The role of directories in Single Sign on Systems Victoriano Giralt - - PowerPoint PPT Presentation

▶
the role of directories in single sign on systems
SMART_READER_LITE
LIVE PREVIEW

The role of directories in Single Sign on Systems Victoriano Giralt - - PowerPoint PPT Presentation

Mar 30, 2023 328 likes •1.4k views

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary The role of directories in Single Sign on Systems Victoriano Giralt Central Computing Facility University of Malaga TERENA EuroCAMP Ljubljana April 3rd

slide-1
SLIDE 1

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The role of directories in Single Sign on Systems

Victoriano Giralt

Central Computing Facility University of Malaga

TERENA EuroCAMP Ljubljana April 3rd 2006

Victoriano Giralt Directories and SSO

slide-2
SLIDE 2

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Outline

1

The Dark Ages

Victoriano Giralt Directories and SSO

slide-3
SLIDE 3

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Outline

1

The Dark Ages

2

The Enlightenment

Victoriano Giralt Directories and SSO

slide-4
SLIDE 4

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Outline

1

The Dark Ages

2

The Enlightenment

3

The Industrial Revolution

Victoriano Giralt Directories and SSO

slide-5
SLIDE 5

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Outline

1

The Dark Ages

2

The Enlightenment

3

The Industrial Revolution

4

The XXI century

Victoriano Giralt Directories and SSO

slide-6
SLIDE 6

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The Dark Ages of Authentication

there were no directories

There is no central credential repository

Victoriano Giralt Directories and SSO

slide-7
SLIDE 7

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The Dark Ages of Authentication

there were no directories

There is no central credential repository Each and every application has its own credential repository

Victoriano Giralt Directories and SSO

slide-8
SLIDE 8

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The Dark Ages of Authentication

there were no directories

There is no central credential repository Each and every application has its own credential repository Users are in the midst of their worst nightmare

Victoriano Giralt Directories and SSO

slide-9
SLIDE 9

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The Enlightenment of Authentication

there IS a directory

Directories appear

Victoriano Giralt Directories and SSO

slide-10
SLIDE 10

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The Enlightenment of Authentication

there IS a directory

Directories appear We have a centralised credential repository

Victoriano Giralt Directories and SSO

slide-11
SLIDE 11

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The Enlightenment of Authentication

there IS a directory

Directories appear We have a centralised credential repository We don’t really know what to do with it

Victoriano Giralt Directories and SSO

slide-12
SLIDE 12

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The Enlightenment of Authentication

there IS a directory

Directories appear We have a centralised credential repository We don’t really know what to do with it Every application does its own authentication

Victoriano Giralt Directories and SSO

slide-13
SLIDE 13

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The Enlightenment of Authentication

there IS a directory

Directories appear We have a centralised credential repository We don’t really know what to do with it Every application does its own authentication Fortunately, users only have to remember one set of credentials

Victoriano Giralt Directories and SSO

slide-14
SLIDE 14

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The Revolution in Authentication

Single Sign On

The directory disappears into the back stage

Victoriano Giralt Directories and SSO

slide-15
SLIDE 15

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The Revolution in Authentication

Single Sign On

The directory disappears into the back stage Kerberos can use the directory for AuthN

Victoriano Giralt Directories and SSO

slide-16
SLIDE 16

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The Revolution in Authentication

Single Sign On

The directory disappears into the back stage Kerberos can use the directory for AuthN Web Single Sign On systems also use the directory for AuthN

Victoriano Giralt Directories and SSO

slide-17
SLIDE 17

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The Revolution in Authentication

Single Sign On

The directory disappears into the back stage Kerberos can use the directory for AuthN Web Single Sign On systems also use the directory for AuthN Polite applications know how to do AuthN against a directory

Victoriano Giralt Directories and SSO

slide-18
SLIDE 18

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

The Revolution in Authentication

Single Sign On

The directory disappears into the back stage Kerberos can use the directory for AuthN Web Single Sign On systems also use the directory for AuthN Polite applications know how to do AuthN against a directory There are some applications left that have an attitude and we must find a way to provision them

