(From Radius Hierarchy to AAI) Miroslav Milinović University Computing Centre - Srce EuroCAMP Ljubljana, March 2006

EuroCAMP, Ljubljana 2006: 2/23 Contents  History  hrEdu radius/LDAP hierarchy  project  hrEdu schemas  AOSI (adding AAI flavour)  today  Future development

EuroCAMP, Ljubljana 2006: 3/23 History  Directories and directory services   Netfind, Whois++, X.500  LDAP  killer application needed  Network access  AAA for dial-up access  introducing radius instead of tacacs+  (highly) distributed user community   200 member institutions (variable size of institution and amount of ICT resources)  expert knowledge is not equaly distributed/available

EuroCAMP, Ljubljana 2006: 4/23 We started with...  (hrEdu) radius/LDAP hierarchy  limited function, primarily for dial-up access  LDAP schema development started  AAI foreseen as a long-term goal / dial-up as a killer application for LDAP deployment  fully operational radius/LDAP hierarchy since Feb  eduroam member since the very begining

EuroCAMP, Ljubljana 2006: 5/23 hrEdu radius/LDAP hierarchy ≈ 200 (170) Home orgs ≈ users SW: FreeRadius & OpenLDAP Dial-up access (CMU) ID: user.realm (Lucent Navis) proxy radius server(s) central LDAP server for backup Home Org X Radius server LDAP server Radius server Radius server LDAP server Network Home Org ZHome Org YHome org X Radius proxy service user resource

EuroCAMP, Ljubljana 2006: 6/23 Missusing the radius attributes  Use of radius in AA(A) process:  AuthN  AuthZ = AuthN + “few simple attributes”  We use:  Connect-Info  hrEduPersonExpireDate  Class  hrEduPersonUniqueID (hrEduPersonUniqueNumber)  Configuration-Token  hrEduPersonPrimaryAffiliation  but actually... not good enough

EuroCAMP, Ljubljana 2006: 7/23 Project  raising demands (network access & applications)  Radius/LDAP hierarchy is not good enough  project started in May 2004  main goals:  define HrEdu schema(s)  set up IdPs  Set up the AAI for EduHr Shibboleth was found as too complex idea: add AAI flavour to the existing radius/LDAP infrastructure

EuroCAMP, Ljubljana 2006: 8/23 hrEdu hierarchy evolved ≈ 200 (170) Home orgs ≈ users SW: FreeRadius & OpenLDAP Dial-up access (CMU) StuDOM (8149 “student beds” connected) Wireless/wired access (Srce, CARNet,...) eduroam ( UNIX/Linux PAM (ID: user.realm) ID: (Lucent Navis) proxy radius server(s) (central LDAP server for backup) Home Org X Radius server LDAP server Radius server Radius server LDAP server Network Home Org ZHome Org YHome org X (radius)proxy service user resource

EuroCAMP, Ljubljana 2006: 9/23 hrEdu schemas  hrEduPerson  HrEduOrg  registry:  transition/migration from earlier versions  all LDAPs at the same version since Feb  more work to do: harmonisation (with SCHAC,...)

EuroCAMP, Ljubljana 2006: 10/23 AOSI – adding AAI flavour  AOSI is:  an application for maintaing the content of the LDAP directory  an access tool for LDAP (e.g. local AAI component)  AOSI has two parts:  web service (core AOSI)  client application (“only” proof of concept; any other client can be used localy)  FWS/HLS = central (AOSI) service  AOSI  “ShibLite”

EuroCAMP, Ljubljana 2006: 11/23 Home org AOSI System LDAP dir. AOSI-WS AOSI Client Schema (XML) Codes,... (XML) Data (XML) User access Administrator access

EuroCAMP, Ljubljana 2006: 12/23 Home org AOSI System (2) LDAP dir. AOSI-WS AOSI Client Schema (XML) Codes,... (XML) Data (XML) PHP.Net Java

EuroCAMP, Ljubljana 2006: 13/23 Organization A Application Federation WS FWS in Organization B AOSI Directory “routing” information

EuroCAMP, Ljubljana 2006: 14/23 Organization A Application Federation WS HLS in Organization B AOSI Directory “routing” information

EuroCAMP, Ljubljana 2006: 15/23 AOSI WS and FWS  Currently based on Perl; FWS to be implemented in Java  Local AOSI WS:  Local service is described in  Generally runs at  Client platforms working with service:  Perl  PHP .Net  Java  FWS/HLS:  Based on AOSI   Documentation:  

EuroCAMP, Ljubljana 2006: 16/23 Resource Entry Point AAI Component today Central Services (proxy, FWS/HLS...) User: Home Org AAI Component Directory 197 (166) Home orgs FreeRadius AOSI WS Open LDAP

EuroCAMP, Ljubljana 2006: 17/23 in real life  in full operation since Feb  basic monitoring (  197 Home organisations (IdPs)  number of services:  Network access: dial-up, wireless & wired (eduroam, 802.1x)  (fully operational by the end of April)  Application access: Web-based aplications, WebCT, Moodle,...

EuroCAMP, Ljubljana 2006: 18/23 PAP to EAP/TTLS Bridge  Improving security  multithreaded UDP server  based on TinyRadius Radius server API, ( and eapol_test (  works on Linux (we still work on Solaris version)

EuroCAMP, Ljubljana 2006: 19/23 PAP  EAP/TTLS NAS Bridge Radius proxy PAP Radius (PAP) Radius (EAP / TTLS) Converts PAP to EAP/TTLS and back

EuroCAMP, Ljubljana 2006: 20/23 An example: CARNet mobile service RADIUS server Mobile CARNet radius server CARNet radius proxy XYZ APN Mobile AAA DB LDAP dir. XYZ client Mobile CARNet AAAHome org.

EuroCAMP, Ljubljana 2006: 21/23 An example: CARNet mobile service (2) RADIUS server Mobile CARNet radius server CARNet radius proxy FWS/HLS Mobile AAA DB LDAP dir. HTTP client Mobile CARNet AAAHome org. Mobile CARNet Web

EuroCAMP, Ljubljana 2006: 22/23 Future work  become a “real” federation (policies, policies,...)  central (vs. local) login page in production  resource registry (based on SWITCH solution)  certficates for services from TERENA SCS (provided by CARNet)  improved monitoring  start “speaking” SAML  Add ARP functionality to AOSI  “Shib gateway” in production  interoperate with eduGAIN  SSO  (SX project)

EuroCAMP, Ljubljana 2006: 23/23