Deploying Authorization Mechanisms for Federated Services in eduroam Klaas Wierenga, EuroCAMP Helsinki, 17&18th April 2007

Contents -Intro -eduroam -The European eduroam confederation -eduGAIN -DAMe -Summary

Federations in European education -Enable the sharing of educational resources -Applications -Shibboleth, PAPI, A-Select, Liberty -Federated with eduGAIN -Network -eduroam -Both require agreement on: -Responsibilities -Privacy -Liability -Technology -Language -Standards

eduroam

The goal of eduroam “open your laptop and be online” or To build an interoperable, scalable and secure authentication infrastructure that will be used all over the world enabling seamless sharing of network resources

eduroam RADIUS server University B RADIUS server University A SURFnet Central RADIUS Proxy server Authenticator (AP or switch) User DB Supplicant Guest Student VLAN Commercial VLAN Employee VLAN data signalling Trust based on RADIUS plus policy documents 802.1X (VLAN assigment)

Eduroam interactions Id Repository Resource (AP) RADIUS + TLS Channel(s) Tue Oct 10 00:05: : DEBUG: Packet dump: *** Received from port Code: Access-Request Identifier: 1 Authentic: k D Attributes: User-Name = NAS-IP-Address = Called-Station-Id = "001217d45bc7" Calling-Station-Id = "0012f0906ccb" NAS-Identifier = "001217d45bc7" NAS-Port = 55 Framed-MTU = 1400 NAS-Port-Type = Wireless-IEEE EAP-Message = - Message-Authenticator = `- y. I<218 > \ Tue Oct 10 00:17: : DEBUG: Handling request with Handler 'TunnelledByTTLS= 1, Realm=/guest.showcase.surfnet.nl/i' Tue Oct 10 00:17: : DEBUG: Deleting session for case.surfnet.nl, , Tue Oct 10 00:17: : DEBUG: Handling with Radius::AuthFILE: SC-GUEST-ID Tue Oct 10 00:17: : DEBUG: Reading users file /etc/radiator/db/showcase-gu est-users Tue Oct 10 00:17: : DEBUG: Radius::AuthFILE looks for match with Klaas.Wie Tue Oct 10 00:17: : DEBUG: Radius::AuthFILE ACCEPT: : Tue Oct 10 00:17: : DEBUG: AuthBy FILE result: ACCEPT, Tue Oct 10 00:17: : DEBUG: Access accepted for se.surfnet.nl Tue Oct 10 00:17: : DEBUG: Returned TTLS tunnelled Diameter Packet dump: Code: Access-Accept eduroam hierarchy

-Single technology -RADIUS X -EAP -Authentication = authorisation European eduroam confederation

eduGAIN

Id Repository(ies) Resource(s) MDS R-FPP Metadata Publish R-BE Metadata Query AA Interaction H-FPP Metadata Publish H-BE AA Interaction AA Interaction The eduGAIN model Lingua Franca: SAML

RequesterResponder Id Repository Resource TLS Channel(s) MDS TLS Channel ?cid=someURN <EntityDescriptor... entityID= ”urn:geant2:..:responder">... <SingleSignOnService... Location= “ />... <samlp:Request... RequestID=”e70c3e9e6…” IssueInstant=“ …”>... <samlp:Response... ResponseID=”092e50a08…” InResponseTo=“e70c3e9e…”>...  urn:geant2:...:responder urn:geant2:...:requester  eduGAIN interactions

DAMe

-Deploying Authorization Mechanisms for Federated Services in eduroam -DAME is a project that builds upon: -eduroam, which defines an inter-NREN roaming architecture based on AAA servers (RADIUS) and the 802.1X standard, -Shibboleth and eduGAIN -NAS-SAML, a network access control approach for AAA environments, developed by the University of Murcia (Spain), based on SAML (Security Assertion Markup Language) and XACML (eXtensible Access Control Markup Language) standards. -Universities of Murcia and Stuttgart within Géant2 JRA5

Gast RADIUS server University B RADIUS server University A eduroam Central RADIUS Proxy server Authenticator (AP or switch) User DB Supplicant data User mobility controlled by assertions and policies expressed in SAML and XACML XACML Policy Decision Point SAML Source Attribute Authority Signaling 1st: Extension of eduroam with authZ

2nd: eduGAIN AuthN+AuthZ backend -Link between the AAA servers (now acting as Service Providers) and eduGAIN

3d: Universal Single Sign On -Users will be authenticated once, during the network access control phase -The eduGAIN authentication would be bootstrapped from the NAS-SAML -New method for delivering authentication credentials and new security middleware -4th goal: integrating applications, focusing on grids.

eduroam+NAS-SAML in Context -The proposal is functionally equivalent to the one discussed in I2 SALSA-FWNA for RADIUS-SAML integration -Compatibility and convergence are the natural way forward -NAS-SAML is -From the inter-realm view, a Diameter binding for SAML -Already available, thus allowing for fast evaluation of ideas - Agree in the basics -Data exchanged in RADIUS space -Relevant attributes

Independent AuthZ

Summary

-Convergence to (small number of) standards X+ RADIUS -The SAML orbit -International confederations are emerging -eduroam -Géant2 AAI (eduGAIN) -The twain will ever meet -Using the same principles and standards

Thank you! More info: