CARSI: Cross University Identity Management and Resource Sharing - - PowerPoint PPT Presentation

CARSI:

Cross University Identity Management and Resource Sharing over CERNET

• Prof. PING CHEN

Peking University, Beijing, China Feb, 24th, 2011

CARSI &Peking University

Agenda

n Current IdM Situation in CERNET n What is CARSI? n What are we doing? n What will we do next?

CARSI &Peking University

Authentication is developing.

CARSI &Peking University

In CERNET, most univ are …

CARSI &Peking University

In CERNET, some univ are …

CARSI &Peking University

In CERNET, some univ. are …

CARSI &Peking University

CERNET AAI situation summary

n Almost all Univ. have campus-wide IDM, for library,

campus network, MIS systems, or other applications

n Most Univ. have SSO, but SSO effecting scope

differs greatly

q One SSO serves the all kinds of applications q Multiple SSOs serve for different classes of applications q Multiple SSOs using the same user database by visiting one

physical user database or by visiting multiple synchronized physical user databases

n Not everyone likes SSO, scope is an issue

CARSI &Peking University

Authentication is developing.

Cross-univ. authn makes large scope of resource sharing possible CARSI &Peking University

What is Resource Sharing?

n Resource & Sharing

q User authentic identity resource, shared from one

• univ. campus to CERNET, to industry

q Application resource, built by one univ, shared to

more users under control

CARSI &Peking University

What is CARSI?

CERNET Authentication and Resource Sharing Infrastructure

n Goals:

q To integrate university IDMs to a CERNET federation q To share univ. authentic user info resources over CERNET q To share existing protected web applications to more users q To help industry control whom he serves for in more fine

grained

q To make full use of limited univ. funds for people with the

most strong desire

q To provide a fundamental AAI middleware for CERNET

applications

q To push new applications among universities

CARSI &Peking University

CARSI’s short history

n Initiated in 2005, being one part of a network

security project

n Extended to 4 univ. in 2008 n Extended to 30 univ. in 2010 n Till now, sponsored primarily by national

research projects

CARSI &Peking University

What are we doing?

n A CNGI pre-commercial project spreading to

30 univ.

n End in June, 2011 n Topic: federation-wide campus learning and

living Communication

n Applications include BulletinBoard Systems,

Blog, library, lecture videos, learning materials, entertainment videos, job seeking info, shopping, net disk, etc.

CARSI &Peking University

CARSI Components

CARSI &Peking University

What are we doing?

n CARSI-Fed: cross-domain federation n CARSI-portal

q A web portal for federation user to login q A web portal providing a resource list

n CARSI-WAYF/DS: where are you from, directory

service

n CARSI-Person: CARSI User Attribute Specification

q CARSI-Uid (Universal user identity): localid@domainid

n CARSI-IdP: shibboleth IdP + n CARSI-SP: shibboleth SP +

CARSI &Peking University

CARSI Workflow

n

Way 1:

• 1. Portal login
• > 2. select application from resource list
• > 3. visit web application
• > 4. visit other applications, SSO

n

Way 2:

• 1. visit a web application
• > 2. redirected to portal to login
• > 3. visit application
• > 4. visit other applications, SSO

CARSI &Peking University

Shibboleth Workflow

Referenced from SWITCH

CARSI &Peking University

CARSI Workflow – Way 1 Demo

CARSI &Peking University

CARSI Workflow – Way 1 Demo

CARSI &Peking University

CARSI Workflow – Way 1 Demo

CARSI &Peking University

CARSI Workflow – Way 1 Demo

CARSI &Peking University

CARSI Workflow – Way 1 Demo

CARSI &Peking University

What are we doing? FPR, VRD, OpenIdP

n CARSI FPR: Federation Provider Registry

q A system for federation members to manage his IdP/SP q Role based Administrator management:

n

FedAdmin, OrgAdmin, IdPAdmin, SPAdmin

q IdP/SP management based on policy

n CARSI VRD: Virtual Resource Directory

q A list of sharing web applications q Synchronized with FPR-registered SPs q Classified and exhibited for user access

n CARSI-OpenIdP

q An open identity provider q Freely registered

CARSI &Peking University

What are we doing? FIVA

Federation Inter-visit Analysis

n Goal:

q

How many and what kind of influences does cross-domain AAI bring to users(IdP) and applications(SP)?

q

How is cross-domain AAI being used?

q

What’s user’s using habit?

n Methods:

q

Federation log recording, aggregating and analysing: IdP log, SP log, DS log, etc.

q

Resource sharing statistics

n

Based on IdP, how many IdP users visit other-domain applications, their using behaviour, etc

n

Based on SP, which domain and what kind of users visit it, what is the peak visiting time, etc

q

User’s behavior and action tracking

n

Tracing user’s visiting sequence

n

Which visiting sequence is more adopted?

n

How cross-domain AAI benefit them?

