Connect. Communicate. Collaborate Federated peering the NREN way: eduGAIN and eduroam Diego R. Lopez (RedIRIS) Klaas Wierenga (SURFnet)

Slides:



Advertisements
Similar presentations
Lousy Introduction into SWITCHaai
Advertisements

Connect. Communicate. Collaborate eduroam: a managed European service Miroslav Milinović, Srce, Zagreb, Croatia eduroam SA, GÉANT2 NORDUnet 2008, Espoo,
Connect. Communicate. Collaborate eduroam: towards a managed European service Miroslav Milinović, Srce, Zagreb, Croatia eduroam SA, GÉANT2 Wi-Fi Workshop,
Policy Based Dynamic Negotiation for Grid Services Authorization Infolunch, L3S Research Center Hannover, 29 th Jun Ionut Constandache Daniel Olmedilla.
Terena Mobility Taskforce update Klaas Wierenga SURFnet.
Licia Florio EUNIS05, Manchester 1 Eduroam EUNIS Conference, June Licia Florio.
Why eduroam sucks, and how to fix it.
TechSec WG: Related activities overview Information and discussion TechSec WG, RIPE-45 May 14, 2003 Yuri Demchenko.
TAC - Poznan, 6 June 2005 Building trust with a European style Diego R. Lopez RedIRIS.
Eduroam – Roam In a Day Louis Twomey, HEAnet Limited HEAnet Conference th November, 2006.
2006 © SWITCH Authentication and Authorization Infrastructures in e-Science (and the role of NRENs) Christoph Witzig SWITCH e-IRG, Helsinki, Oct 4, 2006.
INFSO-RI Enabling Grids for E-sciencE JRA3 2 nd EU Review Input David Groep NIKHEF.
Dorian Grid Identity Management and Federation Dialogue Workshop II Edinburgh, Scotland February 9-10, 2006 Stephen Langella Department.
High-quality Internet for higher education and research Federated network access with Klaas Wierenga SURFnet Ljubljana, April.
TF-EMC2 February 2006, Zagreb Deploying Authorization Mechanisms for Federated Services in the EDUROAM Architecture (DAME) -Technical Project Proposal-
Connect. Communicate. Collaborate The eduGAIN Way Diego R. Lopez - RedIRIS.
High-quality Internet for higher education and research eduroam EuroCAMP, Porto, November 9, 2005
Federated Identity Management for the context of storage Bart Kerver - TERENA Storage-meeting, Amsterdam,
EduRoam: movilidad por Europa... y España Toledo, 29 de octubre de 2004
A Heterogeneous Network Access Service based on PERMIS and SAML Gabriel López Millán University of Murcia EuroPKI Workshop 2005.
WebFTS as a first WLCG/HEP FIM pilot
Connect. Communicate. Collaborate Federation peering à la European The eduGAIN way Diego R. Lopez - RedIRIS.
EduRoam Australia Project Experience in location independent wireless networking with international collaboration with TERENA EduRoam Project 19 th APAN.
EuroPKI 2008 Manuel Sánchez Óscar Cánovas Gabriel López Antonio F. Gómez Skarmeta University of Murcia Levels of Assurance and Reauthentication in Federated.
Developments and challenges in authentication and authorisation Klaas Wierenga Berlin, 23 May 2006.
Connect. Communicate. Collaborate First steps in federation peering: eduGAIN and eduroam Diego R. Lopez - RedIRIS.
TNC2004 Rhodes 1 Authentication and access control in Sympa mailing list manager Serge Aumont & Olivier Salaün May 2004.
High-quality Internet for higher education and research Paul Dekkers April 4th, Turkey.
Michal Procházka, Jan Oppolzer CESNET.
Shib-Grid Integrated Authorization (Shintau) George Inman (University of Kent) TF-EMC2 Meeting Prague, 5 th September 2007.
Dr. Bhavani Thuraisingham October 2006 Trustworthy Semantic Webs Lecture #16: Web Services and Security.
EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Interoperability Shibboleth - gLite Christoph.
High-quality Internet for higher education and research AAI from the NREN perspective Schiphol, October 17, 2005
Connect. Communicate. Collaborate eduGAIN in Real Life! Ajay Daryanani, RedIRIS TERENA Networking Conference Brugge, 20th May 2008.
