1. PAPI 2 Distributed trust model and AA interoperability

2. 2 Elements for the new version New platforms Convergence to other solutions A distributed trust model

3. 3 New Platforms PAPI library IISApacheSquidOther PoA ? ?

4. 4 A Little Review Browser Authentication PAPI AS tokens Hcook- Lcook GPoA GPoAPoA Hcook- Lcook PoA 302+ Hcook 302+data

5. 5 A Little Review PoA University Departments Servers Same policy  Simplifies management There is one aggregator for all the hierarchy It is not necessary to notify about new PoAs X Children have the same policy than their parent New access control policies are needed

6. 6 More functionality for the model More information to control the access  Attributes Off-line On-line  Offline solution -> Privacy problem  Online solution -> online element serving the attributes

7. 7 Attribute Authority: Aproximation to the Shibboleth model Web browser Authentication data Authentication Server Encry-cookies Point of Access Temporary Signed-URLs Signed-URL Encry-cookie Attr. Auth Attributes? Attributes

8. 8 PAPI - Shibboleth models Web browser Authentication data Authentication Server Encry-cookies PoA Temporary Signed-URLs Signed-URL Encry-cookie Attr. Auth Attributes? Attributes ShireSharR.M.

9. 9 Interoperability Starting to define a interoperability scenarios: PAPI - Shibboleth Interoperability aspects:  Protocol between SHAR and AA = SAML (syntax and semantics) -> openSAML  PoA should be able to manage Shibboleth user handles and interact with WAYF elements  Trust model

10. 10 PAPI - Trust model Two components  Horizontal trust: between ASes and target sites  Vertical trust: between PoAs of a organization Requirements of the model  Easy to manage  Not centralized Not TTP (third trust party) Not dedicated staff to manage it  Avoid revocations

11. 11 Trust model PoA1 PoA2 PoA3 C3: S PoA1 (Cert PoA3) C1: Cert PoA1 Pub keys of AAs PoA C2: Cert PoA2 C4: S PoA2 (Cert PoA3) S C3 (Attributes ?) S AA (K C3 (Attributes)) S C4 (Attributes ?) S AA (K C4 (Attributes)) AA 1 C1: Cert PoA1 AS AA 2 AS AA 3 AS

12. 12 Some managment examples: New PoA in the fabric AA 1 PoA1 PoA2 PoA3 S PoA1 (Cert PoA3) + Cert PoA1 AA 2 Pub key of PoA3 Pub key of PoA2 Cert PoA2 S PoA2 (Cert PoA3) + Pubs of AAs Sign request

13. 13 Some managment examples: New AA in the fabric AA 1 PoA1 PoA2 PoA3 Cert of PoA1 Pub key of new AA Pub key of AA Cert of PoA1 AA 2 Cert of PoA1 S PoA1 (Cert PoA3)

14. 14 Some management examples: New keys in a trusted PoA AA PoA1 PoA2 PoA3 S PoA1 (Cert PoA3) Cert PoA1 Pub keys of AAs Pub key of PoA1 Sign request Resign needed

15. 15 Current status Core library available  Openssl  Libxml  Xmlsec Implementations running on IIS and Apache Ready for interoperability tests with Shibboleth Implementing and evaluating the trust model