Operating Systems & Information Services CERN IT Department CH-1211 Geneva 23 Switzerland t OIS CERN Single Sign-On Summer 2012 Updates Emmanuel Ormancey (IT-OIS)

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS SSO - Summer 2012 Updates - 2 Primary objective Prepare CERN Authentication for IAA Extend SSO to HEP community through Federation –Allow HEP members to access CERN resources with their local IDs. –Decrease the ‘CERN Account’ requirement Extend SSO to Public Services authentication (Google, Facebook, etc.) –Allow people to access CERN resources with their public credentials (e.g. Gmail account) –Decrease the ‘Lightweight Account’ requirement

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS SSO - Summer 2012 Updates - 3 Technical objectives Improve service, fix issues and requests Provide Strong Authentication methods –SMS one time password, Yubikey, Smartcard Allow SSO Authentication using scripts & programs Facilitate SSO management for Application owners Address the large number of E-Groups problems –‘Header too big’ Apache issue

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS SSO - Summer 2012 Updates - 4 SSO Management Site Application registration & lifecycle –Reassign the registration to another account. Identity Class (Basic) Authorization –Using the Identity Class, restrict access to the Application at the SSO level. –Lightweight accounts not authorized by default E-Groups Authorization –Filter E-Groups needed for Authorization –User token size decreased, containing E-Group membership only within the E-Groups filter.

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS SSO - Summer 2012 Updates - 5 Identity Class Authorization Provide Basic Authorization using a unique value representing the level of assurance (LoA) of the user and the authentication method used. CERN Registered Represents the currently active CERN primary accounts. ​ CERN TrustedRepresents the currently active CERN secondary and service accounts. HEP Trusted ​ HEP people registered in the CERN HR database, authenticating using their HEP systems (through Federation). Named Identity ​ Ex-members of personnel, like retirees, former staff, etc. They still have an entry in the CERN HR database but no CERN account anymore. Anonymous Identity ​ Anonymous unverified people, like external/lightweight accounts, Facebook/Google accounts, Federation accounts not verified. Default basic authorization set to CERN Registered only. Configuration at SSO level through managementhttp://cern.ch/sso- management Configuration at Application level through usual configuration files.

Operating Systems & Information Services The Road to 5 Identity Classes Types Summary Identity TypesAuth Types Auth LevelsComments CERN_REGCERN 1st STDCERN Accounts / CERN Users CERN_EXCERN 2nd 2FAEXTN and RETR UNREGCERN service UNREG are all available in AD/LDAP as disabled lightweight, same as E-Groups members FED SOCIAL Types Expanded Identity TypesAuth TypesResult/identifier/levelAuth LevelsComments CERN_REGCERN 1st CERN Registered STD CERN_REGCERN 1st CERN Registered 2FA CERN_REGCERN 2nd CERN Trusted STD CERN_REGCERN 2nd 2FA No 2FA (no card,yubikey or gsm) CERN_REGCERN service CERN Trusted STD CERN_REGCERN service 2FA No 2FA (no card,yubikey or gsm) CERN_REGFED HEP Trusted STD Could be CERN Trusted, but making the difference between CERN and HEP could be interesting CERN_REGFED HEP Trusted 2FA CERN_REGSOCIAL STD Social auth forbidden for CERN_REG CERN_REGSOCIAL 2FA Social auth forbidden for CERN_REG CERN_EXCERN 1st Named Identity STD Lightweight EXMP account as today. RETR to be moved to REG CERN_EXCERN 1st 2FA No 2FA (no card,yubikey or gsm) CERN_EXCERN 2nd STD CERN_EX cannot own CERN 2nd CERN_EXCERN 2nd 2FA No 2FA (no card,yubikey or gsm) CERN_EXCERN service STD CERN_EX cannot own CERN service CERN_EXCERN service 2FA No 2FA (no card,yubikey or gsm) CERN_EXFED STD EXMP/RETR can auth with FedID ? No, as trust-relation is void. CERN_EXFED 2FA EXMP/RETR can auth with FedID ? No, as trust-relation is void. CERN_EXSOCIAL STD Social auth forbidden for CERN_EX CERN_EXSOCIAL 2FA Social auth forbidden for CERN_EX UNREGCERN 1st Anonymous Identity STD Lightweight external account as today UNREGCERN 1st 2FA No 2FA (no card,yubikey or gsm) UNREGCERN 2nd STD UNREG cannot own CERN 2nd UNREGCERN 2nd 2FA No 2FA (no card,yubikey or gsm) UNREGCERN service STD UNREG cannot own CERN service UNREGCERN service 2FA No 2FA (no card,yubikey or gsm) UNREGFED Anonymous Identity STD UNREGFED 2FA We don't care UNREGSOCIAL Anonymous Identity STD UNREGSOCIAL 2FA We don't care

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS SSO - Summer 2012 Updates - 7 E-Groups Authorization Current situation: –An account can be member of hundreds of E- Groups –The token size can be huge when the Application needs only some to handle Authorization. New Authorization E-Groups Filter: –Define the list of E-Groups needed for Authorizations. –The User token will contain E-Group membership only within the E-Groups filter.

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS SSO - Summer 2012 Updates - 8 Authentication Methods Standard Authentication: –Forms: user types in his login and password. –Kerberos or Windows: reuse the current Kerberos or Windows (NTLM) credentials for authentication. –Certificates: use your CERN CA or EuGridPMA (IGTF) trusted certificate to authenticate. Two Factor Authentication: –Smartcard: use a CERN Smartcard to authenticate (pilot, see –Yubikey: use a Yubikey hardware token to authenticate. –SMS One Time Password: validate your authentication with a PIN code sent by SMS to your CERN GSM. Federation Authentication: –USATLAS/BNL, INFN, Switch AAI, etc... : coming soon. Public Services Authentication: –Google, Facebook, Live, Yahoo, Orange.

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS SSO - Summer 2012 Updates - 9 Federation & Social ID Federation Authentication: –USATLAS/BNL & INFN: testing, Switch AAI: coming soon. –Can be used to authenticate a CERN Account: IdentityClass = HEP Trusted –Can be used to authenticate any other: IdentityClass = Anonymous Identity Public Services Authentication: –Using standards: OAuth, OpenID –Cannot be used to authenticate a CERN Account. –IdentityClass = Anonymous Identity –Can be added in E-Groups ( based)

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Web App login.cern.ch UPN: IdentityClass: CERN Registered E-Groups: it-dep-ois; atlas-members; UPN: IdentityClass: CERN Registered E-Groups: it-dep-ois; atlas-members; Web App login.cern.ch UPN: IdentityClass: Anonymous Identity E-Groups: alice-friends; twiki-reader; UPN: IdentityClass: Anonymous Identity E-Groups: alice-friends; twiki-reader; Active Directory Login or lookup Active Directory lookup Login on SSO process CERN Account or Federation/Social Account Authorization based on E-Groups, IdentityClass and any other available attribute Authorization based on E-Groups, IdentityClass and any other available attribute Authentication + Authorization based on IdentityClass Authentication + Authorization based on IdentityClass Federation / Social site login.cern.ch

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS SSO - Summer 2012 Updates - 11 Demo… –List applications & Management page –Authenticate with Facebook (and display Application authorization page) –Show Strong Authentication systems Demo SMS Otp

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS SSO - Summer 2012 Updates - 12 More… Help and Documentation: – SSO Management: – Demo site: – Support:

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Questions? Contact: