Web Authentication at Iowa Ed Hill Software Developer The University of Iowa

Web authenticationWeb Camp - June 7th, Who Am I Ed Hill Software Developer at The University of Iowa Manager of the WDS Group in AIS Projects: ISIS, Admissions, Osiris, Budget, Hawk IRB, Various Elections, etc… Background: Java, Unix

Web authenticationWeb Camp - June 7th, Agenda Authentication 101 Hawk IDs Active Directory Security Policies UI Login Tools (passport) What Why How Q&A and Feedback

Web authenticationWeb Camp - June 7th, Authentication 101 Authentication – the mechanism that verifies that an individual is who they claim to be. Typically done based on something known (password) Authorization – the mechanism to determine whether or not to allow access to a particular resource or service

Web authenticationWeb Camp - June 7th, Hawk IDs A standard login ID used to access many different services around campus Before Hawk ID, My login was edhill, ehill, ed_hill, hille, 48006NNNN, etc… User friendly, readable, public

Web authenticationWeb Camp - June 7th, Hawk IDs - Gotchas Hawk IDs are not immutable Hawk IDs are not unique over time Hawk IDs are not 8 characters long, they are 30 characters long Thought about your “special” accounts? What if someone has a hawkid of “root”, “admin”, etc… Don’t use Hawk IDs as primary keys in your application (University ID is a better choice)

Web authenticationWeb Camp - June 7th, Active Directory (AD) Active Directory (AD) is a directory that supports Windows services and it the directory where the Hawk ID passwords are kept Before AD and Hawk ID – chaos/anarchy Post Hawk ID, Before AD – one login id, different passwords for each system Post Hawk ID / AD – one login id, one password

Web authenticationWeb Camp - June 7th, Active Directory (AD) - Gotchas Accessible via LDAP or Kerberos Login failure messages don’t reveal much Synchronization among DCs Multiple GCs, DCs, realms, ohh my… Which domain “owns” a hawkid The UPN IOWA\edhill vs edhill

Web authenticationWeb Camp - June 7th, Directories When someone says “The Directory”, they can mean one of the following Active Directory (AD) – Authentication, Windows services Enterprise Directory Service (EDS) – protected LDAP directory that contains business data about people White Page / Phonebook – LDAP directory that contains public/published information about people

Web authenticationWeb Camp - June 7th, Security Policies If you remember just one thing from this presentation…

Web authenticationWeb Camp - June 7th, Security Policies If you remember just one thing from this presentation… I had nothing to do with the password expiration policy

Web authenticationWeb Camp - June 7th, Security Policies Strong passwords are enforced (min 6 characters, 2 alpha, 2 numbers, no parts of your name/hawkid) Passwords should not be stored or sent via clear-text Passwords expire after 180 days, can’t reset to a previous password Proof of identity rules before administrator can reset a person’s password

Web authenticationWeb Camp - June 7th, UI Login Tools - What UI Login Tools (formerly called UI passport) provides an authentication service to web applications that sits on top of Active Directory and the UI security policies while insulating the web developer from the details Uses Web based protocols: browser redirects, HTTP requests Works with any web development technology: Java, PHP, ASP, Cold Fusion, Perl CGI, etc…

Web authenticationWeb Camp - June 7th, UI Login Tools - Features Provides a login page via SSL Validates a user’s Hawk ID / password, communicates any errors to the user Tells your application the Hawk ID of the person that just logged in Possibly provides your application with EDS information about the person Possibly provides Single Sign On (SSO) capabilities to your application

Web authenticationWeb Camp - June 7th, UI Login Tools - Features Provides an administrative password reset and other utility tools Can provide a custom login page with your own look and feel Provides a complete audit trail of logins, password changes, etc…

Web authenticationWeb Camp - June 7th, UI Login Tools - Applications ISIS, Prof Asst, HR Portal, Mars, Osiris, PCard, PReqs, Skillsoft, Infobank, etc…

Web authenticationWeb Camp - June 7th, UI Login Tools - Why 15 mid-large applications requiring logins Inter-application trust (ISIS and HR portal) No two departments use the same web development technology Microsoft passport – marketing baggage, doesn’t scale down Sun’s passport killer – Liberty something… Yale’s Central Authentication Service (CAS)

Web authenticationWeb Camp - June 7th, UI Login Tools – How Key Concepts – 3 actors The user/browser Your web application The login tools application Browser redirects Authentication ticket Cashing in the authentication ticket HTTP request from your app to the login tools

Web authenticationWeb Camp - June 7th, UI Login Tools – The Picture Prepare to be stunned by my incredible artistic skills

Web authenticationWeb Camp - June 7th, UI Login Tools – The Picture Login ToolsYour Site AD Bob

Web authenticationWeb Camp - June 7th, UI Login Tools – The Picture Login ToolsYour Site AD Bob Step 1: Bob comes to your site for the first time to start a session 1

Web authenticationWeb Camp - June 7th, UI Login Tools – The Picture Login ToolsYour Site AD Bob Step 2: You detect the person doesn’t have a session established and you redirect them to the login tools login page, passing along your service URL 2 1

Web authenticationWeb Camp - June 7th, UI Login Tools – The Picture Login ToolsYour Site AD Bob Step 3: The user’s browser takes the redirect request from your site and sends them to the login tools web server 3 2 1

Web authenticationWeb Camp - June 7th, UI Login Tools – The Picture Login ToolsYour Site AD Bob Step 4: The login page is returned to Bob’s browser (either the generic one, or your custom login page)

Web authenticationWeb Camp - June 7th, UI Login Tools – The Picture Login ToolsYour Site AD Bob Step 5: Bob type in his correct Hawk ID and Hawk ID password in the fields on the login page and presses the Sign In button

Web authenticationWeb Camp - June 7th, UI Login Tools – The Picture Login ToolsYour Site AD Bob Step 6: Bob’s password is verified via AD, a redirect is sent back to Bob to the service url provided along with a uip_ticket param uip_ticket

Web authenticationWeb Camp - June 7th, UI Login Tools – The Picture Login ToolsYour Site AD Bob Step 7: Bob’s browser takes the redirect and sends the uip_ticket back to your web site to the service url you provided uip_ticket 7

Web authenticationWeb Camp - June 7th, UI Login Tools – The Picture Login ToolsYour Site AD Bob Step 8: Your site takes the uip_ticket and connects to the Login Tools to cash it in to find out who the ticket belongs to

Web authenticationWeb Camp - June 7th, UI Login Tools – The Picture Login ToolsYour Site AD Bob Step 9: The login tools take the ticket you Provide and return you a simple text web Page that contains Bob’s Hawk ID hawkid=bob

Web authenticationWeb Camp - June 7th, UI Login Tools – The Picture Login ToolsYour Site AD Bob Step 10: Your site creates a session for Bob and sends back your home page along with any persistence cookies you need Bob’s session Bob’s session cookie

Web authenticationWeb Camp - June 7th, UI Login Tools – The Picture Your Site Bob Step 10+N: Any further requests are just Processed from your site, checking Bob’s Session information. No further interaction With the login tools are needed Bob’s session

Web authenticationWeb Camp - June 7th, UI Login Tools You can leave now and plug into the login tools without any involvement from me To create a custom login page, You will need to send me your service url and point me at a login page template

Web authenticationWeb Camp - June 7th, Next Steps Improve Create some documentation Figure out SSO better (how best to handle and communicate logouts) Better service provider management tools – make it so you can more easily update your own login pages, service URLs, etc… SAML interface, other XML standards. Your suggestions?

Web authenticationWeb Camp - June 7th, Questions? address: