26. Februar 2014 Authentication, Authorisation, Accounting Experience and Status – Austria - Overview

Authentication, Authorization and Accounting – Austria Governmental AA(A) Systems in Austria Citizen to Government (C2G) Austrian Citizen Card (eID) / MOA Authentication /Authorisation Business to Government (B2G) Unternehmesseriveportal (Portal for business company services) Authentication / Authorisation Government to Government (G2G) Austrian Portal Federation (Portalverbund) Authentication / Authorisation / Accounting G2G experiences are the main focus of this presentation March 2014DI Wolfgang Tinkl, Peter Pichler

Authentication, Authorisation, Accounting Citizen to Government Use Cases March 2014

Authentication, Authorization and Accounting – Austria C2G / Austrian Citizen Card / MOA-ID* (STORK) Established chip-card and mobile TAN (2 factor system using phones) authentication system User numbers increase permanently Integrated in the STORK project Social Security Card (and others) can be used as chip-card March 2014 DI Wolfgang Tinkl, Peter Pichler * MOA is the name of the Austrian open source software for the national e-ID solution. MOA-ID is responsible for authentication. (MOA… Modules for Online Applications)

Authentication, Authorization and Accounting – Austria C2G Authorisation (MOA-VV) (german: “Vollmachten und Vertretungen” means about “Service for electronic letters of attorney””) In C2B e-government system authorisation in concrete is mainly the process that one citizen allows someone else to act on behalf of him/her. The first technical approach was to store proxy authorisations directly on the card. Because of technical and practical problems (e.g. that most citizen prefer the mobile phone solution not the chip card, requiring special hardware) we shifted to a server based solution March 2014DI Wolfgang Tinkl, Peter Pichler

Authentication, Authorization and Accounting – Austria Current Status / Authorisation C2G There is a service from the Austrian data protection authority to create electronic letters of attorney. Currently the service is not used very much and only few services are supporting the usage electronic letters of attorney. We are working currently on converting authentication information from the C2G authorisation in the format used for G2G use cases (PVP), to make it more easy for services to support electronic letters of attorney March 2014DI Wolfgang Tinkl, Peter Pichler

Authentication, Authorisation, Accounting Business to Government Use Cases March 2014

Authentication, Authorization and Accounting – Austria Unternehmensserviceportal / Authentication and Authorisation Infrastructure for cooperations 2010 a central E-Government AA infrastructure for all companies was introduced. (USP – UnternemensServicePortal) For authentication the Austrian Citizen Card is used and a username/password system, used also before from the ministry for finance for the E-Taxation System. (Finanz Online) Some services (e.g. register of lobbyists) are available only with the Austrian Citizen Card (chip card or mobile TAN) March 2014DI Wolfgang Tinkl, Peter Pichler

Authentication, Authorization and Accounting – Austria Unternehmensserviceportal / Authentication and Authorisation Infrastructure for cooperations Authorisation in this use case means, that a company decides, which member of staff may/should use which e-government Service. An important challenge is to set up the processes for the authorisation management within the companies. An other main challenge was to create an register for all companies March 2014DI Wolfgang Tinkl, Peter Pichler

Authentication, Authorisation, Accounting Government to Government Use Cases March 2014 DI Wolfgang Tinkl, Peter Pichler

Authentication, Authorization and Accounting – Austria Austria is a really federal republic 9 Austrian Federal States with their own legislation March 2014Peter Pichler, DI Wolfgang Tinkl

Authentication, Authorization and Accounting – Austria Austria is a really federal republic 118 political districts March 2014Peter Pichler, DI Wolfgang Tinkl

Authentication, Authorization and Accounting – Austria Austria is a really federal republic > 2000 communities with own local authority 26. Februar 2014Peter Pichler, DI Wolfgang Tinkl

Authentication, Authorization and Accounting – Austria A lot of governmental and government near agencies with different responsibilities Ministries, Federal State Governments, Courts, …. Special Topic Agency (statistic, environment protection, financial auditing, food safety, drug studies, calibration and measurement, water protection, IT Services,…) Governmental Insurance Agencies Compulsory interest groups for business cooperation, employees, farmers, advocates,... a.s.o. 26. Februar 2014Peter Pichler, DI Wolfgang Tinkl

Authentication, Authorization and Accounting – Austria Challenges for Governmental IT Services in Government To Government Use Cases (G2G) March 2014DI Wolfgang Tinkl, Peter Pichler Organisation A Organisation C Organisation B Service A1 Service A2 Service B1 Service C1 Different Organisations use and/or provide services

Authentication, Authorization and Accounting – Austria Challenges for Governmental IT Services in Government To Government Use Cases (G2G) March 2014DI Wolfgang Tinkl, Peter Pichler Organisation A Organisation C Organisation B Service A1 Service A2 Service B1 Service C1 Implement AAA within the service?

