Single Sign-On in the Danish Educational Sector Per Thorboll Deputy director UNI-C

2 Background UNI-C – The Danish computing center for education and research Nationwide – in a small country Large spectrum of products/services : Basic network Security Infrastructure and Services (VANS) Content services Intranet / LMS SIS and ERP

3 The products The Toolbox Abuse & CERT Schoolbag SkoDa Newspaper in education VPN at Home Antivirus SkoleKom X-IT BlackBoard School-ict InfoGuide Single Sign On EMU – the education portal MVU Net (Lotus Notes) School Intra ERP (EASY, XAL-Stat) SIS And more …….

4 Single Sign On Vision To provide a unified login for all IT-services in the Danish educational sector. Not practically possible with the technologies available today. A pragmatic approach is necessary. Current goal is to build a national authentication and authorization framework and provide unified login for web- based services.

5 HUGO – Central user database Centralized user administration for the Danish educational sector. Approx users registered today. Delegated administration ensures quality of data. Forms the immediate basis for authentication and authorization control for the unified login.

6 First step: Single Login HUGO populates a central LDAP-database with passwords and access rights (service codes). Provides the authentication and authorization service called Single Login. Users must login to each service. Username and password must be entered in several places, which makes them more difficult to protect. In some cases passwords are sent unencrypted between systems. Risk of snooping passwords in transit or at end system.

7 Next step – Single Sign On Proxy PKI Cookie P A A A A A A A A A L

8 SSO proxy Independence of applications All protocols are supported Developed and maintained in-house Does not scale Non-standard

9 SSO PKI Based on standard SSL user certificates Many protocols and applications support SSL Certificates and keys are stored locally Hard to use for end-users Certificate management is cumbersome

SSO Cookie Non-standard – until now ! Only support for web applications Only support for one domain (Initially) Scales well

Single Sign-On – the cookie solution Login is done only once for all services. Username and password entered at a single well- protected login server. Passwords never sent to other web servers. Solution at UNI-C is based on Pubcookie from U. of Washington. ( Related to Internet2 WebISO efforts. (Web Initial Sign-On: middleware.internet2.edu/webiso).

Single Sign-On – Pubcookie features Cookie based solution using a central login-server. Cookies and passwords are protected by SSL and host domains. No browser extensions required. Platform neutral, both on client and server side. Plug-in architecture for backend verifiers. Ships with LDAP and Kerberos5. Plug-in modules available for Apache and IIS webservers.

Pubcookie – How does it work? Login Server App1 App2 Principal App3

Integration of external applications In some cases it is not possible or desirable to use Pubcookie directly with a given application. Causes: SSL not wanted, external DNS domain, no Pubcookie module available, multiple auth. models. UNI-C has developed an SSO proxy solution. Auth. Info is communicated in a short-lived URL-encoded fingerprint. Security model is based on a shared secret.

SSOproxy Login Server Proxy Extern Principal App2 App3 5

Next steps More applications Synchronization with local user administration Client certificates to replace the uid/pwd dialogue Integration of more external parties. Development of a more sophisticated logout model for SSO. (Today you have to close the browser to ensure you are logged out of everything).

Conclusion UNI-C has deployed a web-based Single Login and Single Sign-On infrastructure In the process of migrating our web-based services to it. Made possible by the central HUGO user database with delegated administration. Much interest from third party partners to hook into the SSO-infrastructure in order offer their services online.