Will Darby April 2010

 What is Federated Security  Security Assertion Markup Language (SAML) Overview  Example Implementations  Alternative Solutions for the Internet

 Multi-organization collaboration common  Accounts generally maintained by one organization  Grant access for externally authenticated users Business Agreement Authenticate User Access Resources Home Organization Remote Organization

 Authentication – Verifying user identity and permissions  Authorization – Permitting resource access based on identity or attribute  Identity Provider (IdP) – Entity performing authentication  Service Provider (SP) – Entity allowing authorized resource access  Role-Based Access Control – Authorization based on user attributes rather than identity

 Building block for Federated Security  Public Key Cryptography – Sign and encrypt data without shared secret  Public/Private Keys – Complementary tokens employed by PKI  Digital Signatures – Enables provable message authenticity and integrity  Message Encryption – Enables message confidentiality over public networks

 Separation of authentication from authorization  Direct resource access No fixed content gateway  Eliminate external account management Organizations maintain user accounts and attributes  User identity protection Authorization based on user attributes or pseudonyms  Decouple security implementations PKI exchange between organizations Internet-scalable solution

 First large-scale Federated Security solution  Secures web sites and web applications  Implements Security Assertion Markup Language (SAML) standard  Initially developed for research and higher education Research collaboration Academic information providers Outsourced employee applications Extended user populations  Open source project

 Attributes assigned to user accounts  Represent group affiliation or user privilege No predefined semantics by Shibboleth Semantic agreement among participants Federation and two-party arrangements  Bundled with resource requests Authenticated by IdP Basis of resource authorization by SP

Source: “Web Single Sign-On Authentication using SAML”

 Based on SAML Web Browser SSO Profile  Standard browser request, e.g. GET  Where-Are-You-From service locates IdP  User browser redirected to IdP Automated with JavaScript or manually invoked  IdP specific identity verification  Digitally signed security assertions  Browser session enables single sign-on

 Authorize users across all grids nodes  Minimal changes to existing security  Registry to map credentials to authority  Assertions passed among servers Source: “An Approach for Shibboleth and Grid Integration”

 Anonymous agents require user permissions  Delegation permits privilege assignment  User has right to manage delegation  Delegated entity requests resource on user behalf  IdP translates user ids across domains

Source: “A Delegation Framework for Federated Identity Management”

 Declare Statements regarding subject Method of authentication Associated with attributes Authorization to access resource  Specifies issuer (SAML authority)  Conditions for time and audience  Advice assertions supporting evidence and updates  Encoding defined by XML schema

 One means to exchange SAML assertions  SAML profiles define other options  Queries Authentication return authentication details Attribute return attributes for subject AuthorizationDecision determine resource operation permission  Responses Status of query Verified Assertions requested by query

Web Service Client Identity Provider Service Provider 1. SAML:AttributeQuery 2a. Authenticate User 2b. Create SAML Assertion 3. SAML:Response 4. SOAP:WS-Security 6. SOAP:Resource 5a. Verify Assertion 5b. Package Resource

 SAML protocol retrieves assertions  Client requests required assertions  SOAP-based web service  WS-Security encodes SAML assertion

 XML Signature – Digital signatures, e.g. sign assertions  XML Encryption – Encrypt payload  WS-Security – SOAP encoding of assertions  WS-Policy – Describes service security policy, e.g. assertions required  WS-Trust – Alternate protocol to obtain assertions

 Open source Java and C++ SAML libraries  SAML Assertion and Protocol support  Basis of current Shibboleth implementation  Version 2 supports SAML v1.0, v1.1 and v2.0

 Developed for Blogging community  User-centric identity management Choice of digital address (id) Select identity provider  Discover IdP from identity URL  Google Account APIs implementation

Source: “OpenID 2.0: A Platform for User-Centric Identity Management”

 Delegate access to protected resources  No use of private credentials by client  Differentiates client from resource owner  Server validates authorization and client  Google Account APIs implementation

Adapted from: “The OAuth 1.0 Protocol” Jane (Resource Owner) Jane (Resource Owner) Printer Web Site (Client) Printer Web Site (Client) Photos Web Site (Server) Photos Web Site (Server) 0a. GetClientCredentials 0b. ClientCredentials 2. Register callback 3. ok 1. Print photos 4a. Redirect 4b. Authorize 5. Challenge/Approve 6. User login 7a. Redirect 7b. callback 8. Request token 9. ok 10. Get resource 11. resource

 R.L. Morgan, S. Cantor, S. Carmody, W. Hoehn and K. Klingenstein. “Federated Security: The Shibboleth Approach.” EDUCAUSE Quarterly, Volume 27, Number 4, Pages Available at:  K.D. Lewis and J.E. Lewis. “Web Single Sign-On Authentication using SAML.” International Journal of Computer Science Issues. Volume 2, Pages Available at:  “Security Assertion Markup Language (SAML) V2.0 Technical Overview.” OASIS Security Services Technical Committee. March, Available at: open.org/committees/download.php/27819/sstc-saml-tech- overview-2.0-cd-02.pdf. open.org/committees/download.php/27819/sstc-saml-tech- overview-2.0-cd-02.pdf

 H. Gomi, M.Hatakeyama, S.Hosono and S. Fujita. “A Delegation Framework for Federated Identity Management.” Proceedings of the 2005 workshop on Digital identity management. Pages  F. Pinto and C. Fernau. “An Approach for Shibboleth and Grid Integration.” Proceedings of the UK e-Science All Hands Conference, Available at: pdf. pdf  D. Recordon and D. Reed. “OpenID 2.0: A Platform for User- Centric Identity Management.” Proceedings of the second ACM workshop on Digital Identity Management, Pages  E. Hammer-Lahav. “The OAuth 1.0 Protocol.” IETF Internet Draft. February, Available at: