Presentation is loading. Please wait.

Presentation is loading. Please wait.

X509-bindings-profiles-sep061 Bindings and Profiles for Attribute-based Authz in the Grid Tom Scavo NCSA.

Published byKenia Snipes Modified over 10 years ago

Similar presentations

Presentation on theme: "X509-bindings-profiles-sep061 Bindings and Profiles for Attribute-based Authz in the Grid Tom Scavo NCSA."— Presentation transcript:

1 x509-bindings-profiles-sep061 Bindings and Profiles for Attribute-based Authz in the Grid Tom Scavo trscavo@ncsa.uiuc.edu trscavo@ncsa.uiuc.edu NCSA

2 x509-bindings-profiles-sep062 Overview Metadata Profile for the OASIS Security Assertion Markup Language (SAML) V1.x Metadata Extension for SAML V2.0 and V1.x Query Requesters SAML V1.1 Profiles for X.509 Subjects SAML V2.0 Profiles for X.509 Subjects X.509 Binding for SAML X.509 Attribute-based Authorization Profile for SAML BONUS! Level of Assurance Attribute!

3 x509-bindings-profiles-sep063 Metadata Profile for SAML V1.x SAML V2.0 includes a Metadata Profile The Metadata Profile for the OASIS Security Assertion Markup Language (SAML) V1.x profiles the use of SAML V2.0 metadata with SAML V1.x entities Document is in final stages of pipeline Shibboleth V1.3 (or later) supports SAML V1.x metadata

4 x509-bindings-profiles-sep064 Metadata for Query Requesters GridShib use cases (e.g.) are rife with notion of standalone attribute requesters The Metadata Extension for SAML V2.0 and V1.x Query Requesters profiles use of SAML metadata with standalone query requesters Document is in final stages of pipeline Shibboleth V1.3 (or later) supports metadata for SAML V1.x attribute requester It’s not clear if Shibboleth V2.0 will support SAML V2.0 attribute requester

5 x509-bindings-profiles-sep065 SAML Profiles for X.509 Subjects Two profile sets have been submitted to the OASIS Security Services TC: –SAML V1.1 Profiles for X.509 Subjects http://www.oasis- open.org/committees/document.php?document_id=19996&wg_abb rev=security http://www.oasis- open.org/committees/document.php?document_id=19996&wg_abb rev=security –SAML V2.0 Profiles for X.509 Subjects http://www.oasis- open.org/committees/document.php?document_id=20000&wg_abb rev=security http://www.oasis- open.org/committees/document.php?document_id=20000&wg_abb rev=security Comments are welcome! http://www.oasis- open.org/committees/tc_home.php?wg_abbrev=security http://www.oasis- open.org/committees/tc_home.php?wg_abbrev=security

6 x509-bindings-profiles-sep066 SAML V1.1 Profiles The SAML V1.1 profile set consists of four layered profiles for X.509 subjects: 1.X.509 SAML Subject Profile 2.SAML Assertion Profile for X.509 Subjects 3.SAML Attribute Query Profile for X.509 Subjects 4.SAML Attribute Self-Query Profile for X.509 Subjects Document is brand new and not vetted

7 x509-bindings-profiles-sep067 X.509 SAML Subject Profile The X.509 SAML Subject Profile specifies a element: C=US, O=NCSA-TEST, OU=User, CN=trscavo@uiuc.edu CN=trscavo@uiuc.edu The DN SHOULD be RFC2253 format The NameQualifier attribute SHOULD be omitted

8 x509-bindings-profiles-sep068 X.509 SAML Subject Profile From the profile: –“This profile specifies a SAML V1.1 element that represents a principal who has been issued an X.509 certificate.” –“An entity that produces a element according to this profile MUST have previously determined that the principal does in fact possess the corresponding private key.”

9 x509-bindings-profiles-sep069 SAML Assertion Profile The SAML Assertion Profile for X.509 Subjects is a very general profile for SAML V1.1 assertions based on the X.509 SAML Subject Profile The number of SAML statements per assertion is arbitrary but –Each pair of elements MUST very strongly match (for all practical purposes, they must be identical)

10 x509-bindings-profiles-sep0610 SAML Assertion Profile Excerpt from the profile: –“The SAML Assertion Profile for X.509 Subjects describes how a SAML V1.1 assertion regarding a principal who has been issued an X.509 certificate is produced.” Holder-of-key subject confirmation is optional but tied to the X.509 certificate

11 x509-bindings-profiles-sep0611 SAML Attribute Query Profile The SAML Attribute Query Profile for X.509 Subjects specifies how a service provider and an identity provider exchange attributes about a principal who has been issued an X.509 certificate This profile relies on the X.509 SAML Subject Profile and the SAML Assertion Profile for X.509 Subjects

12 x509-bindings-profiles-sep0612 SAML Attribute Query Profile

13 x509-bindings-profiles-sep0613 SAML Attribute Query SAML V1.1 doesn’t provide much guidance re attribute query A standard Shibboleth attribute query is profiled:......