An XML based Security Assertion Markup Language
Connect. Communicate. Collaborate Place organisation and project logos in this area Usage of SAML in eduGAIN Stefan Winter, RESTENA Foundation TERENA Networking.
1 CS 502: Computing Methods for Digital Libraries Lecture 19 Interoperability Z39.50.
Connect. Communicate. Collaborate Federation Interoperability Made Possible By Design: eduGAIN Diego R. Lopez (RedIRIS)
SOA-39: Securing Your SOA Francois Martel Principal Solution Engineer Mitigating Security Risks of a De-coupled Infrastructure.
1 Protection and Security: Shibboleth. 2 Outline What is the problem Shibboleth is trying to solve? What are the key concepts? How does the Shibboleth.
Connect. Communicate. Collaborate The authN and authR infrastructure of perfSONAR MDM Ann Arbor, MI, September 2008.
Connect. Communicate. Collaborate The MetaData Service Distributing trust in AAI confederations Manuela Stanica, DFN.
Connect. Communicate. Collaborate AAI scenario: How AutoBAHN system will use the eduGAIN federation for Authentication and Authorization Simon Muyal,
PAPI: Simple and Ubiquitous Access to Internet Information Services JISC/CNI Conference - Edinburgh, 27 June 2002.
Connect. Communicate. Collaborate TERENA Networking Conference, 7 june 2005 Eduroam: past, present, and future.
Connect. Communicate. Collaborate Universität Stuttgart A Client Middleware for Token- Based Unified Single Sign On to eduGAIN Sascha Neinert, University.
Diego R. Lopez, RedIRIS JRES2005, Marseille On eduGAIN and the Coming GÉANT Middleware Infrastructure.
Connect. Communicate. Collaborate Deploying Authorization Mechanisms for Federated Services in the eduroam architecture (DAMe)* Antonio F. Gómez-Skarmeta.
Authentication and Authorisation in eduroam Klaas Wierenga, AA Workshop TNC Lyngby, 20th May 2007.
Deploying Authorization Mechanisms for Federated Services in eduroam Klaas Wierenga, EuroCAMP Helsinki, 17&18th April 2007.
GRID ANATOMY Advanced Computing Concepts – Dr. Emmanuel Pilli.
Programme ›TERENA ›Overview of the middleware initiatives in the European Higher Education ›What is eduroam: the technology and how to set up eduroam ›eduroam-in-a-box:
Connect communicate collaborate Trust & Identity EC meets GÉANT 19 June 2014 Brussels Valter Nordh, NORDUnet Federation as a Service Task Leader Trust.
University of Murcia Gabriel López.  Network authentication in eduroam and SSO token distribution ◦ RADIUS hierarchy ◦ Token based on SAML  Network.
Connect communicate collaborate An Infocard-based proposal for unified SSO to eduroam Enrique de la Hoz, Antonio García, Diego López, Samuel Muñoz University.
Workshop on Security for Web Services. Amsterdam, April 2010 Applying SAML to Identity Data Exchange.
AAI Interconnection with an European style Diego R. Lopez RedIRIS.
Connect. Communicate. Collaborate Applying eduGAIN to network operations The perfSONAR case Diego R. Lopez (RedIRIS) Maurizio Molina (DANTE)
Project Moonshot Daniel Kouřil EGI Technical Forum
Authentication and Authorisation for Research and Collaboration Taipei - Taiwan Mechanisms of Interfederation 13th March 2016 Alessandra.
Applying eduGAIN to network operations The perfSONAR case
Cross-sector and user-centric AAI
University of Stuttgart University of Murcia
First steps in federation peering: eduGAIN and eduroam
Federation peering à la European The eduGAIN way
Federation peering à la European The eduGAIN way
TF-Mobility update TF-EMC2, Barcelona 9 September 2005.
The DAMe’s First Steps: eduroam and NAS-SAML
Multi-Domain User Applications Research (JRA3)
GN2 JRA5 Roaming and Authorisation Jürgen Rauschenbach, DFN-Verein
Presentation transcript:

