1. AARNet Copyright 2013 Network Operations OpenConext Workshop Down-Under Enabling Federated Team Management, Group-Aware SPs, and SP Shop-Fronts Neil Witheridge, AARNet Authentication & Authorisation Services Technical Manager 25 th October 2013 Session 1: Overview

2. AARNet Copyright 2013 Session 1: Overview - Topics Session Topics: Federated Authentication & Authorisation Background OpenConext Features (SP Shopfront, Group/Team mgnt & Group info retrieval)OpenConext Features Architecture & Components (Demo clean installed OpenConext)Architecture & Components SAML Proxy: IdP and SP Integration (Demo integrated IdP and SP)SAML Proxy: IdP and SP Integration Group/Team Management (Demo Team Creation & Management)Group/Team Management Group Proxy: Group Provider Integration (Demo API Playground)Group Proxy: Group Provider Integration 2 Overview

3. AARNet Copyright 2013 Session 1: Overview - Topics Session Topics cont’d Virtual Organisations & VO-based Authorisation (Demo VOs & AuthZ)Virtual Organisations & VO-based Authorisation OpenSocial Container, Portal & Gadget Integration (Demo Shindig OpenSocial Container, Rave Portal & Etherpad gadget)OpenSocial Container, Portal & Gadget Integration Security, Sustainability & Usability OpenConext Roadmap Session Wrap-up 3 Overview Non-third-party-sourced content is under the Creative Commons “Attribution 3.0 Unported” license. This means that you are permitted to freely copy, distribute, display, present, or perform material on the wiki, and create derivative works from it, for either commercial or non-commercial purposes.Creative Commons “Attribution 3.0 Unported”

4. AARNet Copyright 2013 Federated Authentication & Authorisation Background 4 Overview

5. AARNet Copyright 2013 Federated Authentication SAML Federated Identity & Access ‘state of the art’ –Service Providers trust Identity Providers & vice versa (via SAML metadata) –SPs requests user attributes from the user’s IdP (info stored in institution’s identity store) –IdP delivers according to Attribute Release Policy (ARP), with optional user consent E.g. AAF –Metadata –Policy –Info –WAYF 5 Overview

6. AARNet Copyright 2013 Authorisation Post Federated AuthN Importance of group-based access for HE&R services –Research Team access to federated services –VOs for Grid Services –Service licensing, restricted access to commercially sensitive info User information used by service for authorisation decision –IdP user attributes IdP authoritative & owned, directory schema -> namespace –Team-attributes (Research Teams, Virtual Organisations) Team authoritative & owned namespace (URN), bilateral agreement with services –urn:collab:group:biolabs:au:genome-team –Authorisation Rights (e.g. populated in eduPersonEntitlement) Service authoritative & owned namespace (URN), delegates authority to issue –urn:service-x:entitlement:foo 6 Overview

7. AARNet Copyright 2013 Group-management Systems 7 http://www.youtube.com/watch?v=kUpn568NSl0&feature=player_embedded Overview Source: http://www.switch.ch/aai/support/presentations/installfest-2008/D2-P3-GMT.pdf Source: http://www.its.hku.hk/services/research/grid/egee/userguide Source: https://spaces.internet2.edu/display/COmanage/Home Source: http://www.internet2.edu/products-services/trust-identity-middleware/grouper/ Source: http://www.eresearch.edu.au/docs/280607/James_Dalziel_Alan_Lin_Neil_Witheridge.pdf Source: SURFnet

8. AARNet Copyright 2013 OpenConext Features 8 Overview

9. AARNet Copyright 2013 SAMLFed, IdP, SP Integration Federated authentication of users 9 Overview

10. AARNet Copyright 2013 SAML Proxy Benefits 10 OpenConext Engine as an IdP/SP Proxy –Hub&Spoke -> centralised admin –Potential for attribute aggregation –Enables Services Shopfront Overview

11. AARNet Copyright 2013 Group Information Retrieval Authenticated user group information from “Group Providers” Internal Group Provider “Grouper” + External Group Providers –Registration of Group Providers = shared credentials 11 Overview

12. AARNet Copyright 2013 Group/Team Management Types of Group Providers supported by OpenConext: –Grouper –OpenSocial Group Management via “Teams” (interface to “Grouper”) –Need trust in both Group management side (cf. IdP & institutional idm) and mechanism for group information retrieval (cf. attribute resolver) –Internet2’s Grouper is comprehensive group management solution Hierarchical groups, stems Advanced delegation of authority to administer –“stem”: string that forms the leading part of a Group's name 12 Overview Source: http://www.internet2.edu/products-services/trust-identity-middleware/grouper/

13. AARNet Copyright 2013 OpenConext Architecture and Components 13 Overview

14. AARNet Copyright 2013 OpenConext Architecture 14 Overview Source: http://www.internet2.edu/products-services/trust-identity-middleware/grouper/

15. AARNet Copyright 2013 OpenConext Components 15 Application components making up OpenConext Overview Mock Group Provider API Playground Grouper Java JANUS