14 x509-bindings-profiles-sep0614 Attribute Query Response...............

15 x509-bindings-profiles-sep0615 SAML Attribute Self-Query Profile The SAML Attribute Self-Query Profile for X.509 Subjects specifies how a principal who has been issued an X.509 certificate self-queries an identity provider for attributes This profile extends the SAML Attribute Query Profile for X.509 Subjects A driving use case for self-query is caBIG Dorian

16 x509-bindings-profiles-sep0616 SAML Attribute Self-Query Profile

17 x509-bindings-profiles-sep0617 Attribute Self-Query Response...............

18 x509-bindings-profiles-sep0618 Subject of Self-Query The of a self-query uses holder-of-key: C=US, O=NCSA-TEST, OU=User, CN=trscavo@uiuc.edu urn:oasis:names:tc:SAML:1.0:cm:holder-of-key... CN=trscavo@uiuc.edu

19 x509-bindings-profiles-sep0619 SAML V2.0 Profiles Likewise the SAML V2.0 profile set consists of four sub-profiles: 1.X.509 SAML Subject Profile 2.SAML Assertion Profile for X.509 Subjects 3.SAML Attribute Query Profile for X.509 Subjects 4.SAML Attribute Self-Query Profile for X.509 Subjects Significant difference is encryption

20 x509-bindings-profiles-sep0620 Revision History SAML V2.0 profiles have a long history: –Draft-01, 22 Jun 2004 –Draft-02, 03 Feb 2005 –Draft-07, 23 May 2005 –CD-01, 01 Jun 2005 –Draft-08, 14 Mar 2006 –CD-02, 28 Mar 2006 –Draft-09, 26 Jun 2006 –Draft-10, 05 Jul 2006 –Draft-11, 24 Aug 2006

21 x509-bindings-profiles-sep0621 X.509 Binding for SAML … An ASN.1 SEQUENCE of elements at a well- known, non-critical X.509 v3 certificate extension This profile is a work in progress (but it won’t be an OASIS profile)

22 x509-bindings-profiles-sep0622 X.509 Attribute-based Authz Goal: Use SAML Assertion Profile and X.509 Binding to profile attribute push Distinguish between two types of bound attribute assertions: –Self-issued assertions –Third-party assertions (e.g., Shib-issued) https://authdev.it.ohio- state.edu/twiki/bin/view/GridShib/X509B indingSAMLhttps://authdev.it.ohio- state.edu/twiki/bin/view/GridShib/X509B indingSAML

23 x509-bindings-profiles-sep0623 Bound Assertion Example...............

24 x509-bindings-profiles-sep0624 MACE-Dir LoA Attribute MACE-Dir is profiling use of authnLoa attribute in conjunction with usPerson Proposed SAML binding:... Legal attribute values are per federation

25 x509-bindings-profiles-sep0625 E-Auth LoA Values For the E-Authentication Program, the recommended initial set of values is: –http://www.cio.gov/eauthentication/us person/authnloa#nist-sp-800-63-1 –http://www.cio.gov/eauthentication/us person/authnloa#nist-sp-800-63-2 –http://www.cio.gov/eauthentication/us person/authnloa#nist-sp-800-63-3 –http://www.cio.gov/eauthentication/us person/authnloa#nist-sp-800-63-4 –http://www.cio.gov/eauthentication/us person/authnloa#test InCommon values have not been proposed

Download ppt "X509-bindings-profiles-sep061 Bindings and Profiles for Attribute-based Authz in the Grid Tom Scavo NCSA."

Similar presentations

SAML Overview 1 Security Assertion Markup Language Tom Scavo NCSA

SAML Overview 1 Security Assertion Markup Language Tom Scavo NCSA
SAML CCOW Work Item: Task 2

SAML CCOW Work Item: Task 2
Federated Identity for Grid Architects Tom Scavo NCSA

Federated Identity for Grid Architects Tom Scavo NCSA
Combining the strengths of UMIST and The Victoria University of Manchester Adapting to Federated Identity SHEBANGS Shibboleth Enabled Bridge to Access.

