Download presentation
Presentation is loading. Please wait.
Published byJada McFadden Modified over 10 years ago
1
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia 2 years ago in Bled… ESUP-Portail: open-source Single Sign-On with CAS –Pascal Aubry, Vincent Mathieu & Julien Marchal –EUNIS2004, Bled, Slovenia, July 2004
2
Copyright © 2006 – ESUP-Portail consortium – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth Pascal Aubry University of Rennes 1 ESUP-Portail consortium EUNIS2006, Tartu, Estonia Learn Shibboleth in 20 minutes Shibboleth for the impatient
3
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Copyright © 2006 – ESUP-Portail – University of Rennes 1 Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back- Cover Texts. http://www.gnu.org/licenses/licenses.html#FDL
4
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Summary Why a federation? Technical solutions The Shibboleth system
5
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Need and context Need: give access to web resources to outside users Context –No interoperability –Single Sign-On in establishments –Need of collaboration
6
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia University A Greetings to SWITCHaai Once upon a time… Some resources not protected at all Access control based on IP addresses often used Issues with user management at resource- level So many login processes So many accounts and passwords Almost no resource shared by several establishments Sympa Moodle Research lab C Moodle Thesis Library B Search eng. Publications Access control Resource Identity management Authentication
7
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia University A Greetings SWITCHaai With SSO, it was a little better Sympa Moodle Research lab C Moodle Thesis Library B Search eng. Publications Access control Resource Identity management Authentication
8
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia University A Greetings SWITCHaai With SSO, it was a little better Locally, yes… but still the same everywhere else! Sympa Moodle Research lab C Moodle Thesis Library B Search eng. Publications Access control Resource Identity management Authentication
9
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia University A Greetings SWITCHaai Hopefully, Identity Federation has come! Sympa Moodle Research lab C Moodle Thesis Library B Search eng. Publications Access control Resource Identity management Authentication
10
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia University A Greetings SWITCHaai Hopefully, Identity Federation has come! No user management at resource-level Users authenticates only once in their establishments Users gain access to new resources Resources have a much larger audience Sympa Moodle Research lab C Moodle Thesis Library B Search eng. Publications Access control Resource Identity management Authentication
11
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Shibboleth, the SSO and the LDAP directory Shibboleth does not replace the SSO nor the LDAP directory Shibboleth needs both the SSO and the LDAP directory
12
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Security Assertion Markup Language SAML Standard OASIS en 2002 Répond à un besoin dinteropérabilité Echanges dassertions de sécurité entre services Indépendant des mécanismes dauthentification
13
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Types dassertions SAML Authentification Échange dattributs Décisions dautorisation SAML
14
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Exemple dassertion SAML <saml:Assertion MajorVersion=1 MinorVersion=0 AssertionID=128.9.167.32.12345678 Issuer=Comite Reseau des Universites IssueInstant=2002-03-21T10:02:00Z> <saml:Conditions NotBefore=2002-03-21T10:02:00Z NotAfter=2002-03-21T10:07:00Z /> <saml:AuthenticationStatement AuthenticationMethod=password AuthenticationInstant=2002-03-21T10:02:00Z> <saml:NameIdentifier SecurityDomain=www.cru.fr Name=osalaun /> SAML
15
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Liberty Alliance SAML Liberty Alliance Liberty Alliance nest pas un produit Consortium dindustriels produisant des spécifications sur la gestion didentités Sappuie sur SAML Implémenté dans de nombreux produits Retenu par lADAE pour « Mon Service Public » SourceID Sun LASSO
16
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Les frameworks de Liberty Alliance SAML Liberty Alliance ID-FF (Federation Framefork) –Fédération de comptes –Délégation dauthentification –Single logout ID-WSF (Web Services Framework) –Propagation dattributs utilisateur –Recherche de services didentités –Échange de méta données SourceID Sun LASSO
17
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Shibboleth SAML ShibbolethLiberty Alliance Shibboleth SourceID Sun LASSO Norme et produit développé par Internet2 Open source Première version en 2002 Basé sur SAML (bibliothèque OpenSAML) Utilisé par la communauté enseignement/recherche –en production en Suisse, USA, Angleterre, Finlande, Australie –en cours de déploiement en Belgique, Allemagne
18
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Shibboleth SAML ShibbolethLiberty Alliance Shibboleth SourceID Sun LASSO Conçu pour interconnecter les SSO des établissements Fonctionnalités –Délégation dauthentification –WAYF pour orienter lutilisateur –Propagation des attributs utilisateur –Partage de méta données –Définition de règles de confiance
19
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Dautres normes basées sur SAML SAML ShibbolethLiberty Alliance Shibboleth SourceID Sun LASSO Oblix
20
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia WS-Federation SAML ShibbolethLiberty Alliance Shibboleth SourceID Sun LASSO Oblix WS-* WS-Federation ADFS Draft porté par Microsoft et IBM, 2003 Basée sur les spécifications WS-* –WS-Security, WS-Trust, WS-Policy, WS-MetadataExchange Définit léchange didentités et dattributs entre domaines de sécurité
21
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Formats, protocols and tools SAML ShibbolethLiberty Alliance Shibboleth SourceID Sun LASSO Oblix WS-* WS-Federation ADFS
22
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia The choice of Shibboleth Advanced features –Attribute management –Anonymization –confidence (PKI) management Adapted to our environment –Several Identity Providers Interoperability –Integration with the Information System –Many applications already Shibbolized –Already adopted by others colleagues (USA, Swiss, UK, Finland…) –Non intrusive solution In any case, more and more interoperability with other tools in the future, thanks to SAML 2.0
23
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Assertion Consumer Attribute Requester Access Controller Ressource Web browser Authentication service Authentication Authority Attribute Authority User database SSO Server userId ssoId attributes userId attributes ticket attributes Shibboleth, its easy ;-) Many actors WAYF nameId Many interactions