Connect. Communicate. Collaborate Federated peering the NREN way: eduGAIN and eduroam Diego R. Lopez (RedIRIS) Klaas Wierenga (SURFnet)

Connect. Communicate. Collaborate Contents The drivers for (con-)federations (Diego) The eduroam case (Klaas) The eduGAIN case (Diego) Universal single signon aka DAMe (Klaas)

Connect. Communicate. Collaborate The drivers for con-federations Giving federations a taste of their own medicine

Connect. Communicate. Collaborate As Federations Grow The risk of dying of success –Do we really need to go on selling the federated idea? Different communities, different needs –Not even talking about international collaboration –Different (but mostly alike) solutions –Grids and libraries as current examples –And many to come: Governments, professional associations, commercial operators,… Don’t hold your breath waiting for the Real And Only Global Federation

Connect. Communicate. Collaborate Confederations Federate Federations Same federating principles applied to federations themselves –Own policies and technologies are locally applied Independent management –Identity and authentication-authorization must be properly handled by the participating federations Commonly agreed policy –Linking individual federation policies –Coarser than them Trust fabric entangling participants –Through each federation’s fabric –P2P trust must be dynamically built

Connect. Communicate. Collaborate First Steps Simplifying user collaboration across whatever border is an excellent selling argument –Making the whole promise of the VO idea –eduroam fast worldwide success is a clear example Following a middle-both-ways approach –Top-down: projects like GEANT2 –Bottom-up: initiatives like ShibEnableºº

Connect. Communicate. Collaborate Technologies Lingua franca –Syntax: SAML (converging to 2.0) Shibboleth and eduGAIN profiles –Semantics: eduPerson, SCHAC Trust fabric –Public key technologies (if not infrastructures) –Component identifiers and registries –Metadata repositories

Connect. Communicate. Collaborate Policy and Legal Matters The PMA model has proven extremely useful –Consensual set of guidelines –Peer-reviewed accreditation Legal matters: Hic sunt leones –For techies like us –Privacy –Liability –More or less manageable in the case of (national) federations

Connect. Communicate. Collaborate The eduroam case Confederation avant-la-lettre

Connect. Communicate. Collaborate The goal of eduroam “open your laptop and be online” To build an interoperable, scalable and secure authentication infrastructure that will be used all over the world enabling seamless sharing of network resources

Connect. Communicate. Collaborate eduroam concepts Based on reciprocal (free) access NREN community Authentication at home Authorisation at visited institution

Connect. Communicate. Collaborate eduroam: Ubiquitous Network Access Connect. Communicate. Collaborate RADIUS server University B RADIUS server University A SURFnet Central RADIUS Proxy server Authenticator (AP or switch) User DB Supplicant Gast Student VLAN Commercial VLAN Employee VLAN data signalling Trust based on RADIUS plus policy documents 802.1X (VLAN assignment)

