EGI-InSPIRE GridCertLib Shibboleth authentication for X.509 - - PowerPoint PPT Presentation

▶
egi inspire
SMART_READER_LITE
LIVE PREVIEW

EGI-InSPIRE GridCertLib Shibboleth authentication for X.509 - - PowerPoint PPT Presentation

Mar 01, 2023 119 likes •386 views

EGI-InSPIRE GridCertLib Shibboleth authentication for X.509 certificates and Grid proxies Sergio Maffioletti <sergio.maffioletti@gc3.uzh.ch> Grid Computing Competence Centre, University of Zurich http://www.gc3.uzh.ch/ GridCertLib EGI

slide-1
SLIDE 1

EGI-InSPIRE

GridCertLib Shibboleth authentication for X.509 certificates and Grid proxies

Sergio Maffioletti <sergio.maffioletti@gc3.uzh.ch>

Grid Computing Competence Centre, University of Zurich http://www.gc3.uzh.ch/

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-2
SLIDE 2

The Problem with Portals

How to get a Grid proxy into the portal host?

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-3
SLIDE 3

What is GridCertLib?

Java library to create an X.509 certificate and a VOMS proxy upon successful login to the portal. For Users: No interaction with Grid middleware required at all. For programmers: assures that, once a user has logged in, valid certificate and proxy are available. Key ingredients:

  • Shibboleth federated authentication
  • SLCS online CA

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-4
SLIDE 4

Shibboleth

  • HTTP-based operation
  • User credentials are authenticated by the home
  • rganization Identity Provider (IdP) server only
  • IdP controls what information about the authenticated user

is sent to the Service Provider (SP)

  • Passwords and other sensitive data are never disclosed to

Service Providers

  • Service Providers only need to trust the limited number of

IdPs for authentication purposes.

Shibboleth login workflow GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-5
SLIDE 5

The SWITCH AAI Infrastructure Switzerland-wide federated authentication infrastructure.

  • Based on Shibboleth 2.x
  • “Identity Providers” already operational at every University

and several other research centres.

  • One login/password to access a variety of services (e.g.,

e-mail, ... and SLCS!)

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-6
SLIDE 6

Short-Lived Credential Service

Web service to create an X.509 user certificate, valid for 11 days.

  • A new certificate at each successful invocation
  • Same subject DN every time
  • Command-line client (Java-based) available in gLite 3.x

Uses AAI/Shibboleth authentication. SWITCH SLCS CA is already in the IGTF bundle

  • SLCS certificates can be used for normal Grid operations

Already in use in SMSCG, the Swiss national Grid infrastructure.

More on SLCS GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-7
SLIDE 7

Architecture

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-8
SLIDE 8

GridCertLib operation (1)

mod_shib mod_shib Certificate storage Certificate storage

GridCertLib

Shibboleth/ AAI Idp Shibboleth/ AAI Idp SLCS SLCS VOMS VOMS ID-WSF ECP library

1 2 3 4 5 6

Users log in to the web portal using Shibboleth single sign-on.

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-9
SLIDE 9

GridCertLib operation (2)

mod_shib mod_shib Certificate storage Certificate storage

GridCertLib

Shibboleth/ AAI Idp Shibboleth/ AAI Idp SLCS SLCS VOMS VOMS ID-WSF ECP library

1 2 3 4 5 6

Users are authenticated by their home organization “Identity Provider” (IdP). (This is all transparently handled by the Shibboleth software.)

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-10
SLIDE 10

GridCertLib operation (3)

mod_shib mod_shib Certificate storage Certificate storage

GridCertLib

Shibboleth/ AAI Idp Shibboleth/ AAI Idp SLCS SLCS VOMS VOMS ID-WSF ECP library

1 2 3 4 5 6

The portal calls GridCertLib. GridCertLib retrieves the SAML2 assertion (Shibboleth login data) from Apache’s mod shib.

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-11
SLIDE 11

GridCertLib operation (4)

mod_shib mod_shib Certificate storage Certificate storage

GridCertLib

Shibboleth/ AAI Idp Shibboleth/ AAI Idp SLCS SLCS VOMS VOMS ID-WSF ECP library

1 2 3 4 5 6

The portal application code calls GridCertLib to obtain a X.509 certificate. This step requires delegation of the Shibboleth credentials (SAML2 assertion) to the SLCS login service. done through Identity Domain

  • Web Service Framework

(ID-WSF) ECP Web Service Client

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-12
SLIDE 12

GridCertLib operation (5)

mod_shib mod_shib Certificate storage Certificate storage

GridCertLib

Shibboleth/ AAI Idp Shibboleth/ AAI Idp SLCS SLCS VOMS VOMS ID-WSF ECP library

1 2 3 4 5 6

GridCertLib generates an X.509 certificate, signs it using SLCS, and then generates a VOMS proxy.

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-13
SLIDE 13

SLCS: Technical issues

Obtaining a user certificate requires delegation of the Shibboleth credentials to the SLCS login service.

  • SLCS web service requires Shibboleth authentication...
  • ...but AuthN data is only valid towards SP!