16. AARNet Copyright 2013 OpenConext Installation OpenConext Repository https://github.com/OpenConext https://github.com/OpenConext Downloading OpenConext from Github git clone https://github.com/OpenConext/OpenConext-vm.git or curl https://codeload.github.com/OpenConext/OpenConext-vm/tar.gz/masterhttps://github.com/OpenConext/OpenConext-vm.githttps://codeload.github.com/OpenConext/OpenConext-vm/tar.gz/master Easy OpenConext installation by running installation scripts –Installation and setup will be covered in next session Mujina IdP –Installed and pre-configured as IdP in OpenConext –convenient ‘test’ and ‘bootstrap’ IdP’ –provides default “admin” user –REST interface provided to create users e.g. “addjane” 16 Overview

17. AARNet Copyright 2013 Installed Components ServiceRegistry –OpenConext admin user management –SAML Proxy configuration –Adding connections (IdP and SP) Manage –OpenConext usage, access to Engine metadata –Adding Group Providers (also to configure test External Group Provider) –Creating VOs (VO-based authZ described later) Other tools –Teams (creation and management of Teams) (and Grouper native UI) –API Playground (experiment with Group Info retrieval via “API” component) –Profile (basic identity management) 17 Overview

18. AARNet Copyright 2013 SAML Proxy: IdP and SP Integration 18 Overview

19. AARNet Copyright 2013 SAML-Proxy functionality Engine proxies trusted SPs to trusted IdPs & vice versa –Trusted IdPs metadata provisioned in Engine SP –Engine IdP metadata provisioned in Trusted SPs 19 Overview

20. AARNet Copyright 2013 Integration with SAML Fed OpenConext in the national federation –Registered as single SP (Engine) Federation IdPs release attributes to OpenConext Engine Proxy functionality -> “SP shopfront” or “Super SP” 20 Overview

21. AARNet Copyright 2013 Attribute Release Policy (ARP) OpenConext Engine deployed as SP in the National SAML Fed –Engine SP SAML metadata provisioned in Nat Fed IdPs (& vice versa) –OpenConext SPs provisioned with Engine IdP SAML metadata (& vice versa) –Attribute requirements for Engine determine Nat Fed IdPs’ ARP –Attribute req’s for OpenConext SPs determine OpenConext IdP ARP –Only att’s received by Engine SP are available for release by Engine IdP –OpenConext SP requirements configured in Service Registry 21 Overview

22. AARNet Copyright 2013 SAML Proxy Technology OpenConext Engine (Corto) & Service Registry (JANUS) –Reuse of mature technology for SAML proxying, metadata admin –SURFnet responsible for JANUS development Corto https://sites.google.com/site/cortopages/ JANUS http://code.google.com/p/janus-ssp/ 22 Overview Source: https://sites.google.com/site/cortopages/ Source: https://code.google.com/p/janus-ssp/

23. AARNet Copyright 2013 SAML Proxy: Power & Flexibility “IdP A” a member of Nat SAML Fed but not trusting/trusted by OpenConext (i.e. users can’t access “SP 1”, “SP-2”, “SP 3”) “IdP 1”& “IdP 2” not members of Nat Fed but trusted by OpenConext (i.e. users can’t access “SP A” or “SP B”) 23 Overview

24. AARNet Copyright 2013 Group/Team Management 24 Overview

25. AARNet Copyright 2013 Group/Team Management Groups/Teams –Groups=Teams in OpenConext –Team types: private, public Group Providers –Source of user group information (cf IdP for SAML federation) –Built-in Group Provider: Internet2’s “Grouper” OpenConext groups/teams are flat –External Group Providers can be integrated Types of Group Provider: Grouper, OpenSocial OpenConext “Teams” service, a GUI for Grouper –Provision of GUI for External Group Providers ? 25 Overview Source: http://www.internet2.edu/products-services/trust-identity-middleware/grouper/

26. AARNet Copyright 2013 Team creation and admin “Teams” provides for secure team creation and administration –Delegation of responsibilities for team administration User role requirements for team creation Email workflow –User added to team at manager’s invitation –User added to team at user’s request Adding Groups to Teams –tbd Using the Grouper GUI directly –Significance of ‘stem’ 26 Overview

27. AARNet Copyright 2013 Group Proxy Group Provider Integration ( for Group Information Retrieval) 27 Overview

28. AARNet Copyright 2013 Group Proxy Functionality “API” component acts as Proxy to Group Providers for SPs 28 Overview

29. AARNet Copyright 2013 VOOT Protocol From SP perspective, requests are issued via VOOT protocol Retrieval of group and person information –Standardised REST API based on OpenSocial Social API Subset of OpenSocial + {voot_membership_role} attributes Supported Requests: –Information about authenticated user /people/@me –List of groups the user is a member of /groups/@me –List of people that are members of the user’s group /people/@me/ –OAuth 2.0 and OAuth 1.0a (for legacy SPs) authentication supported 29 Overview

