Web Application Authentication with PKI & Other Functions Bill Weems & Mark B. Jones Academic Technology University of Texas Health Science Center at Houston

Ideally, individuals would each like a single digital credential that can be securely used to authenticate his or her identity anytime authentication of identity is required to secure any transaction.

How do you prove you are who you say you are? How do you know that someone is legitimate in his or her dealings with you, and how do you get redress if things go wrong? If your identity is stolen and used fraudulently, or personal records are altered without your knowledge or permission, how do you prove that it was not you? It is difficult enough to verify someone's identity in the tangible world where forgery, impersonation and credit card fraud are everyday problems related to authentication. Such problems take on a new dimension with the movement from face-to-face interaction, to the faceless interaction of cyberspace. Identity and Authentication by Simon Rogerson

UTHSC-H Strategic Authentication Goals Two authentication mechanisms. –Single university ID (UID) and password –Public Key Digital ID on Token (two-factor authentication) Digital Signatures –Authenticates senders –Guarantees messages are unaltered, i.e. message integrity –Provides for non-repudiation –Legal signature Encryption of and other documents Highly Secure Access Control Potential for inherent global trust

Plug n Play Authentication Programmatic Signed and Encrypted mail Plug n Play authentication with JSP

Mass Mailing of Signed & Encrypted Automated Mailer Mailing List Signed & Encrypted LDAP Directory Service Request Recipient's Digital Cert. User Specific Messages

Plug n Play Authentication Application or Page level authX Authentication Method (optional) –Password (default) –Certificate Authorization Group (optional) –LDAP Group (with distributed group administration)

Plug n Play Authentication Client requests a resource (URL) –Resource redirects to AuthX.jsp in cert. protected directory Web Server – requests client certificate –Validates client certificate –Parses address from certificate and looks up the user in the directory –Compares the client certificate to the ‘userCertificate’ stored in the directory based on the address –Sets ‘Remote User’ to the ‘UID’ value from the directory –Allows client to access AuthX.jsp AuthX.jsp –Retrieves the ‘Remote User’ variable and assumes successful authentication –Verifies that the user is in the authorization group if specified –Redirects back to the originally requested resource

Client Browser Web Server Certificate Protected directory HTTP Request Directory Resource (UserAdmin.jsp) Request User Certificate AuthX.jsp Certificate Validation Plug n Play Authentication