1. HMA-S Project User Management for EO Services OGC 07-118r9
P. Jacques, Spacebel s.a.
Y. Coene, Spacebel s.a.
T.H. Nguyen, Spacebel s.a.
November 6, 2013

2. Outline
Issues with OGC r9
Proposed solutions
HMA-S EO UM Issues

3. Issues Related to delegation authentication Use Cases Issue with (4)
(2) Delegate STS as IdP
(4) Delegate STS with External IdP
Issue with (4)
Delegated STS has to know the public key of all the Clients in delegating STS domain
Public key of Clients needed by delegated STS to verify RST signature
HMA-S EO UM Issues

4. Delegate SAML token generation for target PEP
STS Multiplicity
Web-SSO
IdP
Client
STS
(sts-1)
STS
Service
DelegateTo
 sts-x
PEP
Service
Web-SSO
IdP
Client
STS
(sts-2)
Delegate SAML token generation for target PEP
Service
Service
PEP
PEP
Service
Service
HMA-S EO UM Issues

5. STS Multiplicity - DAIL
Web-SSO
IdP
Client
STS
(sts-1)
STS
Service
DelegateTo
 sts-x
PEP
Service
Web-SSO
IdP
Client
STS
(sts-2)
Delegate SAML token generation for target PEP
Service
PEP
PEP
DAIL
Service
HMA-S EO UM Issues

6. Issues - Delegate STS with External IdP
External Security Domain
External Identity Provider (IdP)
Client
Role
Authentication service
STS
STS
User
Registry
Component 1
authenticate
Verify identity 2
Out of scope 3
authenticate response 4
Prepare RST and sign with Client’s private key 5
RST with signature 6
HTTPS
redirect RST to known external STS 7
Verify signature with Client’s public key
HTTPS
Create SAML token 9
RTSR (SAML token in clear)
HTTPS
10 Sign SAML token using STS private key
11 Encrypt SAML token with Relying Party’s public key 12
RSTR
HTTPS
HMA-S EO UM Issues

7. Solution/Alternative – Issue with (4)
External Security Domain
External Identity Provider (IdP)
Client
Role
Authentication service
STS
STS
User
Registry
Component 1
authenticate
Verify identity 2
Out of scope 3
authenticate response 4
Prepare RST and sign with Client’s private key 5
RST with signature 5b
Verify signature with Client’s public key
Sign RST with STS’s private key
HTTPS 6
Redirect RST to known external STS 7
Verify signature with STS’s public key
HTTPS
Create SAML token 9
RTSR (SAML token in clear)
HTTPS
10 Sign SAML token using STS private key
11 Encrypt SAML token with Relying Party’s public key 12
RSTR
HTTPS
HMA-S EO UM Issues

8. STS Multiplicity - DAIL – Current
ClientA public key
Delegate SAML token generation for target PEP
STS
(sts-1) 
ClientB public key
STS
DelegateTo
 sts-x
Service
PEP
Web-SSO
IdP
ClientA
Service 
ClientA private key 
ClientA public key
STS
(sts-2) 
ClientB public key
Web-SSO
IdP
ClientB 
ClientB private key
Service
PEP
PEP
DAIL
Service
HMA-S EO UM Issues

9. STS Multiplicity – DAIL - Alternative
STS public key
Delegate SAML token generation for target PEP
STS
(sts-1)
STS
DelegateTo
 sts-x
Service 
STS private key
PEP 
ClientA public key
Web-SSO
IdP
ClientA
Service 
ClientB public key 
ClientA private key 
STS public key
STS
(sts-2)
Web-SSO
IdP
ClientB 
ClientB private key
Service
PEP
PEP
DAIL
Service
HMA-S EO UM Issues

10. Conclusion Advantage of “alternative”:
Clients can be added without impacting the G/S. No additional key exchange required.
E.g. HMA-SE: NASA (or CEOS) would access FedEO (ordering) and VITO, DLR and EUMETSAT do not have to make changes.
Feedback from HMA-AWG would be appreciated.
HMA-S EO UM Issues