Connect. Communicate. Collaborate A General model for eduroam interactions Connect. Communicate. Collaborate Id Repository Resource (AP) RADIUS + TLS Channel(s) Tue Oct 10 00:05: : DEBUG: Packet dump: *** Received from port Code: Access-Request Identifier: 1 Authentic: k D Attributes: User-Name = NAS-IP-Address = Called-Station-Id = "001217d45bc7" Calling-Station-Id = "0012f0906ccb" NAS-Identifier = "001217d45bc7" NAS-Port = 55 Framed-MTU = 1400 NAS-Port-Type = Wireless-IEEE EAP-Message = - Message-Authenticator = `- y. I<218 > \ Tue Oct 10 00:17: : DEBUG: Handling request with Handler 'TunnelledByTTLS= 1, Realm=/guest.showcase.surfnet.nl/i' Tue Oct 10 00:17: : DEBUG: Deleting session for case.surfnet.nl, , Tue Oct 10 00:17: : DEBUG: Handling with Radius::AuthFILE: SC-GUEST-ID Tue Oct 10 00:17: : DEBUG: Reading users file /etc/radiator/db/showcase-gu est-users Tue Oct 10 00:17: : DEBUG: Radius::AuthFILE looks for match with Klaas.Wie Tue Oct 10 00:17: : DEBUG: Radius::AuthFILE ACCEPT: : Tue Oct 10 00:17: : DEBUG: AuthBy FILE result: ACCEPT, Tue Oct 10 00:17: : DEBUG: Access accepted for se.surfnet.nl Tue Oct 10 00:17: : DEBUG: Returned TTLS tunnelled Diameter Packet dump: Code: Access-Accept

Connect. Communicate. Collaborate eduroam Hierarchy Connect. Communicate. Collaborate (virtual) eduroam root APAN rootEuropean root(America’s root)...nl.ac.uk.dk....au.cn....edu.us....hr.es...

Connect. Communicate. Collaborate eduroam Confederations Regions have their own stage of development and pace Regions have their own regional policies (with delegation to national federations) Policies will be aligned as much as possible

Connect. Communicate. Collaborate The European eduroam Policy Mutual access Home institutions are/remain responsible for their users abroad Members are European NRENs Members guarantee required security levels by their participants Members promote eduroam in their countries European eduroam may peer with other regions

Connect. Communicate. Collaborate National Policies Mutual access Members are connected institutions Home institution is/remains responsible for its users behaviour. Home institution is responsible for proper user management Home and visited institution must keep sufficient logdata Appropriate security levels

Connect. Communicate. Collaborate Limitations Authentication = authorisation Hierarchical trust establishment AND hierarchical routing of access requests Transitive trust No dynamic trust establishment Use of UDP Use of shared secrets

Connect. Communicate. Collaborate eduroam-ng After evaluating Diameter, RadSec and DNSROAM: Introduction of RadSec (if possible) –TCP instead of UDP –TLS between RADIUS-servers instead of shared secrets Possibly at later stage introduction of DNSROAM –Support for direct peer interaction –How about firewalls / access lists? Eventually Diameter?

Connect. Communicate. Collaborate The eduGAIN case Exercising the confederation concepts

Connect. Communicate. Collaborate The AAI Goal in GÉANT2 To build an interoperable authentication and authorisation infrastructure that will be used all over Europe enabling seamless sharing of e- science resources We started from –Scattered AAI (pilot) implementations in the EU and abroad –The basic idea of federating them, preserving hard- won achievements

Connect. Communicate. Collaborate Applying Confederation Concepts An eduGAIN confederation is a loosely-coupled set of cooperating identity federations –That handle identity management, authentication and authorization using their own policies Trust between any two participants in different federations is dynamically established –Members of a participant federation do not know in advance about members in the other federations Syntax and semantics are adapted to a common language –Through an abstract service definition

Connect. Communicate. Collaborate The eduGAIN Components Bridging Elements (BE) –Interconnection points –Federation-wide (LFA) or distributed (LA) Federation Peering Point (FPP) –Able to announce BE metadata The Metadata Service (MDS) –Publishing interface (to FPPs) –Querying interface (to BEs)

Connect. Communicate. Collaborate The eduGAIN Model Connect. Communicate. Collaborate Id Repository(ies) Resource(s) MDS R-FPP Metadata Publish R-BE Metadata Query AA Interaction H-FPP Metadata Publish H-BE AA Interaction AA Interaction

Connect. Communicate. Collaborate Component Identifiers eduGAIN operations strongly depend on having unique, structured and well-defined component identifiers Based on URNs delegated by the eduGAIN registry to the participating federation Identifiers establish the kind of component they apply to by means of normalized prefixes Identifiers follow the hierarchy of the trust establishing process

