first round trip App determines user must authenticate Login page sends Web Request to eID server with eService token eID server answers with some HTML – a login form that posts to eID User logs in, form posts to eID eID server evaluates the login, sends user to preregistered “result” page carrying an AuthenticationID

eID WebAuth (3) Authenticating – second round trip Login-proc re-bundles token with AuthenticationID, makes another Web Request eID server answers with delimited set of data on the person as well as an answer on if the user is valid or not

eID WebAuth (4) Processing Must look at “ValidUser” property, make decisions Metadata returned, if valid user: eName PrimaryEID EIDIRID ISISIRID ARIESIRID HRIRID AssociatesIRID CSUID

eID Webauth (5) Problems You have to handle invalid users Not much data except for IDs; requires subsequent lookups Round-trip (login form) spoofing Does not implement single sign-on Retiring!

Enter Shibboleth Replacement for eID WebAuth In production in very high-traffic web apps RAMweb Canvas LMS Library, Parking, others Timeline: eID WebAuth support ends July 1st 2017

What is Shibboleth? Web based single sign on with three components The Identity Provider (IdP) – does user authentication The Service Provider (SP) – protects online resources The Discovery Service (DS) – links SP to user’s IdP (not always needed)

Shibboleth Identity Provider (IdP) IdP does User Authentication, provides user information to the Service Provider, located at the home organization, which maintains the user's account. At CSU: Run by ACNS Redundant, load balanced Works just fine when Oracle is unavailable

Shibboleth Service Provider (SP) Protects online resources Consumes information from the Identity Provider (IdP). Generally installed on the same server as the resource. At CSU: Runs on your web server (IIS, Apache/Linux) Already set up on ACNS web servers ACNS timeout is 8hours session/1hour inactivity (default) http://csufederation.acns.colostate.edu/

Shibboleth Flow User requests a protected resource (your web page) If user lacks session, gets sent to the service provider Service Provider issues Authentication Request The SP sends the user to the Identity Provider User Authenticated at Identity Provider The IdP checks if the user has an existing session.. If none, IdP validates username and password

Safer > Logins only happen on the IdP <

Shibboleth Flow (2) Identity Provider issues Authentication Response and sends user back to the Service Provider. Service Provider checks Authentication Response SP validates the response, creates a session for the user, and makes metadata available to the protected resource. Resource returns Content Like before, user is asking for protected resource But now, user has a session and the resource knows who they are Must still do Authorization

Richer Data In addition to all the ID numbers (Aries, CSU-ID, EIDIRID, ad nauseum) Shibboleth also returns: displayName: Firstname Lastname eduPersonNickname: Firstname eduPersonPrincipalName: ename@colostate.edu This one is a key and the preferred identifier Mail: whatever alias email, like first.last@colostate.edu Sn: lastname givenName: Firstname

Session Timeouts for Single Sign-On IdP Session CSU IdP: 8 hours 2 hour inactivity timeout SP Session Default: 8 hours Application Session Set your own wsnetdev2.colostate.edu/cwis262/shibbolethpdi/session_timing.aspx

Implementing Shibboleth Decide what resource to protect Make use of the metadata you get from the IdP Manage your own session

Protecting Resources Can “protect” an entire folder or a single web form/page Best practice: Protect one page with the Shibboleth SP If using ACNS servers: email Joe Volesky with the filename Probably call it authorize instead of login Protect other pages by checking local session Send users to authorize page if local session is expired or nonexistent

Shibboleth Metadata Resources protected by the SP return metadata in the header. See: https://wsnetdev2.colostate.edu/cwis262/shibbolethpdi/authorize.aspx

Shibboleth Metadata (2) Wrap this metadata into a little class and only loop once ShibUserData.cs

Shibboleth Metadata Class Your one protected page spins up one ShibUserData object Just pass in the headers to the constructor Now you have all the SAML attributes from the IdP in an object that holds them in individual, type-correct properties

Managing Session in your App Create a ShibSession class Holds a ShibUserData object, and AuthZ, and a few others Store one instance of itself in the ASP.NET session Allows access to session properties in a type-safe way From inside a class file OR on any aspx page, in the same way No more HttpContext.Current.Session[“MySession”]…

Managing Session (2) Benefits it saves you from a lot of type-casting you don't have to use hard-coded session keys throughout your application (e.g. Session["loginId"]) you can document your session items by adding XML doc comments on the properties of MySession you can initialize your session variables with default values (e.g. assuring they are not null)

Shibboleth Session Class Properties: A ShibUserData object Intended Destination (for redirecting back) Login time (implement faster timeout) AuthZ Add more AuthZ properties for multiple types of AuthZ e.g., AuthZnormal, AuthZsuper

Implementing ShibSession (1) On your Authorize page: Set ShibSession User and Date properties

Implementing ShibSession (2) On your Authorize page: Do AuthZ Could be a database lookup Could be a simple ename check Could be GROUPER…

Implementing Shibboleth (3) Redirect if necessary

Now to “Other Pages” Example: simple one-page web app Three things to examine: Does user have an application session? Is user’s session fresh enough? Is user Authorized?

Other Page – Check for Session

Other Page – Check Timestamp

Other Page – Check Authorization

Demo http://wsnetdev2.colostate.edu/cwis262/ShibbolethPDI/ Default page is default.aspx Authorize page is authorize.aspx

Resources Joe Volesky for shibboleth-protecting a file on WSNDETDEV2/WSNET2 Files used in this demo: ShibUserData.cs and ShibSession.cs Authorize.aspx, Authorize.aspx.cs Default.aspx, Default.aspx.cs Web Sites shibboleth.net and wiki.shibboleth.net http://stackoverflow.com/questions/621549/how-to-access-session- variables-from-any-class-in-asp-net

Questions?