Connecting Web and Kerberos SSO Connecting Web and Kerberos SSO Rok - - PowerPoint PPT Presentation

▶
connecting web and kerberos sso connecting web and
SMART_READER_LITE
LIVE PREVIEW

Connecting Web and Kerberos SSO Connecting Web and Kerberos SSO Rok - - PowerPoint PPT Presentation

Dec 17, 2023 176 likes •355 views

Akademska in raziskovalna mrea Slovenije Connecting Web and Kerberos SSO Connecting Web and Kerberos SSO Rok Pape ARNES aaa-podpora@arnes.si Cork Institute of Technology Cork, Ireland, 19.5.2009 Kerberos Kerberos Akademska in

slide-1
SLIDE 1

Akademska in raziskovalna mreža Slovenije

Connecting Web and Kerberos SSO Connecting Web and Kerberos SSO

Rok Papež ARNES aaa-podpora@arnes.si Cork Institute of Technology

Cork, Ireland, 19.5.2009

slide-2
SLIDE 2

Akademska in raziskovalna mreža Slovenije

Authentication protocol

– (No) authorization

Single Sign On (SSO) Cerberus

– Greek and Roman mythology – 3 headed dog guarding the gates of Hades

MIT Project Athena

– Versions 1-3 internal only – Version 4 – 1989 (public software release)

  • DES only, Protocol flaws, End of life

– Version 5 – 1993 (RFC 1510) – GSS-API – Generic security services API – IETF Kerberos working group

Kerberos Kerberos

slide-3
SLIDE 3

Akademska in raziskovalna mreža Slovenije

MIT Kerberos

– Krb5-1.6.3 – Krb5-1.7 beta (22.4.) – Most popular – Subject to USA cryptography export regulations

Heimdal

– Heimdal-1.2.1 – Developed in Sweden – Better security track record – More features

Microsoft Windows 2000 and later

– ActiveDirectory default authentication protocol – AuthZ extension: PAC – Privilege Access Certificate

Kerberos implementations Kerberos implementations

slide-4
SLIDE 4

Akademska in raziskovalna mreža Slovenije

Inband for different protocols

– IMAP, POP, Telnet, SSH, Cisco routers ...

3rd party trust point - KDC

– KDC – Key Distribution Center – Symmetric key cryptography

Client acquires TGT from KDC

– TGT - Ticket Granting Ticket – Client-KDC trust via shared secret – password – User prompted for password! User prompted for password!

Client uses TGT to request Service ticket from KDC

– User isn't prompted for password – KDC issues a time limited Service ticket for ServiceX

How Kerberos works How Kerberos works

slide-5
SLIDE 5

Akademska in raziskovalna mreža Slovenije

Kerberos diagram Kerberos diagram

slide-6
SLIDE 6

Akademska in raziskovalna mreža Slovenije

Kerberos demo Kerberos demo Simple Kerberos demo Cheat sheet:

– kinit – klist [-v] – kgetcred <service> – kdestroy [--credential=service]

slide-7
SLIDE 7

Akademska in raziskovalna mreža Slovenije

Bad administrator documentation Horrible developer documentation Questionable security track record Not suitable to run as a „public“ internet service

– From design-on treated as a LAN or campus service – Static 2-way or spoke and hub inter-realm trust – Always firewalled

Bad authorization support

– Kerberos doesn't provide much data – Kerberos AutZ in application: check if userID is present

SPNEGO for web applications

– Simple and protected GSSAPI Negotiation mechanism – Limited to local network use

Kerberos shortcomings Kerberos shortcomings

slide-8
SLIDE 8

Akademska in raziskovalna mreža Slovenije

Distributed AAI using SAML Distributed AAI using SAML SAML – Security Assertion Markup Language

– Data format / standard

Web applications

– Seperate login from application – Single Sign On (SSO) – User authenticates via „login application“

  • IdP – Identity Provider

– Authorization data sent to „service application“

  • SP – Service Provider
  • Module in web server
  • Application library

SAML 1.0 – OASIS standard, 2002 SAML 2.0 – OASIS standard, 2005

slide-9
SLIDE 9

Akademska in raziskovalna mreža Slovenije

SAML-AAI implementations SAML-AAI implementations Shibboleth IdP, SP

– http://shibboleth.internet2.edu/ – Older – Very configurable – Java

SimpleSAMLphp IdP, SP

– http://rnd.feide.no/simplesamlphp – Newer – Very easy to use – PHP

slide-10
SLIDE 10

Akademska in raziskovalna mreža Slovenije

How SAML-AAI works How SAML-AAI works 3rd party trust point

– Metadata distribution point (Web server URL) – X.509 public key cryptography

Web browser redirects

– WAYF/DS – Where Are You From/Discovery Service

Auto-submit forms

– IdP sends authorization data from LDAP to SP

Cookies for SSO session at IdP

slide-11
SLIDE 11

Akademska in raziskovalna mreža Slovenije

SAML-AAI Diagram SAML-AAI Diagram

http://www.switch.ch/aai/demo

slide-12
SLIDE 12

Akademska in raziskovalna mreža Slovenije

SAML-AAI demo SAML-AAI demo Video demo!

(screencast of user accessing Foodle and Adobe Connect aplications secured via web server integrated Shibboleth SP login via SimpleSAMLphp IdP)

slide-13
SLIDE 13

Akademska in raziskovalna mreža Slovenije

SAML-AAI

– Web applications – Internet-wide – X.509 PKI – SAML – Authorization data

Comparing SAML-AAI and Kerberos Comparing SAML-AAI and Kerberos Kerberos

– (Mostly) Non-web applications – Local/campus networks – (Mostly) symmetric keys – ASN.1 – (Mostly) no authorization data

SAML-AAI and Kerberos are SAML-AAI and Kerberos are not not competing protocols! competing protocols!

slide-14
SLIDE 14

Akademska in raziskovalna mreža Slovenije

Interoperating SAML-AAI and Kerberos Interoperating SAML-AAI and Kerberos Hybrid web applications:

– Web interface – Access to backend Kerberos protected services – Login via SAML-AAI + get Kerberos ticket

Problems:

– Identity mapping

  • Which Kerberos principal name to use?
  • Kerberos principal name: userX@org.eu
  • org.eu is Kerberos LAN/Campus realm
  • SAML identity

– EduPersonPrincipalName: userX@uni.eu – EduPersonTargetedId: kl83HlsnblqYskgh72Kfqkl

– User provisioning (new user?!) – Getting service tickets from KDC for userX@org.eu

slide-15
SLIDE 15

Akademska in raziskovalna mreža Slovenije

Hybrid SAML-AAI with Kerberos diagram Hybrid SAML-AAI with Kerberos diagram

slide-16
SLIDE 16

Akademska in raziskovalna mreža Slovenije

ARNES AAI team ARNES AAI team http://aai.arnes.si http://www.eduroam.si e-mail: aaa-podpora@arnes.si

Questions? Questions?