Victoriano Giralt Directories and SSO

slide-19
SLIDE 19

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

XXI century directories do AuthZ

Storing privileges in the directory

The directory is used as an unique point for AuthoriZation

Victoriano Giralt Directories and SSO

slide-20
SLIDE 20

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

XXI century directories do AuthZ

Storing privileges in the directory

The directory is used as an unique point for AuthoriZation A sole authorization model

Victoriano Giralt Directories and SSO

slide-21
SLIDE 21

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

XXI century directories do AuthZ

Storing privileges in the directory

The directory is used as an unique point for AuthoriZation A sole authorization model Agent-Function-Qualifier

Victoriano Giralt Directories and SSO

slide-22
SLIDE 22

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Getting AuthZ to applications

  • ut of the directory

Direct directory search

Victoriano Giralt Directories and SSO

slide-23
SLIDE 23

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Getting AuthZ to applications

  • ut of the directory

Direct directory search Web services

Victoriano Giralt Directories and SSO

slide-24
SLIDE 24

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Getting AuthZ to applications

  • ut of the directory

Direct directory search Web services Authorization assertions for Web SSO systems

Victoriano Giralt Directories and SSO

slide-25
SLIDE 25

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Getting AuthZ to applications

  • ut of the directory

Direct directory search Web services Authorization assertions for Web SSO systems Provisioning for applications with an attitude

Victoriano Giralt Directories and SSO

slide-26
SLIDE 26

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Summary

No one is using multiple credentials anymore

Victoriano Giralt Directories and SSO

slide-27
SLIDE 27

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Summary

No one is using multiple credentials anymore, true?

Victoriano Giralt Directories and SSO

slide-28
SLIDE 28

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Summary

No one is using multiple credentials anymore, true? A single set of credentials

Victoriano Giralt Directories and SSO

slide-29
SLIDE 29

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Summary

No one is using multiple credentials anymore, true? A single set of credentials Central AuthN/AuthZ management

Victoriano Giralt Directories and SSO

slide-30
SLIDE 30

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Summary

No one is using multiple credentials anymore, true? A single set of credentials Central AuthN/AuthZ management Fast provision

Victoriano Giralt Directories and SSO

slide-31
SLIDE 31

The Dark Ages The Enlightenment The Industrial Revolution The XXI century Summary

Summary

No one is using multiple credentials anymore, true? A single set of credentials Central AuthN/AuthZ management Fast provision and deprovision

Victoriano Giralt Directories and SSO

slide-32
SLIDE 32

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Introduction to technical matters

How we can achieve XXI century directory based AuthN/Z

We have different options depending on

Victoriano Giralt Directories and SSO

slide-33
SLIDE 33

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Introduction to technical matters

How we can achieve XXI century directory based AuthN/Z

We have different options depending on the kind of applications we want to integrate

Victoriano Giralt Directories and SSO

slide-34
SLIDE 34

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Introduction to technical matters

How we can achieve XXI century directory based AuthN/Z

We have different options depending on the kind of applications we want to integrate the kind of infrastructure we are using

Victoriano Giralt Directories and SSO

slide-35
SLIDE 35

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Introduction to technical matters

How we can achieve XXI century directory based AuthN/Z

We have different options depending on the kind of applications we want to integrate the kind of infrastructure we are using the desired level of interoperability

Victoriano Giralt Directories and SSO

slide-36
SLIDE 36

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Introduction to technical matters

How we can achieve XXI century directory based AuthN/Z

We have different options depending on the kind of applications we want to integrate the kind of infrastructure we are using the desired level of interoperability Web applications, easier to integrate into the SSO picture

Victoriano Giralt Directories and SSO

slide-37
SLIDE 37

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Introduction to technical matters

How we can achieve XXI century directory based AuthN/Z

We have different options depending on the kind of applications we want to integrate the kind of infrastructure we are using the desired level of interoperability Web applications, easier to integrate into the SSO picture Traditional applications are a much different issue

Victoriano Giralt Directories and SSO

slide-38
SLIDE 38

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Active Directory Server

The MS way of things

Designed for a Microsoft centric environment

Victoriano Giralt Directories and SSO

slide-39
SLIDE 39

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Active Directory Server

The MS way of things

Designed for a Microsoft centric environment Works for web and non web applications