24
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Service Provider (SP) Without Single Sign On
25
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Identity Provider (IdP) Service Provider (SP) Without Single Sign On (first request to a SP)
26
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Identity Provider (IdP) Service Provider (SP) userId password Without Single Sign On (first request to a SP) nameId attributes
27
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Identity Provider (IdP) Service Provider (SP) 1 2 3 4 Without Single Sign On (first request to a SP) userId password
28
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Identity Provider (IdP) Service Provider (SP) Without Single Sign On (next requests to the same SP)
29
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Service Provider (SP) Assertion Consumer Attribute Requester Access Controller Resource Web browser Identity Provider (IdP) attributes nameId Service Provider architecture userId password nameId attributes
30
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Fournisseur didentités Authentication service Authentication Authority Attribute Authority User database nameId attributes userId Assertion Consumer Attribute Requester Access Controller Resource Web browser attributes nameId Identity Provider architecture userId password userId attributes
31
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Fournisseur didentités Authentication service Authentication Authority Attribute Authority User database nameId attributes userId Assertion Consumer Attribute Requester Access Controller Resource Web browser attributes nameId What is Shibboleth? userId password userId attributes Shibboleth
32
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller Resource User database SSO server With Single Sign On (first request to a SP)
33
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller Resource User database SSO server userId attributes userId attributes ticket attributes With Single Sign On (first request to a SP) nameId password nameId
34
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller Resource User database SSO server With Single Sign On (the users point of view) 1 2 3 4 userIdpassword
35
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller Resource User database SSO server With Single Sign On (next requests to the same SP)
36
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller Resource User database SSO server userId ssoId ticket With Single Sign On (next requests to another SP) nameId attributes userId attributes nameId
37
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller Resource User database SSO server With Single Sign On (next requests to another SP) userId ssoId ticket nameId attributes userId attributes nameId
38
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller Resource User database SSO server With SSO and WAYF (first request to a SP) WAYF
39
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller Resource User database SSO server With SSO and WAYF (first request to a SP) WAYF
40
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller Resource User database SSO server With SSO and WAYF (first request to a SP) WAYF userId attributes userId attributes ticket attributes nameId password nameId
41
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Resource Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller User database SSO server With SSO and WAYF (the users point of view) WAYF 1 4 5 6 2 3 userIdpassword
42
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller Resource User database SSO server With SSO and WAYF (next requests to the same SP) WAYF
43
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller Resource User database SSO server WAYF With SSO and WAYF (next requests to another SP)
44
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller Resource User database SSO server With SSO and WAYF (next requests to another SP) WAYF userId ssoId ticket nameId attributes userId attributes nameId
45
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Web browser Authentication service Authentication Authority Attribute Authority Assertion Consumer Attribute Requester Access Controller Resource User database SSO server WAYF With SSO and WAYF (next requests to another SP) 1 4 2 3
46
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Service Provider #1 Web browser Identity Provider (IdP) attributes for SP#1 nameId Service Provider #2 (encrypted) attributes for SP#2 nameId Multi-tiers installations (encrypted) attributes for SP#2
47
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Portal Web browser Content provider #1 An application : meta search engines Content provider # 2 Content provider # n...
48
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia university Cuniversity B university A SP WAYF Browser IdP A IdP BIdP C WAYF et topology SP
49
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Integration of an IdP into the IS Web browser Authentication service Authentication Authority Attribute Authority User database SSO server Service Provider userId ticket attributes userId nameId SSO J2EE filter Attributes retrieval –LDAP directories –Databases, –…–…
50
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Authentication Authority Attribute Authority ARP Attribute Release Policy Navigateur Authentication service User database SSO server Service Provider #3 userId ticket attributes userId nameId supannOrganisme eduPersonAffiliation edupersonPrincipalName supannRole mail Service Provider #2 Service Provider #3
51
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Anonymous access to a Service Provider The users profiles can be transmitted without any personal data An opaque but persistent identifier can be provided (targetedId) The users UID and global identifier are managed just like any other attribute
52
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia Online course reserved to students in mathematics Autorisation based on the students profile speciality The need of a common naming space University A University C University B specialityspectopic
53
Copyright © 2005 – ESUP-Portail – University of Rennes 1 – Pascal Aubry Open-source Identity Federation with Shibboleth, Pascal Aubry, EUNIS2006, Tartu, Estonia The need of a common semantics University A Online course reserved to students in mathematics University C University B Autorisation based on the students profile speciality = mathematicsspeciality = Mathematicsspeciality = MATH
54
Copyright © 2006 – ESUP-Portail consortium – University of Rennes 1 – Pascal Aubry References: http://shibboleth.internet2.edu http://federation.cru.fr EUNIS2006, Tartu, Estonia
Similar presentations
© 2024 SlidePlayer.com. Inc.
All rights reserved.