30. AARNet Copyright 2013 VOOT Request/Response e.g. GET /groups/@me?sortBy=title HTTP/1.1 HTTP/1.1 200 OK Content-Type: application/json { "entry": [ { "description": "Group containing employees.", "id": "employees", "title": "Employees", "voot_membership_role": "admin" }, { "description": "Group containing everyone at this institute.", "id": "members", "title": "Members", "voot_membership_role": "member" } ], "itemsPerPage": 2, "startIndex": "0", "totalResults": 2 } 30 Overview Source: http://www.internet2.edu/products-services/trust-identity-middleware/grouper/

31. AARNet Copyright 2013 OAuth Authentication OAuth v2.0, Authorisation Code Grant 31 Source (reproduced in): http://www.bubblecode.net/en/2013/03/10/understanding-oauth2/

32. AARNet Copyright 2013 API Playground OpenConext provides an ‘API playground’ for testing OAuth/VOOT calls OAuth actors –Resource, Resource Owner, Resource Server, Client, Authorisation Server OAuth security –Client Registration with Authorisation Server (consumer key, secret) –Reliance on TLS (i.e. use of https) in requests to service end-points API Playground OAuth protocols supported –Version 1.0a 3-legged, 2-legged –Version 2.0 Authorization Code Grant, Implicit Grant API Playground workflow –OAuth Settings –Authorisation Request –API Request (changing the API Request to explore different VOOT requests) 32 Overview

33. AARNet Copyright 2013 Overview Putting it together: SAML + Group Proxy 33

34. AARNet Copyright 2013 Virtual Organisations and VO-based Authorisation 34 Overview

35. AARNet Copyright 2013 VO’s and VO-based AuthZ In OpenConext, a Virtual Organisation is an group aggregator –Defined in terms of groups, IdPs and stems Creating a VO –“Manage” component provides for VO creation –Types of VO: group(s), IdP(s), group(s)+IdP(s), stem Access to resources based on VO membership –Authorisation built into OpenConext engine –VO-based authorisation by virtue of Engine SAML IdP metadata Generate Engine IdP SAML metadata with VO suffix vo: Provision protected SP with Engine IdP metadata Only members of the VO (Groups, IdPs, stem) can access the service 35 Overview

36. AARNet Copyright 2013 VO-Based Authorisation 36 Overview

37. AARNet Copyright 2013 OpenSocial Container, Portal and Gadget integration 37 Overview

38. AARNet Copyright 2013 JISC Conext / Jacson Uptake of OpenConext by JISC –Development of JISC Conext / Jacson (initially for JISCmail) Integration of OpenSocial Container & Portal in OpenConext –Initially intended to be an integral part of OpenConext OpenSocial Container – Apache Shindig OpenSocial Portal – Apache Rave –OpenSocial Gadgets – e.g. Etherpad Federated Authentication and Group Information retrieval Uptake of OpenSocial technology. –Key value of OpenSocial Portal infrastructure such as “Jacson” Potential for Australian HE&R Service Providers? 38 Overview

39. AARNet Copyright 2013 Security, Sustainability and Ease-of Use 39 Overview

40. AARNet Copyright 2013 OpenConext Security OpenConext Security Mechanisms –SAML Proxy related, Group Proxy related (OpenSocial API) OpenConext Security –Analysis undertaken of SURFconext components by 3 rd party Australian HE&R focus on Group Information Retrieval –VOOT/OAuth security reliance on TLS –Considerable work on Oauth Security undertaken http://tools.ietf.org/html/draft-ietf-oauth-v2-threatmodel-01 Security Analysis of Double redirection protocols http://pomcor.com/techreports/DoubleRedirection.pdf http://pomcor.com/techreports/DoubleRedirection.pdf 40 Overview

41. AARNet Copyright 2013 OpenConext Sustainability Continuing use for The Netherland’s National SAML Federation Global uptake & collaboration (e.g. in deploying, documenting) JISC Internet2 41 Overview Source: http://conext.jiscconext.org.uk/cgi-bin/greeting?instanceID=1 Source: https://spaces.internet2.edu/download/attachments/10732/2012-COmanage-info-rev.pdf

42. AARNet Copyright 2013 42 Ease of Use Deployment –Open Source, supported, growing development & user community, maillists –Focus on documentation, ease of installation Development –OpenSocial / OAuth Client libraries available for most languages Java (e.g. Scribe) PHP (e.g. zend_oauth) Python (e.g. rauth) Workshops & conferences –Active topic at technical conferences –Workshops being created & delivered Overview

43. AARNet Copyright 2013 OpenConext Roadmap 43 Overview

44. AARNet Copyright 2013 OpenConext Roadmap Niels van Dijk to describe current priorities and future plan for OpenConext development Also (depending on time) report on –Global Uptake –Documentation effort –Commitment of SURFnet to support for global uptake –Keeping informed and contributing to development 44 Overview

45. AARNet Copyright 2013 Wrapping Up, Questions ? 45 neil.witheridge@aarnet.edu.au niels.vandijk@surfnet.nl Overview

46. AARNet Copyright 2013 Preparation for Session 2 Session 2 to go into technical detail, building on Session 1 –SP development work will be undertaken during afternoon sessions Preparation for Session 2: –Preparation section Confirm connectivity Virtual Machines –Assigned to participants – add initials on VM list to reserve –Note IP address, domain name –Username and password on whiteboard –Access via SSH 46 Overview