Combining the strengths of UMIST and The Victoria University of Manchester Adapting to Federated Identity SHEBANGS Shibboleth Enabled Bridge to Access.
Implementing Federated Identity Management across a Multi-campus Statewide System: The Texas Experience William A. Weems Assistant Vice President Academic.

Implementing Federated Identity Management across a Multi-campus Statewide System: The Texas Experience William A. Weems Assistant Vice President Academic.
OASIS OData Technical Committee. AGENDA Introduction OASIS OData Technical Committee OData Overview Work of the Technical Committee Q&A.

OASIS OData Technical Committee. AGENDA Introduction OASIS OData Technical Committee OData Overview Work of the Technical Committee Q&A.
Overview of US Federal Identity Management Initiatives Peter Alterman, Ph.D. Chair, Federal PKI Policy Authority and Asst. CIO E-Authentication, NIH.

Overview of US Federal Identity Management Initiatives Peter Alterman, Ph.D. Chair, Federal PKI Policy Authority and Asst. CIO E-Authentication, NIH.
1© Nokia Siemens Networks SAML Name Identifier Request-Response Protocol Contribution to OASIS Security Services TC Christian Günther, Thinh Nguyenphu.

1© Nokia Siemens Networks SAML Name Identifier Request-Response Protocol Contribution to OASIS Security Services TC Christian Günther, Thinh Nguyenphu.
OOI-CI–Ragouzis–2007.10.15 Ocean Observatories Initiative Cyberinfrastructure Component CI Design Workshop 17-19 October 2007.

OOI-CI–Ragouzis– Ocean Observatories Initiative Cyberinfrastructure Component CI Design Workshop October 2007.
VOMS & SAML Valerio Venturi MWSG 12 12-13/6/07. EU project: RIO31844-OMII-EUROPE OMII-Europe OMII-Europe is an EU-funded project which has been established.

VOMS & SAML Valerio Venturi MWSG /6/07. EU project: RIO31844-OMII-EUROPE OMII-Europe OMII-Europe is an EU-funded project which has been established.
Donkey Project Introduction and ideas around February 21, 2003 Yuri Demchenko.

Donkey Project Introduction and ideas around February 21, 2003 Yuri Demchenko.
Saml-v2_0-intro-dec051 Security Assertion Markup Language An Introduction to SAML 2.0 Tom Scavo NCSA.

Saml-v2_0-intro-dec051 Security Assertion Markup Language An Introduction to SAML 2.0 Tom Scavo NCSA.
Computer Security: Principles and Practice EECS710: Information Security Professor Hossein Saiedian Fall 2014 Chapter 23: Internet Authentication Applications.

Computer Security: Principles and Practice EECS710: Information Security Professor Hossein Saiedian Fall 2014 Chapter 23: Internet Authentication Applications.
Lecture 23 Internet Authentication Applications

Lecture 23 Internet Authentication Applications
Authz work in GGF David Chadwick

Authz work in GGF David Chadwick
Dorian Grid Identity Management and Federation Dialogue Workshop II Edinburgh, Scotland February 9-10, 2006 Stephen Langella Department.

Dorian Grid Identity Management and Federation Dialogue Workshop II Edinburgh, Scotland February 9-10, 2006 Stephen Langella Department.
Levels of Assurance OGF Activity Michael Helm ESnet/LBNL 27 Feb 2007.

Levels of Assurance OGF Activity Michael Helm ESnet/LBNL 27 Feb 2007.
Federated Identity, Levels of Assurance, and the InCommon Silver Certification Jim Green Identity Management Academic Technology Services © Michigan State.

Federated Identity, Levels of Assurance, and the InCommon Silver Certification Jim Green Identity Management Academic Technology Services © Michigan State.
Carl A. Foster.  What is SAML?  Security Assertion and Markup Language is an XML-based standard for exchanging authentication and authorization between.

Carl A. Foster.  What is SAML?  Security Assertion and Markup Language is an XML-based standard for exchanging authentication and authorization between.
95-804 Applied Cryptography Week 13 SAML 1 95-804 Applied Cryptography SAML and XACML Mike McCarthy Week 13.

Applied Cryptography Week 13 SAML Applied Cryptography SAML and XACML Mike McCarthy Week 13.

Similar presentations

Ads by Google