1. Shibboleth Akylbek Zhumabayev September 2008

2. Agenda Introduction Related Standards: SAML, WS-Trust, WS-Federation Overview: Shibboleth, GSI, GridShib Shibboleth Architecture GridShib Architecture References 2

3. Introduction Cross-domain Single Sign-On (SSO) Standards: SAML, WS-Trust, WS-Federation Started in 2000 by Internet2/MACE Current version: 2.0 (March 19, 2008) http://shibboleth.internet2.edu Open source (Apache2 license) Large projects in 15 countries 3

4. SAML Security Assertion Markup Language XML-based standard for exchanging authentication and authorization data Build over standards: HTTP, XML, XML-Signature, XML-Encryption, SOAP, Assertions: – Authentication – Attribute – Authorization decision 4

5. SAML SAML 2.0 - standards set (OASIS) Assertions and Protocols Bindings (SOAP, HTTP GET, HTTP POST etc) Profiles (SSO, Query, Attribute, Resolution etc) Metadata (related data elements) Authentication Context Conformance Requirements Security and Privacy Considerations 5

6. SAML Web Service (SOAP) Web Browser (HTTP) HTTP/1.1 200 OK … … 6 HTTP SOAP SAML

7. WS-Trust Managing tokens: issuing, renewing and validating Specification defines: – Security Token Service (STS) – Formats of messages – Mechanisms for key exchange Build over standards: WS-Security, WS-Policy, WS-PolicyAttachment 7

8. WS-Trust 1.3 (OASIS) 8 Client Resource STS Token Policy Claims Token Policy Claims Token Policy Claims RST/RSTR

9. WS-Federation Contributors: IBM, Microsoft etc. Purpose: cross-domain identity portability Current version: 1.1 (December, 2006) Carrier: SAML token Domain trust: WS-Trust Trust carrier: X.509 9

10. WS-Federation: Basic 10 Requestor Resource Identity Provider Identity Provider STS Trust 1. Obtain ST2. Obtain AT 3. Access

11. WS-Federation: Attributes 11 Requestor Resource Identity Provider Identity Provider STS Trust 1. Obtain ST 2. Obtain AT 5. Authorize Attribute & Pseudonym Service Attribute & Pseudonym Service 3. Obtain PT 4. Access 6. Obtain additional info

12. WS-Federation: Metadata [Federation Metadata] [Signature] 12

13. Overview: Shibboleth Shibboleth includes two main components: Identity Provider (IdP): – Maintain user credentials and attributes – Assert authentication statements on request Service Provider (SP): – Manages secured resources – Access is based on assertions made by IdP 13

14. Overview: Shibboleth user@X Identity Provider Identity Provider Service Provider Service Provider WAYF LDAP System Domain X Domain Y 1 2 3 Attributes 4 WS-Federation Username/password 14

15. Overview: GSI Globus Toolkit (GT) – grid middleware de-facto: – Based on Open Grid Services Architecture (OGSA) – Implements WS Resource Framework (WSRF) Globus Security Infrastructure (GSI): – Powerful and reliable implementation – Based on WS standards – X.509 authentication mechanism – Uses proxy certificates (MyProxy) 15

16. Overview: GSI GSI: X.509 Certificates Client System CA MyProxy X.509 Entity Certificate Proxy Certificate Certificates 16

17. Overview: GridShib Shibboleth is not originally integrated with grid: Username/password vs. X.509 GridShib integrates Shibboleth and GT Joint project of NCSA, University of Chicago, and Argonne National Laboratory 17

18. Overview: GridShib user@X Identity Provider Identity Provider GridShib WAYF LDAP System Domain X Grid System 1 2 3 Attributes Profile 4 WS-Federation X.509 18

19. Shibboleth Architecture 19 Identity Provider Authentication Authority Attribute Authority Artifact Resolution Service SSO Service

20. Shibboleth Architecture 20 Service Provider Assertion Consumer Service Attribute Requester Resource

21. Shibboleth Architecture 21 WAYF Resource Client 4. GET 2. GET/Form 3. GET/IdP SSO 1. GET Auth Authority Assertion Consumer 5. GET/POST 6. GET Attribute Authority Artifact Resolution Attribute Requestor

22. Shibboleth Architecture 22

23. GridShib Architecture Modules: 1.GridShib for Globus Toolkit (GS4GT) 2.GridShib for Shibboleth (GS4Shib) 3.GridShib Certificate Authority (GS-CA) 4.GridShib SAML Tools (GS-ST) Scenarios: A.SAML Web Browser SSO B.Shib-enabled GridShib CA C.Shib-enabled Science Gateway D.GridShib-enabled Grid Security Infrastructure (GSI) E.GridShib-enabled Attribute Query 23

24. GridShib Architecture 24

25. References Shibboleth official website: http://shibboleth.internet2.edu Globus Toolkit official website: http://globus.org GridShib official website: http://gridshib.globus.org OASIS official website: www.oasis-open.org 25