Delegation issue

  • Shibboleth 2.1.x supports delegation of credentials
  • but deployed IdP’s not (yet) up to that version

Solution

  • use pre-production Shibboleth 2.2 IdP with delegation

extension (at SWITCH)

  • register/manage portal user accounts there
  • will merge with the production infrastructure eventually

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-14
SLIDE 14

GridCertLib operations (5)

Generate X.509 certificate:

mod_shib mod_shib Certificate storage Certificate storage GridCertLib Shibboleth/ AAI Idp Shibboleth/ AAI Idp SLCS SLCS VOMS VOMS ID-WSF ECP library

1 2 3 4 5 6

  • 1. Login to SLCS endpoint
  • 2. SLCS server verifies AuthN data

with IdP

  • 3. SLCS replies with a “session”

token and information to generate a CSR

  • 4. Generate a private key and a

CSR

  • 5. Submit CSR to SLCS endpoint
  • 6. Get back signed certificate in

response Then, generate proxy and contact VOMS server.

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-15
SLIDE 15

GridCertLib operations (6)

Store certificate and proxy on the disk, ready for use.

(Encrypted with a random password, which is returned by the GridCertLib API.)

Users only interact via WWW, and passwords are sent to the IdP only (and only once per login!)

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-16
SLIDE 16

P-GRADE integration

Two main action items:

  • Enable Shibboleth login at the GridSphere level
  • Initially done by the Australian MAMS project
  • Requires some lengthy procedure to make login data

compatible with the DB storage

  • Insert calls to GridCertLib into the login code
  • Java code calling Java code, no big issue
  • Disable P-GRADE’s native certificate handling
  • Certificate management is now handled by GridCertLib

More on P-GRADE integration GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-17
SLIDE 17

Django integration

Issue: How to bridge Python with Java?

  • Run GridCertLib servlets in parallel with Django.
  • Use HTTP redirects to pass information back and forth.

Use Python decorators to mark view functions that require a certificate and/or Grid proxy. @proxy_required def submit_job(req): # do Grid work return HttpResponse(...)

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-18
SLIDE 18

Summary

Java library to create an X.509 certificate and a VOMS proxy upon successful login to the portal.

  • No user interaction with Grid middleware required at all.
  • Once a user has logged in, valid certificate and proxy are

available. Already integrated with P-GRADE and Django

  • Example servlets with commented code provided for

integration in other portals. Key ingredients:

  • Shibboleth federated authentication
  • SLCS online CA

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-19
SLIDE 19

Any questions? website: http://gridcertlib.googlecode.com/ e-mail: info@lists.gc3.uzh.ch Credits Peter Kunszt (SystemsX.ch), Riccardo Murri (GC3/UZH), Valery Tschopp (SWITCH)

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-20
SLIDE 20

Additional material

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-21
SLIDE 21

Shibboleth login workflow / 1 (Images cour

1 User first connects to portal web server (SP) and is redirected to the “Where Are You From?” page (WAYF)

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-22
SLIDE 22

Shibboleth login workflow / 2 (Images cour

2 User chooses Home Organisation and is redirected to the IdP AuthN page

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-23
SLIDE 23

Shibboleth login workflow / 3 (Images cour

3 User posts username/password to IdP and is redirected to

  • riginal page on SP
  • Detailed workflow much more convoluted; see extra slides

at end.

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-24
SLIDE 24

SLCS operations workflow

  • 1. Login to SLCS endpoint
  • HTTP request, using SAML assertion as AuthN data
  • 2. SLCS server verifies AuthN data with IdP
  • Need delegation functionality (Shibboleth 2.1)
  • 3. SLCS replies with a “session” token and information to

generate a CSR

  • 4. Generate a private key and a CSR
  • Private key protected by random password known only to

the portal

  • 5. Submit CSR to SLCS endpoint
  • Use “session” token from step ??
  • 6. Get back signed certificate in response

Back to SLCS Intro GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-25
SLIDE 25

More technical issues

Shibboleth authentication data has a limited time validity

  • By the time GridCertLib is called, it might have expired.

Solution

  • Use a “RenewAssertion” servlet

http://example.com/RenewAssertion?url=...

  • Forces Shibboleth logout
  • Redirects to whatever URL was specified in the initial

request

  • If the URL is Shibboleth-protected, new login data will be

generated.

  • No user interaction required until IdP session expires

(default 8 hours)

GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu

slide-26
SLIDE 26

More on P-GRADE integration

  • First-time users directed to a page with a single button

“sign up”, that only lists their Shibboleth attributes.

  • Once they hit the button:
  • Their credentials are stored in the DB but not activated

(excluded from login)

  • They are shown a page ’your request is being processed’,

the admin gets an email

  • If users try to log in again, they get the ’your request is

being processed’ page again

  • The admin needs a “Shibboleth” page in the

“Administration” section:

  • Here requests can be approved or denied
  • If approved, user can now just log in
  • If denied, user will be removed - can apply again though
  • Users get a notification email either way

Back to P-GRADE integration GridCertLib EGI TF 2012 EGI-InSPIRE RI-261323 / www.egi.eu