Authentication, Authorization and Accounting – Austria Challenges for Governmental IT Services in Government To Government Use Cases (G2G) March 2014DI Wolfgang Tinkl, Peter Pichler Organisation A Organisation C Organisation B Service A1 Service A2 Service B1 Service C1 Managing user and rights separately for each service is not manageable in a secure way!

Authentication, Authorization and Accounting – Austria Authorisation Management Not a person has the right to use a G2G service, but the organisation he/she is working for. The agency delegates this rights to staff need the service, because of the scope of their duties. If responsibilities within the organisation are changed, also authorisation have to be adapted Credential management Password, certificate and chip-card Management Account and Identity Management Account registration needs a solid identification, much more easy if the user requiring the account is physical present (passport check) March 2014DI Wolfgang Tinkl, Peter Pichler Challenges for Governmental IT Services (G2G)

Authentication, Authorization and Accounting – Austria March 2014DI Wolfgang Tinkl, Peter Pichler Austrian Solution – Federation of Governmental Organisations User System-User AAA Data Store Identity Provider (IdP) Service Provider(SP) Service Implementation IdPs, Authorisation Profiles for foreign organisations User Home Organisation Organisation providing a Service PVP (Protocol) SPs can trust AAA info from federation members because of a multilateral contract between the participating organisations TRUST § PVV

Authentication, Authorization and Accounting – Austria March 2014DI Wolfgang Tinkl, Peter Pichler Austrian Solution – Federation Organisations want to access services from other Organisations use an Identity-Provider (User-Portal*). They can use an own infrastructure or can use shared infrastructure. Access rights for all governmental applications are managed by the home organisation of the user. Organisations providing services have Service Providers (Application Portals*). A multilateral contract between all participants allows Service Providers to trust the authentication, the authorisation and accounting information passed to them from IdPs of the federation. (German: “Portalverbund Vereinbarung”, about “Portal Federation Agreement”) * before integrating SAML2, we used the term “User Portal” for Identity Provider (IdP) and “Application Portal” for Service-Provides(SP)

Authentication, Authorization and Accounting – Austria March 2014DI Wolfgang Tinkl, Peter Pichler Central Residence Register BM.I Gateway Protocol PVP 1.5 (technical protocol) PVV 1.0 (multilateral agreement)Standard-Portal 1.0 (common software) Usage 2010: PVV (G2G) > registered users > 400 services PVP (technologie) > registered users > 600 not federated services PVP 2,0 (+ SAML2 WebSSO) Standard-Portal

Authentication, Authorization and Accounting – Austria History, Timeline (-2005) A important driver creating an Austrian governmental AAA infrastructure was the launch of the computer based Central Residence Register. Predecessor of the technical protocol was a protocol of the ministry of the interior. (BM.I Gateway Protocol) the first common specification of the technical protocol was specified (PVP and 1.5) and the multilateral contract (PVV 1.0 valid till now) allowing participants to trust each others and defining rights and obligations of Identity-Providers and Service-Providers many participants decided to make a common software for the Austrian Portal Federation. The PVP Standardportal, developed by the ministry of the interior and the LFRZ (IT company under the control of the ministry for agriculture) March 2014DI Wolfgang Tinkl, Peter Pichler

Authentication, Authorization and Accounting – Austria History, Timeline ( ) Till 2010 the federation is established. All ministries, federal state administrations, local community administrations (>2000) can access services of the federation. Many special topic organisations have also access to the federation and/or provide services. Also internal applications are developed using the common AAA standards. The federated portal technologies are used also for organisation internal citizen portals. Already 2010 there was more than registered G2G users, more than non G2G users. Millions of transactions are handed every day. (e.g. Ministry of the interior: 2 Mio. Transactions/day) March 2014DI Wolfgang Tinkl, Peter Pichler

