1. EFDA-Fed: European federation among fusion energy research laboratories
R. Castro, J. Vega, A. Portas, A. Pereira, S. Balme, A. Duarte,
H. Fernandes, J. Kadlecsik, P. Lebourg, A. Neto, F. Oliveira,
K. Purahoo, F. Reis, C. Rodriguez, J. Signoret, J. M. Theis, K Thomsen
EURATOM/CIEMAT
JET
CEA
EFDA-Fed

2. Index Motivation Federation PAPI as AAI New technical solutions Demo
Federation logout
Integration with JAVA applications
Demo

3. Motivation

4. Motivation
Single Sign On, Secure Access, Users Mobility, Simple Management and Scalability, Transparency, Common tools compatibility

5. Motivation Security framework for services access control
Necessity in organizations of sharing resources
Transparency
Simple management
Requirements
Single Sign On
Secure Access
Users Mobility
Simple Management and Scalability
Common tools compatibility

6. Federation

7. EFDA Federation Authentication and authorisation infrastructure Trust
PAPI
Trust
Public Key
Coordination and repository centre

8. Federated Organization Federated Organization
How does it work?
User
Repository
Federation
GPoA
Federation
WAYF
Federated Organization ? ?
Federated
Serice
Authentication
Server
Federated Organization
Web
browser
Federated
Serice

9. PAPI as AAI: Identity management
Send ID
GPoA 1
Authentication
Server
ID propagation
ID propagation
Point of
Access
Point of
Access
GPoA 2
Point of
Access
Point of
Access

10. PAPI as AAI: GPoA One credential -> Many resources 1 2 GPoA 1
HTTP
Client
GPoA 1 1 2
GPoA 2
Point of
Access
Point of
Access
Point of
Access
Point of
Access

11. PAPI as AAI: Infrastructure architecture
Federation
GPoA
GPoA AS
GPoA AS
GPoA AS
GPoA
PoA
GPoA
PoA
PoA
PoA
PoA
PoA
PoA
Organisation A
Organisation B
Organisation C

12. PAPI as AAI: Application level front-end
Easy services integration
One XML configuration point
HTTP
Server
GPoA
PoA
PoA
HTTP
Service
PoA
HTTP
Server

13. Technical solutions

14. Logout Mechanism Problem: Solution:
Service sessions based on encrypted cookies (created first time the user is authorised)
Logout => to disable all session cookies
Solution:
Only AS registered GPoAs, have not “timeout” cookies
Two “timeout” levels:
Lcook: Very short fixed timeout
Hcook:
If close time renewed -> to renew hcook
Else -> to climb to GPoA

15. Federated Organization Federated Organization
Logout Mechanism
User
Repository
Federation
GPoA
Federation
WAYF
Federated Organization ?
Logout ?
Federated
Serice
Authentication
Server
Logout
Federated Organization
Web
browser
Federated
Serice

16. Integration with JAVA applications
Adapted CookieModule class of libraries
RT-HTTPClient [
jakarta commons-httpclient
HTTP lib of jakarta projects
XML-RPC integration [
New standard CookieHandler for java > 1.5

17. Integration with JAVA applications
Jakarta common-httpclient
RT-HTTPClient
Java 1.5 or above
CookieHandler
CookieModule
CookieModule
CookiesDB
JAVA Bercley DB

18. JAVA PAPI Runner Compatible with JWS Transparent for JAVA application
NOT recompilation required
GPoA
PAPI Runner
JAVA App
CookieHandler
PoA
Cookies DB
HTTP
Resource

19. Demo

20. Thank you for your attention
R. Castro, J. Vega, A. Portas, A. Pereira, S. Balme, A. Duarte,
H. Fernandes, J. Kadlecsik, P. Lebourg, A. Neto, F. Oliveira,
K. Purahoo, F. Reis, C. Rodriguez, J. Signoret, J. M. Theis, K Thomsen
EFDA-Fed