1. Security Token Service (STS) Status Update
Henri Mikkonen, Helsinki Institute of Physics
EGI Technical Forum , Prague, Czech Republic

2. Henri Mikkonen @ EGI Technical Forum 2012
Current Status
The following security token formats are currently functional
Incoming token formats:
Username/Password
SAML assertion
Outgoing token formats:
X.509 certificate
VOMS proxy certificate
WS-Trust Interoperability profile is followed
See
20/09/2012
Henri EGI Technical Forum 2012

3. Henri Mikkonen @ EGI Technical Forum 2012
Username/Password
<soap11:Header>
<wsse:Security>
<wsse:UsernameToken wsu:Id="UsernameToken-0001">
<wsse:Username> ... </wsse:Username>
<wsse:Password Type="..."> ... </wsse:Password>
<wsse:Nonce EncodingType="..."> ... </wsse:Nonce>
<wsu:Created> ... </wsu:Created>
</wsse:UsernameToken>
</wsse:Security>
</soap11:Header>
Currently supports plaintext passwords
Hashing, optionally by exploiting Nonce and Created –elements can be supported
20/09/2012
Henri EGI Technical Forum 2012

4. Henri Mikkonen @ EGI Technical Forum 2012
SAML Assertion
<soap11:Header>
<wsse:Security>
<saml2:Assertion ID="_064090d66352b278a7cbfd95f345fec0" IssueInstant=" T07:33:47.224Z" Version="2.0"> …
</saml2:Assertion>
</wsse:Security>
</soap11:Header>
Contents of the SAML attribute statements is used for the certificate to be issued
How can the clients obtain the assertion?
The assertion must be targeted to STS
ECP Profile, SAML delegation
20/09/2012
Henri EGI Technical Forum 2012

5. Henri Mikkonen @ EGI Technical Forum 2012
X.509 issuance
Currently supports CMP protocol with CRMF
Very suitable for our use cases
Access to the private key corresponding to the upcoming certificate is not needed by STS
STS can construct the CSR itself
<soap11:Header>
<wsse:Security>
<wsse:BinarySecurityToken EncodingType=" wsu:Id="X509SecurityToken">
… BASE64-encoded certificate …
</wsse:BinarySecurityToken>
</wsse:Security>
</soap11:Header>
20/09/2012
Henri EGI Technical Forum 2012

6. Henri Mikkonen @ EGI Technical Forum 2012
VOMS proxy issuance
End-entity certificate obtained from the online CA is used for the proxy initialization
Access to the private key corresponding to the user certificate required for issuing the proxy certificate
VOMS Java API used for the communication
Minimal customization was needed
A method for communicating the VOMS request params from the client was needed
GridProxyRequest –extension to the RST
20/09/2012
Henri EGI Technical Forum 2012

7. GridProxyRequest - example
<soap11:Body>
<wst:RequestSecurityToken wsu:Id=“…“ Context=“…">
<wst:RequestType>
<wst:TokenType>urn:glite.org:sts:GridProxy</wst:TokenType> …
<gridProxy:GridProxyRequest xmlns:gridProxy="urn:glite.org:sts:proxy" lifetime="86400">
<gridProxy:VomsAttributeCertificates>
<gridProxy:FQAN>testers.eu-emi.eu:/testers.eu-emi.eu</gridProxy:FQAN>
</gridProxy:VomsAttributeCertificates>
</gridProxy:GridProxyRequest>
</wst:RequestSecurityToken>
</soap11:Body>
This RST requests a VOMS proxy with
Lifetime of seconds (24 hours)
VO attributes from the EMI testbed
20/09/2012
Henri EGI Technical Forum 2012

8. GridProxyRequest - schema
<xs:schema targetNamespace="urn:glite.org:sts:proxy” xmlns="urn:glite.org:sts:proxy" elementFormDefault="qualified" attributeFormDefault="unqualified">
<xs:complexType name="GridProxyRequestType">
<xs:sequence>
<xs:element name="VomsAttributeCertificates” type="VomsAttributeCertificatesType" minOccurs="0" maxOccurs="1"/>
<xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="lifetime" type="xs:int" use="required" />
<xs:attribute name="proxyType" type="xs:int" use="optional" />
<xs:attribute name="delegationType" type="xs:int" use="optional" />
<xs:attribute name="policyType" type="xs:int" use="optional" />
</xs:complexType>
<xs:complexType name="VomsAttributeCertificatesType">
<xs:element name="FQAN" type="xs:string" minOccurs="1” maxOccurs="unbounded"/>
<xs:attribute name="ordering" type="xs:string" use="optional"/>
<xs:attribute name="targets" type="xs:string" use="optional"/>
<xs:attribute name="verificationType" type="xs:int" use="optional"/>
<xs:anyAttribute namespace="##other" processContents="lax"/>
<xs:element name="GridProxyRequest" type="GridProxyRequestType"/>
</xs:schema>
Contents of the AttributeStatements can be used for the certificate
20/09/2012
Henri EGI Technical Forum 2012

9. Henri Mikkonen @ EGI Technical Forum 2012
Additional features
Other token formats?
Kerberos ticket?
X.509 as an incoming token format?
SAML assertion as an outgoing token format?
Other CA protocols?
MyProxy CA?
20/09/2012
Henri EGI Technical Forum 2012

10. Thank you! Questions?
Henri Mikkonen