mod_auth_pubtkt a pragmatic Web Single Sign-On solution by Manuel - - PowerPoint PPT Presentation

▶
mod auth pubtkt
SMART_READER_LITE
LIVE PREVIEW

mod_auth_pubtkt a pragmatic Web Single Sign-On solution by Manuel - - PowerPoint PPT Presentation

Jan 07, 2024 23 likes •246 views

mod_auth_pubtkt a pragmatic Web Single Sign-On solution by Manuel Kasper, Monzoon Networks AG mkasper@monzoon.net The login hell mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008 Solutions use client

slide-1
SLIDE 1

mod_auth_pubtkt

a pragmatic Web Single Sign-On solution

by Manuel Kasper, Monzoon Networks AG

mkasper@monzoon.net

slide-2
SLIDE 2

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

The login hell

slide-3
SLIDE 3

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Solutions

  • use client certificates and OCSP

– and get killed by end users? – still only AuthN, no (centralized) AuthZ

  • use LDAP

– users still need to log in for each server → not SSO

  • SPNEGO/GSSAPI/Kerberos/NTLM

– Integrated Windows Authentication → MS centric – not supported by all browsers

slide-4
SLIDE 4

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Solutions

  • Shibboleth

– very powerful... and very bloated

  • Pubcookie

– basically a nice solution (a bit complicated to set up) – no AuthZ

  • CoSign

– promising, but still a bit too complicated – service web servers communicate with login server

slide-5
SLIDE 5

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Solutions

  • use a commercial solution

– not our goal

slide-6
SLIDE 6

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

There’s one more...

  • mod_auth_tkt

– operates on simple “ticket” cookies – open login server implementation (example CGI script + library provided) – flexible and quite easy to use – uses keyed MD5 to authenticate tickets

slide-7
SLIDE 7

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Enter mod_auth_pubtkt

  • mod_auth_pubtkt

– based (loosely) on mod_auth_tkt – uses public-key cryptography instead of MD5 – DSA and RSA supported – private key only known to login server

slide-8
SLIDE 8

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

How it works

Client Web server

foo.example.com

Login server

sso.example.com

Initial request Redir to login server Login request (user/pass) authenticate check cookie Response ... Request + Redirect to web server + domain cookie *.example.com

slide-9
SLIDE 9

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Anatomy of a ticket

uid=mkasper;cip=192.168.200.163;validuntil=1201383542; tokens=foo,bar;udata=mydata;sig=MC0CFDkCxODPml+cEvAuO +o5w7jcvv/UAhUAg/Z2vSIjpRhIDhvu7UXQLuQwSCF=

user ID

(REMOTE_USER environment variable)

client IP address (optional) expiration date

(UNIX timestamp)

slide-10
SLIDE 10

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Anatomy of a ticket

uid=mkasper;cip=192.168.200.163;validuntil=1201383542; tokens=foo,bar;udata=mydata;sig=MC0CFDkCxODPml+cEvAuO +o5w7jcvv/UAhUAg/Z2vSIjpRhIDhvu7UXQLuQwSCF=

user data (optional) Tokens (think of groups)

slide-11
SLIDE 11

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Anatomy of a ticket

uid=mkasper;cip=192.168.200.163;validuntil=1201383542; tokens=foo,bar;udata=mydata;sig=MC0CFDkCxODPml+cEvAuO +o5w7jcvv/UAhUAg/Z2vSIjpRhIDhvu7UXQLuQwSCF=

RSA DSA

SHA1 Base64

Private key

slide-12
SLIDE 12

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Generating the key pair

# openssl genrsa -out privkey.pem 1024 # openssl rsa -in privkey.pem -out pubkey.pem -pubout # openssl dsaparam -out dsaparam.pem 1024 # openssl gendsa -out privkey.pem dsaparam.pem # openssl dsa -in privkey.pem -out pubkey.pem -pubout

DSA RSA

slide-13
SLIDE 13

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

DSA vs. RSA

  • it doesn’t really matter – in doubt use RSA

Signature size Verification speed DSA 64 bytes ~400/sec. RSA 172 bytes ~4000/sec.

* 1024-bit key/modulus, P4 2.8 GHz, size including Base64 encoding

slide-14
SLIDE 14

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Web server configuration

LoadModule auth_pubtkt_module libexec/apache/mod_auth_pubtkt.so AddModule mod_auth_pubtkt.c # Apache 1.3 only

slide-15
SLIDE 15

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Web server configuration

<VirtualHost *:80> ServerName myserver.example.com DocumentRoot /path/to/my/htdocs TKTAuthPublicKey /etc/apache2/tkt_pubkey.pem <Directory /path/to/my/htdocs> Order Allow,Deny Allow from all AuthType Basic TKTAuthLoginURL https://sso.example.com/login TKTAuthTimeoutURL https://sso.example.com/login?timeout=1 TKTAuthUnauthURL https://sso.example.com/login?unauth=1 TKTAuthToken "myserver" require valid-user </Directory> </VirtualHost>

path to public key file redirection URLs (for unauthenticated clients etc.) (optional) tokens required in ticket

slide-16
SLIDE 16

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Windows version

  • pre-compiled binaries available

– painstakingly compiled by me... ;)

slide-17
SLIDE 17

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Login server

  • simple PHP library (and example login script)

provided

– function pubtkt_generate($privkeyfile, $privkeytype, $uid, $clientip, $validuntil, $tokens, $udata)

  • easy to implement in any language that allows

access to OpenSSL

– even if only to the command-line openssl binary

slide-18
SLIDE 18

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Disadvantages of mod_auth_pubtkt

  • for Apache only

– writing an IIS module should be feasible

  • current version relies on domain cookies

– all web servers must be in the same domain – rogue web server could steal ticket (→ use secure cookies; embed client’s IP address in ticket)

  • no “ticket refreshing”

– probably a bad idea from a security point of view anyway

slide-19
SLIDE 19

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Live demonstration

slide-20
SLIDE 20

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Where to get it

http://neon1.net/mod_auth_pubtkt

slide-21
SLIDE 21

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Questions?

?

http://neon1.net/mod_auth_pubtkt

slide-22
SLIDE 22

mod_auth_pubtkt ::: Manuel Kasper, Monzoon Networks AG ::: SwiNOG 16, 14.5.2008

Thank you

Thank you for your attention!