Download presentation
Presentation is loading. Please wait.
1
Put SAML assertion in context
IdP e.g. HIE Registry 1 Provide SAML Assertion e.g. use SAML Assertion 5 EHR Authentication Application Set Context User:<saml> Context Manager Get Context User:<saml> Downside: Size of the assertion being held in context (2k?) Performance impact – we could make an exception by creating a new subject not passed to requesting applications Upside Reduce number of requests for the assertion Simplicity Having the assertion. Can use either SAML or WS-Trust 2 3 4 Validate assertion Using signature 12/1/2018 Title or job number
2
Put SAML artifact in context Similar to Browser SSO profile
IdP e.g. HIE Registry SAML ArtifactResolve/Response 4 SAML Get assertion Provide SAML Assertion (artifact) 5 1 e.g. use SAML Assertion 6 Context Manager EHR Authentication Application Set Context User:<artifact> Get Context User:<artifact> Artifact scenario Downside Extra round trips to get actual assertion Artifacts may not be usable in WS-Trust (research) May have to set the user and assertion into context – or additionally retrieve and interpret user information from assertion or capture from the UI Upside Smaller footprint 2 3 12/1/2018 Title or job number
3
Use WS-Trust SAML e.g. HIE Registry STS Context EHR Manager WS-Trust
Token Resolve/Response Provide SAML Assertion 1 e.g. use SAML Assertion 5 4 EHR Authentication Application Set Context User:<saml-id> Context Manager Get Context User:<saml-id> WS-Trust Downside Can the SAML-id be used in SAML IdP environment? Extra round trips to get actual assertion May have to set the user and assertion into context – or additionally retrieve and interpret user information from assertion or capture from the UI Upside Smaller footprint Can be used in WS-Trust environment 2 3 12/1/2018 Title or job number
4
Use CCOW authentication agent interface (or some new method) to get SAML assertion dynamically
IdP e.g. HIE Registry Provide SAML Assertion 11*** e.g. use SAML Assertion 7 6 Context Manager EHR Authentication Application Get Context Username Downside Greater burden on the authenticating application (needs to be “action agent” aware) Possible connectivity issues Upside No changes to CM architecture, need data definition Request for SAML assertion may be delayed until needed Set username 2 3 Get SAML Assertion 4 5 12/1/2018 Title or job number
5
SAML e.g. HIE Registry IdP Context EHR Manager
Use CCOW authentication agent interface (or some new method) to get SAML assertion dynamically (with changes in TC meeting) SAML IdP e.g. HIE Registry Obtain SAML Assertion e.g. use SAML Assertion 7 6 Context Manager EHR Authentication Application Get Context Username Updated to provide less impact on the environments that do not use SAML assertions Set username 2 3 Get SAML Assertion 4 5 12/1/2018 Title or job number
6
Use CCOW authentication agent interface (or some new method) to get SAML assertion dynamically – Context Manager uses WS-Trust SAML IdP e.g. HIE Registry 1 Provide SAML Assertion e.g. use SAML Assertion 5 6 Context Manager EHR Authentication Application Set username Get Context Username Discussion in Security TC resulted in rejecting this option. 2 3 Get SAML Assertion 4 12/1/2018 Title or job number
7
Context manager Use WS-Trust
SAML STS e.g. HIE Registry WS-Trust Token Resolve/Response Provide SAML Assertion 1 e.g. use SAML Assertion Validate assertion 5 3 Mapping Agent 6 EHR Context Manager Authentication Application Set Context User:<saml-id> Get Context User:<saml-id> Similar to slide 3 except the mapping agent does the work 2 4 12/1/2018 Title or job number
8
Key issues Attributes of the SAML assertion?
Signed, SubjectConfirmation, AudienceRestrictions, ProxyRestrictions How would the IDP/STS be discovered? Do all applications get access, or are there constraints on which? Is the Context Manager actively involved in the SAML processing (e.g. validation)? 12/1/2018 Title or job number
Similar presentations