Connect. Communicate. Collaborate The (X.509) Trust Fabric Validation procedures include – Normal certificate validation Trust path evaluation, signatures, revocation,… –Peer identification Certificates hold the component identifier It must match the appropriate metadata Applicable to –TLS connections between components Two-way validation is mandatory –Verification of signed XML assertions

Connect. Communicate. Collaborate A general model for eduGAIN interactions Connect. Communicate. Collaborate RequesterResponder Id Repository Resource TLS Channel(s) MDS TLS Channel ?cid=someURN <EntityDescriptor... entityID= ”urn:geant2:..:responder">... <SingleSignOnService... Location= “ />... <samlp:Request... RequestID=”e70c3e9e6…” IssueInstant=“ …”>... <samlp:Response... ResponseID=”092e50a08…” InResponseTo=“e70c3e9e…”>...  urn:geant2:...:responder urn:geant2:...:requester 

Connect. Communicate. Collaborate Operation Mapping Maps the abstract service definition into actual protocols Current version is based on SAML 1.1 –Profiling the standard to fit abstract parameters A SAML 2.0 implementation will be available along the lifetime of the project –The abstract service specification protects components and applications from these changes Authentication assertions and attribute exchange mechanisms are designed to be Shibboleth 1.3 compatible –And Shibboleth 2 in the future

Connect. Communicate. Collaborate Metadata Service Based on REST interfaces transporting SAML 2.0 metadata Metadata are published through POST operations Metadata are retrieved through GET operations URLs are built as MDSBaseURL/FederationID/entityID?queryString –Using component names –The query string transports data intended to locate the appropriate home BE (Home Locators) Hints provided by the user Contents of certificate extensions ( SubjectInformationAccess )

Connect. Communicate. Collaborate eduGAIN Profiles Three profiles defined so far –Web SSO (Shibboleth compatible) –Automated client (no human interaction) –Non-web client (use of SASL-CA) Others envisaged –Extended Web SSO (allowing the send of POST data) –eduGAIN usage from roaming clients (DAMe) Based on SAML 1.1 –Mapping to SAML 2.0 profiles along the transition period

Connect. Communicate. Collaborate A Sample Profile Connect. Communicate. Collaborate

DAMe aka “The holy grail”

Connect. Communicate. Collaborate Deploying Authorization Mechanisms for Federated Services in eduroam (DAMe) DAME is a project that builds upon: –eduroam, which defines an inter-NREN roaming architecture based on AAA servers (RADIUS) and the 802.1X standard, –Shibboleth and eduGAIN –NAS-SAML, a network access control approach for AAA environments, developed by the University of Murcia (Spain), based on the SAML (Security Assertion Markup Language) and the XACML (eXtensible Access Control Markup Language) standards.

Connect. Communicate. Collaborate First Goal: extNA First Goal: Extension of eduroam Using NAS-SAML Connect. Communicate. Collaborate Gast RADIUS server University B RADIUS server University A SURFnet Central RADIUS Proxy server Authenticator (AP or switch) User DB Supplicant data User mobility controlled by assertions and policies expressed in SAML and XACML XACML Policy Decision Point SAML Source Attribute Authority Signaling

Connect. Communicate. Collaborate First Goal: extNA Second Goal: eduGAIN as AuthN and AuthR Backend Connect. Communicate. Collaborate Link between the AAA servers (now acting as Service Providers) and eduGAIN

Connect. Communicate. Collaborate First Goal: extNA Third Goal: Universal Single Sign On Connect. Communicate. Collaborate Users will be authenticated once, during the network access control phase The eduGAIN authentication would be bootstrapped from the NAS-SAML New method for delivering authentication credentials and new security middleware

Connect. Communicate. Collaborate Summary and conclusions

Connect. Communicate. Collaborate Summary Educational federations are happening –And suffering their first growing pains Convergence to (small number of) standards –In the SAML orbit International confederations are emerging –eduroam –Géant2 AAI (eduGAIN) –The twain will ever meet –Using the same principles and standards