Victoriano Giralt Directories and SSO

slide-40
SLIDE 40

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Active Directory Server

The MS way of things

Designed for a Microsoft centric environment Works for web and non web applications as long as they are on MS-Windows

Victoriano Giralt Directories and SSO

slide-41
SLIDE 41

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Active Directory Server

The MS way of things

Designed for a Microsoft centric environment Works for web and non web applications as long as they are on MS-Windows Not much interoperable

Victoriano Giralt Directories and SSO

slide-42
SLIDE 42

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Active Directory Server

The MS way of things

Designed for a Microsoft centric environment Works for web and non web applications as long as they are on MS-Windows Not much interoperable Can do AuthN to another LDAP using ADAM

Victoriano Giralt Directories and SSO

slide-43
SLIDE 43

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Active Directory Server

The MS way of things

Designed for a Microsoft centric environment Works for web and non web applications as long as they are on MS-Windows Not much interoperable Can do AuthN to another LDAP using ADAM Can be tamed with the help of Kerberos

Victoriano Giralt Directories and SSO

slide-44
SLIDE 44

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Active Directory Federation Services

The F word comes into play

Designed for interoperating with non Microsoft environments

Victoriano Giralt Directories and SSO

slide-45
SLIDE 45

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Active Directory Federation Services

The F word comes into play

Designed for interoperating with non Microsoft environments Works with LDAP for AuthN thanks to ADAM

Victoriano Giralt Directories and SSO

slide-46
SLIDE 46

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Active Directory Federation Services

The F word comes into play

Designed for interoperating with non Microsoft environments Works with LDAP for AuthN thanks to ADAM Uses SAML for federating

Victoriano Giralt Directories and SSO

slide-47
SLIDE 47

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Active Directory Federation Services

The F word comes into play

Designed for interoperating with non Microsoft environments Works with LDAP for AuthN thanks to ADAM Uses SAML for federating Only for Web SSO

Victoriano Giralt Directories and SSO

slide-48
SLIDE 48

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Active Directory Federation Services

The F word comes into play

Designed for interoperating with non Microsoft environments Works with LDAP for AuthN thanks to ADAM Uses SAML for federating Only for Web SSO Available on Windows 2003 Server R2

Victoriano Giralt Directories and SSO

slide-49
SLIDE 49

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Oracle SSO

You play by our rules

Centred around iAS and OID

Victoriano Giralt Directories and SSO

slide-50
SLIDE 50

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Oracle SSO

You play by our rules

Centred around iAS and OID Mainly Web SSO

Victoriano Giralt Directories and SSO

slide-51
SLIDE 51

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Oracle SSO

You play by our rules

Centred around iAS and OID Mainly Web SSO It is not clear it can integrate non web apps

Victoriano Giralt Directories and SSO

slide-52
SLIDE 52

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Oracle SSO

You play by our rules

Centred around iAS and OID Mainly Web SSO It is not clear it can integrate non web apps Can integrate external web apps via Apache module (mod_osso) or SDK

Victoriano Giralt Directories and SSO

slide-53
SLIDE 53

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Oracle SSO

You play by our rules

Centred around iAS and OID Mainly Web SSO It is not clear it can integrate non web apps Can integrate external web apps via Apache module (mod_osso) or SDK Has an API for interoperation but needs user synchronisation

Victoriano Giralt Directories and SSO

slide-54
SLIDE 54

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Permis is an AAI with a Privilege Management Infrastructure

Victoriano Giralt Directories and SSO

slide-55
SLIDE 55

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Permis is an AAI with a Privilege Management Infrastructure Based on X.509 Attribute Certificates

Victoriano Giralt Directories and SSO

slide-56
SLIDE 56

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Permis is an AAI with a Privilege Management Infrastructure Based on X.509 Attribute Certificates The certificates do a strong bind between holder and granted privilege

Victoriano Giralt Directories and SSO

slide-57
SLIDE 57

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Permis is an AAI with a Privilege Management Infrastructure Based on X.509 Attribute Certificates The certificates do a strong bind between holder and granted privilege Privileges granted can range from University degrees through file access

