Will Darby 91.514 5 April 2010 What is Federated Security Security Assertion Markup Language (SAML) Overview Example Implementations Alternative Solutions for the Internet Business Agreement Multi-organization collaboration common Accounts generally maintained by one organization Grant access for externally authenticated users Home Organization Authenticate User Remote Organization Access Resources Authentication – Verifying user identity and permissions Authorization – Permitting resource access based on identity or attribute Identity Provider (IdP) – Entity performing authentication Service Provider (SP) – Entity allowing authorized resource access Role-Based Access Control – Authorization based on user attributes rather than identity Building block for Federated Security Public Key Cryptography – Sign and encrypt data without shared secret Public/Private Keys – Complementary tokens employed by PKI Digital Signatures – Enables provable message authenticity and integrity Message Encryption – Enables message confidentiality over public networks Separation of authentication from authorization Direct resource access • No fixed content gateway Eliminate external account management • Organizations maintain user accounts and attributes User identity protection • Authorization based on user attributes or pseudonyms Decouple security implementations • PKI exchange between organizations • Internet-scalable solution First large-scale Federated Security solution Secures web sites and web applications Implements Security Assertion Markup Language (SAML) standard Initially developed for research and higher education • • • • Research collaboration Academic information providers Outsourced employee applications Extended user populations Open source project Attributes assigned to user accounts Represent group affiliation or user privilege • No predefined semantics by Shibboleth • Semantic agreement among participants • Federation and two-party arrangements Bundled with resource requests • Authenticated by IdP • Basis of resource authorization by SP Source: “Web Single Sign-On Authentication using SAML” Based on SAML Web Browser SSO Profile Standard browser request, e.g. GET Where-Are-You-From service locates IdP User browser redirected to IdP • Automated with JavaScript or manually invoked IdP specific identity verification Digitally signed security assertions Browser session enables single sign-on Authorize users across all grids nodes Minimal changes to existing security Registry to map credentials to authority Assertions passed among servers Source: “An Approach for Shibboleth and Grid Integration” Anonymous agents require user permissions Delegation permits privilege assignment User has right to manage delegation Delegated entity requests resource on user behalf IdP translates user ids across domains Source: “A Delegation Framework for Federated Identity Management” Declare Statements regarding subject • Method of authentication • Associated with attributes • Authorization to access resource Specifies issuer (SAML authority) Conditions for time and audience Advice assertions supporting evidence and updates Encoding defined by XML schema One means to exchange SAML assertions SAML profiles define other options Queries • Authentication return authentication details • Attribute return attributes for subject • AuthorizationDecision determine resource operation permission Responses • Status of query • Verified Assertions requested by query Web Service Client Identity Provider 2a. Authenticate User 2b. Create SAML Assertion Service Provider 5a. Verify Assertion 5b. Package Resource SAML protocol retrieves assertions Client requests required assertions SOAP-based web service WS-Security encodes SAML assertion XML Signature – Digital signatures, e.g. sign assertions XML Encryption – Encrypt payload WS-Security – SOAP encoding of assertions WS-Policy – Describes service security policy, e.g. assertions required WS-Trust – Alternate protocol to obtain assertions Open source Java and C++ SAML libraries SAML Assertion and Protocol support Basis of current Shibboleth implementation Version 2 supports SAML v1.0, v1.1 and v2.0 Developed for Blogging community User-centric identity management • Choice of digital address (id) • Select identity provider Discover IdP from identity URL Google Account APIs implementation Source: “OpenID 2.0: A Platform for User-Centric Identity Management” Delegate access to protected resources No use of private credentials by client Differentiates client from resource owner Server validates authorization and client Google Account APIs implementation Jane (Resource Owner) Adapted from: “The OAuth 1.0 Protocol” 0a. GetClientCredentials 0b. ClientCredentials Printer Web Site (Client) 2. Register callback 3. ok 8. Request token 9. ok 10. Get resource 11. resource Photos Web Site (Server) R.L. Morgan, S. Cantor, S. Carmody, W. Hoehn and K. Klingenstein. “Federated Security: The Shibboleth Approach.” EDUCAUSE Quarterly, Volume 27, Number 4, 2004. Pages 12-17. Available at: http://net.educause.edu/ir/library/pdf/EQM0442.pdf. K.D. Lewis and J.E. Lewis. “Web Single Sign-On Authentication using SAML.” International Journal of Computer Science Issues. Volume 2, 2009. Pages 41-48. Available at: http://www.ijcsi.org/papers/2-41-48.pdf. “Security Assertion Markup Language (SAML) V2.0 Technical Overview.” OASIS Security Services Technical Committee. March, 2008. Available at: http://www.oasisopen.org/committees/download.php/27819/sstc-saml-techoverview-2.0-cd-02.pdf. H. Gomi, M.Hatakeyama, S.Hosono and S. Fujita. “A Delegation Framework for Federated Identity Management.” Proceedings of the 2005 workshop on Digital identity management. Pages 94-103. F. Pinto and C. Fernau. “An Approach for Shibboleth and Grid Integration.” Proceedings of the UK e-Science All Hands Conference, 2005. Available at: http://www.allhands.org.uk/2005/proceedings/papers/531. pdf. D. Recordon and D. Reed. “OpenID 2.0: A Platform for UserCentric Identity Management.” Proceedings of the second ACM workshop on Digital Identity Management, 2006. Pages 11-16. E. Hammer-Lahav. “The OAuth 1.0 Protocol.” IETF Internet Draft. February, 2010. Available at: http://tools.ietf.org/html/draft-hammer-oauth-10.