CARSI &Peking University

What are we doing? FIVA

Federation Inter-visit Analysis

What are we doing? FIVA

Federation Inter-visit Analysis

n Two ways are mainly used:

q IdP + local SSO q IdP

+ customized local authentication interface + authentic user database

What are we doing? IdP + Local IdM

CARSI &Peking University

What are we doing? IdP + Local SSO

CARSI &Peking University

What are we doing? IdP + Local SSO

CARSI &Peking University

What are we doing? IdP + Local SSO

What happen, if an app support both SSO & SP?

CARSI &Peking University

What are we doing? IdP + Local SSO

What happen, if another federation is CARSI SP?

CARSI &Peking University

What are we doing? IdP + CLAI +AUDB

CARSI &Peking University

n Current Situations:

q CARSI candidate applications have different

authn and access control requirements and implementing ways.

q Resource diversity increases CARSI federation

integration difficulty.

n Goals:

q To simplify the application federation migration

with no or little code modification.

What are we doing? SP + Application

CARSI &Peking University

Applications: Before joining CARSI Fed

n Some app. required authn with simple or no authr policies. n Some app. already had authn and authr policies implemented in

modules loosely coupled with application logic.

n Some app. already had authn and authr policies dispersed in

application codes, and difficult to be separated.

n Some app. support some kind of campus-wide identity

management.

n Some app. was planning to enforce access control. n Some had been shibbolethed.

CARSI &Peking University

Authn- Required Authr- Required Authn Impl. Authr Impl. AOA – Authn only App Yes No CARSI no FAA – Fed Attribute- relying App Yes Yes CARSI Application AAIA – Authn & Authr Independent App Yes Yes CARSI CARSI AAEA – Authn & Authr Embedded App Yes Yes CARSI & Application Application

CARSI Web Application Classification

CARSI &Peking University

Authn- Required Authr- Required Authn Impl. Authr Impl. AOR – Authn only Res Yes No CARSI no FAR – Fed Attribute- relying Res. Yes Yes CARSI Application AAIR – Authn & Authr Independent Res Yes Yes CARSI CARSI AAER – Authn & Authr Embedded Res Yes Yes CARSI & Application Application

CARSI Web Application Classification

CARSI &Peking University

Authn- Required Authr- Required Authn Impl. Authr Impl. AOR – Authn only Res Yes No CARSI no FAR – Fed Attribute- relying Res. Yes Yes CARSI Application AAIR – Authn & Authr Independent Res Yes Yes CARSI CARSI AAER – Authn & Authr Embedded Res Yes Yes CARSI & Application Application

CARSI Web Application Classification

CARSI &Peking University

Authn- Required Authr- Required Authn Impl. Authr Impl. AOR – Authn only Res Yes No CARSI no FAR – Fed Attribute- relying Res. Yes Yes CARSI Application AAIR – Authn & Authr Independent Res Yes Yes CARSI CARSI AAER – Authn & Authr Embedded Res Yes Yes CARSI & Application Application

CARSI Web Application Classification

CARSI &Peking University

Authn- Required Authr- Required Authn Impl. Authr Impl. AOR – Authn only Res Yes No CARSI no FAR – Fed Attribute- relying Res. Yes Yes CARSI Application AAIR – Authn & Authr Independent Res Yes Yes CARSI CARSI AAER – Authn & Authr Embedded Res Yes Yes CARSI & Application Application

CARSI Web Application Classification

CARSI &Peking University

What will we do next?

n After the CNGI project, how to continue our work? Not sure! n A little more progresses than before, some Chinese users began

to know the technology

q Thomson Reuters + Tsinghua Univ. library q Shenzhen Univ. library q Discussion with Microsoft is on-going

n More work to do on

q still in experimental phase q Making more people know it q Finding good solutions for technical problems

CARSI &Peking University

Thank You!

CARSI: http://www.carsi.edu.cn Email: carsi@pku.edu.cn