Victoriano Giralt Directories and SSO

slide-58
SLIDE 58

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Permis is an AAI with a Privilege Management Infrastructure Based on X.509 Attribute Certificates The certificates do a strong bind between holder and granted privilege Privileges granted can range from University degrees through file access Attribute certificates are stored in the holder’s entry in the directory

Victoriano Giralt Directories and SSO

slide-59
SLIDE 59

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Permis is an AAI with a Privilege Management Infrastructure Based on X.509 Attribute Certificates The certificates do a strong bind between holder and granted privilege Privileges granted can range from University degrees through file access Attribute certificates are stored in the holder’s entry in the directory Digitally signed policies are also stored in the owner’s entry

Victoriano Giralt Directories and SSO

slide-60
SLIDE 60

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Some PERMIS key terms

Victoriano Giralt Directories and SSO

slide-61
SLIDE 61

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Some PERMIS key terms PMI Privilege Management Infrastructure

Strong authorization infrastructure that extends X.509 PKIs. It is based upon the same cryptographic principles.

Victoriano Giralt Directories and SSO

slide-62
SLIDE 62

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Some PERMIS key terms PMI AC Attribute Certificate

Strong binding of owner and attribute, based on digital signatures.

Victoriano Giralt Directories and SSO

slide-63
SLIDE 63

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Some PERMIS key terms PMI AC AA Attribute Authority

The entity that grants the privileges by issuing the Attribute Certificate to the holder. E.g: a University, the owner of a file or a manager.

Victoriano Giralt Directories and SSO

slide-64
SLIDE 64

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Some PERMIS key terms PMI AC AA Owner Certificate owner

The entity to which the privileges have been granted.

Victoriano Giralt Directories and SSO

slide-65
SLIDE 65

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Some PERMIS key terms PMI AC AA Owner Attributes Attributes

Part of the certificate that is signed, like the public key in a PKI. Can be used to store privileges and policies.

Victoriano Giralt Directories and SSO

slide-66
SLIDE 66

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Some PERMIS key terms

Victoriano Giralt Directories and SSO

slide-67
SLIDE 67

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Some PERMIS key terms SOA Source Of Authority

Equivalent to a PKI’s Root CA. It is the root of

  • trust. A resource access control system implicitly

trusts the SOA for granting access rights and privileges to it. The SOA issues ACs to AAs and end users.

Victoriano Giralt Directories and SSO

slide-68
SLIDE 68

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Some PERMIS key terms SOA PDP Policy Decision Point

Entity where AuthZ policies are stored, in a signed AC, and AuthZ decisions are taken based on such policies.

Victoriano Giralt Directories and SSO

slide-69
SLIDE 69

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Some PERMIS key terms SOA PDP PEP Policy Enforcement Point

The entity that protects access to a resource and acts based on queries to the PDP .

Victoriano Giralt Directories and SSO

slide-70
SLIDE 70

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Some PERMIS key terms SOA PDP PEP DIS Delegation Issuing Service

An entity used by the AAs to issue delegation ACs. It allows for better control, auditing and logging of the delegation of privileges. It can also reduce complexity of the privilege issuing chain.

Victoriano Giralt Directories and SSO

slide-71
SLIDE 71

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

PERMIS

X.509 based AuthZ policies

Some PERMIS key terms SOA PDP PEP DIS Non assertion Preventing privilege abuse

The owner of an AC marked as no assertion can grant the indicated privileges but cannot use

  • them. Useful for the DIS.

Victoriano Giralt Directories and SSO

slide-72
SLIDE 72

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Kerberos

taming the beasts

Kerberos, though old, will take us into the XXI century of SSO.