Authentication, Authorization and Accounting – Austria History, Timeline (2010-now) From 2010 on the responsible specification group developed Version 2.0 of the PVP protocol, to create a PVP variant based on the Web-Single-Sign-On Profile of SAML 2 and the eGovernment Profile of the Kantara Initiative. (PVP2 S(AML)-Profile) From 2012 to 2014 the Standardportal was extended to support PVP 2. Currently we work on bringing PVP2 to productive systems and on building up central services required for an SAML Federation (e.g. central SAML metadata services) March 2014DI Wolfgang Tinkl, Peter Pichler

Authentication, Authorization and Accounting – Austria Technology – PVP R-Profile – Austrian Standard March 2014DI Wolfgang Tinkl, Peter Pichler User System-User Identity Provider (IdP) Service Provider(SP) Service Implementation X509 HTTP / SOAP over HTTP X509 Identity Provides act as non transparent reverse proxy. (every HTTP request is passed over IdP and SP; non-transparent means that portals have own DNS names)

Authentication, Authorization and Accounting – Austria Technology – PVP R-Profile – Austrian Standard IdPs and SPs act as non transparent reverse proxy. (every HTTPS request is passed over IdP and SP; non-transparent means that portals have own DNS names) SPs are authenticate the foreign IdP and trust them (limited by trust-profiles describing maximal authorisations of a foreign organisations). Authentication between IdP and SP is made mainly using certificates for the https trafic. Authentication and authorisation information is transported using HTTP Headers with each request March 2014DI Wolfgang Tinkl, Peter Pichler

Authentication, Authorization and Accounting – Austria Technology – S Profil – PVP using the SAML2 Web SSO Profile March 2014DI Wolfgang Tinkl, Peter Pichler IdP SP In the PVP2 S-Profile users are accessing the service directly. When a service needs to authenticate a user, it passes the control over the browser of the user to the IdP. (after asking user, which IdP should be used = IdP Discovery) After authentication the IdP sends an SAML response to the SP – and gives back control over the browser. Messages are signed using XML signatures, to ensure they are originated by a member of the federation. authenticate use service

Authentication, Authorization and Accounting – Austria Technology: Handling different protocols and profiles March 2014DI Wolfgang Tinkl, Peter Pichler StdPortal AWP / R-Profil-SP PVP R-Profil (PVP x) SAML 2.0 SP PVP S-Profil (PVP 2.x) Foreign IDP PVP X.X (R-Profil oder S-Profil) Service Provider Protocol-Bridge Identity Provider StdPortal Portal software converts different protocols and profiles. Services need not be updated, e.g. for the introduction of Version 2.0.

Authentication, Authorization and Accounting – Austria Usage of the Austrian Governmental Portal Federation in the INSPIRE Implementation Several organisations using a common platform for INSPIRE service from LFRZ. The administrative user interfaces (e.g. to bring in new INSPIRE metadata) are accessible using the PVP federation technologies March 2014DI Wolfgang Tinkl, Peter Pichler Central INSPIRE services

Authentication, Authorization and Accounting – Austria Current use and ideas concerning INSPIRE Used in applications around the INSPIRE services –Service and Metadata Editor –Administration GUI –eCommerce GUIs Building up a central e-commerce platform for governmental with costs. (e.g. GIS data, but also for other services) Using PVP as technical protocol between this payment platform and services March 2014DI Wolfgang Tinkl, Peter Pichler

Authentication, Authorization and Accounting – Austria Used Images March 2014DI Wolfgang Tinkl, Peter Pichler Source: Wikipedia; Licence: Creative Commons Logos of the Austrian E-ID solution Source: buergerkarte.at The Austrian Social Security Card Source: Logo of the Austrian Governmental B2G Portal Source: Logo Central Residence Register; Austrian Ministry of the Interior

Authentication, Authorization and Accounting – Austria Used Images March 2014DI Wolfgang Tinkl, Peter Pichler Maps from the Austrian Statistics Agency (Statistik Austria) Sources: _gliederungen/gemeinden/index.html _gliederungen/gemeinden/index.html _gliederungen/politische_bezirke/index.html _gliederungen/gemeinden/index.html LFRZ Images LFRZ GmBH has the using rights and allows using them in the context of this presentation

Authentication, Authorization and Accounting – Austria Autors Peter Pichler Authentication, Authorisation, Accounting DI Wolfgang Tinkl Geographical information systems, INSPIRE March 2014DI Wolfgang Tinkl, Peter Pichler