Shibboleth and Federations 12 April 2019

Agenda Trust fabrics Federations Federating Software Shibboleth-based Federations 4/12/2019

Unified field theory of Trust Bridged, global hierarchies of identification-oriented, often government based trust – laws, identity tokens, etc. Passports, drivers licenses Future is typically PKI oriented Federated enterprise-based; leverages one’s security domain; often role-based Enterprise does authentication and attributes Federations of enterprises exchange assertions (identity and attributes Peer to peer trust; ad hoc, small locus personal trust A large part of our non-networked lives New technology approaches to bring this into the electronic world. Virtual organizations could leverage any of these fabrics 4/12/2019

Federations and Classic PKI They are very similar Both imply trust models Federations are a enterprise-enterprise PKI Local authentication may well be end-entity certs Name-space control is a critical issue And they are very different End user authentication a local decision Flat set of relationships; little hierarchy Focus as much on privacy as security Web Services only right now: no other apps, no encryption We get to define… 4/12/2019

What are federations? Associations of enterprises that come together to exchange information about their users and resources in order to enable collaborations and transactions Built on the premise of Initially “Authenticate locally, act globally” Now, “Enroll and authenticate and attribute locally, act federally.” Federation provides only modest operational support and consistency in how members communicate with each other Enterprises (and users) retain control over what attributes are released to a resource; the resources retain control (though they may delegate) over the authorization decision. Over time, this will all change… 4/12/2019

The good Very flexible – easy to establish and operate; can work for 2 or 2000 members Very customizable – tailored to fit the precise membership Address the whole problem space – security, data schema, privacy, security, transport – of inter-realm collaborations Are relatively simple to install and operate, both for enterprises and for end-users 4/12/2019

The bad They aren’t real, yet They don’t do everything Are web services based right now Will hit scaling walls in several dimensions; we don’t see clear answers yet… 4/12/2019

The unknown The scaling walls How reality will unfold The convergence of the various federating software solutions Users’ willingness to manage their privacy and security 4/12/2019

Three Types of federation Internal federations are occurring among the many subsidiaries of large companies, especially for those companies with more dynamic aggregations. Private federations occur among enterprises, typically within a market sector, that want to facilitate a specific set of transactions and interactions. Many will be bi-lateral, short-term or otherwise constrained. Public federations address more free-standing, long-term, general-purpose requirements, and need to be more open about rules of engagement. Public federations face significant scaling issues and may not be able to leverage contractual relationships that private federations can. 4/12/2019

Requirements for federations Federation operations Federating software Exchange assertions Link and unlink identities Federation data schema Federation privacy and security requirements 4/12/2019

Federating Software Liberty Alliance Shibboleth WS-* V 1.1 of their functional specs released; 2.0 under discussion Federation itself is out of scope (see PingID et al) Semi-open source under development Current work is linked identities Shibboleth V1.1 released; 2.0 under discussion Most standards-based (though Liberty has said that they will turn their enhancements into standards organizations) Pure open source Current work is attribute release focused. WS-* 4/12/2019

WS-* Work by Microsoft, with participation from IBM and BEA et al Complex framework, consisting of 9 areas, which can form a whole cloth solution to the problem space, but which need to closely interact with each other to do so. Standards process and IPR issues uncertain No implementations yet; indeed a lofty set of abstractions that will need considerable convention and detail to resolve into a working instantiation Can Shibboleth/InCommon be a working instantiation within WS-*? 4/12/2019

Interoperability among federations Or, more precisely, interoperability between two members of distinct federations Ability to pass each other assertions Protocols and architectures Ability to understand each other’s assertions Syntax and semantics of objectclasses and schema Ability to trust each other’s assertions Er…… 4/12/2019

Shibboleth-based federations InQueue InCommon Club Shib SWITCH NSDL ------------------------------------ State networks Medical networks Financial aid networks Life-long learning communities 4/12/2019

The Research and Education Federation Space REF Cluster InQueue (a starting point) InCommon SWITCH The Shib Research Club Other national nets Other clusters Other potential US R+E feds State of Penn Fin Aid Assoc NSDL Indiana Slippery slope - Med Centers, etc 4/12/2019

InQueue The “holding pond” Is a persistent federation with “passing-through” membership… Operational today. Can apply for membership via http://shibboleth.internet2.edu/ InQueue Federation guidelines Requires eduPerson attributes Operated by Internet2; open to almost anyone using Shibboleth in an R&E setting or not… Fees and service profile to be established shortly: cost-recovery basis 4/12/2019

InCommon basics Permanent federation for the R&E US sector Operated by Internet2, open to .edu-qualified sites and business partners Attributes passed: eduPerson Privacy requirements: Initially, destroy received attributes immediatley upon use Security requirements: Initially, enterprises post local I/A and basic business rules for assignment of eduPersonAffiliation values Likely to progress towards standardized levels of authn Logout issues 4/12/2019

InCommon Management – exec group of CIO’s and CTO’s Operations Strong institutional I/A High confidence WAYF operation Low exposure if enterprise signing keys compromised Indemnified project Cost-recovery Costs will depend on the level of InCommon work Low risk level operations ~$1K/yr Certifying operations potentially much higher 4/12/2019

Multiple federations Aggregation Overlap Business partners want to simplify their processing Reducing legal and operational costs Overlap User confusion 4/12/2019

Trust pivot points in federations In response to real business drivers and feasible technologies increase the strengths of Campus/enterprise identification, authentication practices Federation operations, auditing thereof Campus middleware infrastructure in support of Shib (including directories, attribute authorities and other Shib components) and auditing thereof Relying party middleware infrastructure in support of Shib Moving in general from self-certification to external certification 4/12/2019

Federated Applications Personal Privacy and Resource Managers Digital rights management Role-based access controls Desktop videoconferencing Interrealm calendaring Authenticated instant messaging P2P Shibbed * 4/12/2019

4/12/2019