Victoriano Giralt Directories and SSO

slide-73
SLIDE 73

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Kerberos

taming the beasts

Kerberos, though old, will take us into the XXI century of SSO. It can use the directory for AuthN

Victoriano Giralt Directories and SSO

slide-74
SLIDE 74

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Kerberos

taming the beasts

Kerberos, though old, will take us into the XXI century of SSO. It can use the directory for AuthN It can control access to many kinds of applications

Victoriano Giralt Directories and SSO

slide-75
SLIDE 75

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Kerberos

taming the beasts

Kerberos, though old, will take us into the XXI century of SSO. It can use the directory for AuthN It can control access to many kinds of applications ADS can use Kerberos for AuthN

Victoriano Giralt Directories and SSO

slide-76
SLIDE 76

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Kerberos

taming the beasts

Kerberos, though old, will take us into the XXI century of SSO. It can use the directory for AuthN It can control access to many kinds of applications ADS can use Kerberos for AuthN There are rumours of someone having used it for AuthN with OID

Victoriano Giralt Directories and SSO

slide-77
SLIDE 77

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

Kerberos

taming the beasts

Kerberos, though old, will take us into the XXI century of SSO. It can use the directory for AuthN It can control access to many kinds of applications ADS can use Kerberos for AuthN There are rumours of someone having used it for AuthN with OID Unfortunately it cannot be used for AuthN to web apps from non Windows clients

Victoriano Giralt Directories and SSO

slide-78
SLIDE 78

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

eduPermission and eduPermissionGroup

a work in progress

It is a discussion in progress in MACE about ways of storing permissions in the directory.

Victoriano Giralt Directories and SSO

slide-79
SLIDE 79

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

eduPermission and eduPermissionGroup

a work in progress

It is a discussion in progress in MACE about ways of storing permissions in the directory. Subentries eduPermission: as objects subentries (Tom Barton’s)

The permissions objects are stored as subentries

  • f the holder’s entry.

It might have scaling problems if holders are persons, as the numbers may explode.

Victoriano Giralt Directories and SSO

slide-80
SLIDE 80

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

eduPermission and eduPermissionGroup

a work in progress

It is a discussion in progress in MACE about ways of storing permissions in the directory. Subentries Groups eduPermissionGroup (Brendan Belina’s)

Permissions are described as group entries in the directory and are granted to persons by way of inclusion in the group, using standard membership mechanisms.

Victoriano Giralt Directories and SSO

slide-81
SLIDE 81

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

eduPermission and eduPermissionGroup

a work in progress

It is a discussion in progress in MACE about ways of storing permissions in the directory. Subentries Groups Objects Permissions are objects

Both approaches share the way they describe permissions, as objects with multiple attributes for storing their properties such as the application to which they are applied.

Victoriano Giralt Directories and SSO

slide-82
SLIDE 82

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

URNs in Entitlements for AuthZ

as it is in use at UMA (by example)

irisUserEntitlement = urn:mace:rediris.es:uma.es: entitlement:applAccess:SolicitudGasto:LEVEL Assigns access rights to the designated application:

Victoriano Giralt Directories and SSO

slide-83
SLIDE 83

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

URNs in Entitlements for AuthZ

as it is in use at UMA (by example)

irisUserEntitlement = urn:mace:rediris.es:uma.es: entitlement:applAccess:SolicitudGasto:LEVEL Assigns access rights to the designated application: Function entitlement

the URN describes a right for a user or role

Victoriano Giralt Directories and SSO

slide-84
SLIDE 84

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

URNs in Entitlements for AuthZ

as it is in use at UMA (by example)

irisUserEntitlement = urn:mace:rediris.es:uma.es: entitlement:applAccess:SolicitudGasto:LEVEL Assigns access rights to the designated application: Function applAccess

kind of right, access to an application in this case.

Victoriano Giralt Directories and SSO

slide-85
SLIDE 85

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

URNs in Entitlements for AuthZ

as it is in use at UMA (by example)

irisUserEntitlement = urn:mace:rediris.es:uma.es: entitlement:applAccess:SolicitudGasto:LEVEL Assigns access rights to the designated application: Function SolicitudGasto

application the right is granted on.

Victoriano Giralt Directories and SSO

slide-86
SLIDE 86

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

URNs in Entitlements for AuthZ

as it is in use at UMA (by example)

irisUserEntitlement = urn:mace:rediris.es:uma.es: entitlement:applAccess:SolicitudGasto:LEVEL Assigns access rights to the designated application: Function LEVEL

granted access level, application specific: RUG, ROU, RGE

Victoriano Giralt Directories and SSO

slide-87
SLIDE 87

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

URNs in Entitlements for AuthZ

as it is in use at UMA (by example)

irisUserEntitlement = urn:mace:rediris.es:uma.es: entitlement:applAccess:SolicitudGasto:LEVEL Function Usage LDAP search

The application does a standard directory search to find out if the user that has been authenticated has the right to use it and the access level that has been granted to her.

Victoriano Giralt Directories and SSO

slide-88
SLIDE 88

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

URNs in Entitlements for AuthZ

as it is in use at UMA (by example)

irisUserEntitlement = urn:mace:rediris.es:uma.es: entitlement:applAccess:SolicitudGasto:LEVEL Function Usage Query via web service

The application queries a web service with user and application identifier as inputs and obtains the access level or the absence of the right to use.

Victoriano Giralt Directories and SSO

slide-89
SLIDE 89

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

URNs in Entitlements for AuthZ

as it is in use at UMA (by example)

irisUserEntitlement = urn:mace:rediris.es:uma.es: entitlement:applAccess:SolicitudGasto:LEVEL Function Usage WebSSO AuthZ assertion

The authentication server has information about the accessed resource, once the user is AuthN’d, retrieves application specific AuthZ information from the entitlements in the user’s entry in the directory, and passes them onto the resource

Victoriano Giralt Directories and SSO

slide-90
SLIDE 90

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

URNs in Entitlements for AuthZ

as it is in use at UMA (by example)

irisUserEntitlement = urn:mace:rediris.es:uma.es: entitlement:applAccess:SolicitudGasto:LEVEL Function Usage Advantages Unique authorization point

All of an object’s authorisations, both explicit and implicit, are centrally kept in a directory entry.

Victoriano Giralt Directories and SSO

slide-91
SLIDE 91

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

URNs in Entitlements for AuthZ

as it is in use at UMA (by example)

irisUserEntitlement = urn:mace:rediris.es:uma.es: entitlement:applAccess:SolicitudGasto:LEVEL Function Usage Advantages A sole authorization model

URNs allow us to express all authorization in a common form, with application specific semantics.

Victoriano Giralt Directories and SSO

slide-92
SLIDE 92

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

URNs in Entitlements for AuthZ

as it is in use at UMA (by example)

irisUserEntitlement = urn:mace:rediris.es:uma.es: entitlement:applAccess:SolicitudGasto:LEVEL Function Usage Advantages Agent-Function-Qualifier

Who can do What on Which object

Victoriano Giralt Directories and SSO

slide-93
SLIDE 93

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

SPOCP

multiple source AuthZ policies

With regard to AuthZ, we can consider SPOCP as

Victoriano Giralt Directories and SSO

slide-94
SLIDE 94

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

SPOCP

multiple source AuthZ policies

With regard to AuthZ, we can consider SPOCP as Engine AuthZ policy engine

AuthZ policies can be described and applied to resources using SPOCP

Victoriano Giralt Directories and SSO

slide-95
SLIDE 95

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

SPOCP

multiple source AuthZ policies

With regard to AuthZ, we can consider SPOCP as Engine Service AuthZ policy service

SPOCP is implemented as a service that resources query for taking AuthZ decisions based

  • n the policy engine.

Victoriano Giralt Directories and SSO

slide-96
SLIDE 96

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

SPOCP

multiple source AuthZ policies

With regard to AuthZ, we can consider SPOCP as Engine Service Aggregator AuthZ source aggregator

We can use SPOCP for aggregating information

  • n which AuthZ decisions can be based, through

the use of boundary conditions.

Victoriano Giralt Directories and SSO

slide-97
SLIDE 97

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

SPOCP

multiple source AuthZ policies

With regard to AuthZ, we can consider SPOCP as Engine Service Aggregator Most important, it allows us to use most of the presented methods of AuthZ, and then some.

Victoriano Giralt Directories and SSO

slide-98
SLIDE 98

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

SPOCP

multiple source AuthZ policies

Some SPOCP key terms

Victoriano Giralt Directories and SSO

slide-99
SLIDE 99

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

SPOCP

multiple source AuthZ policies

Some SPOCP key terms S-Expression Policy language

The access policies to resources are described using expressions like: (spocp (resource etc passwd)(action write)(subject (uid 0)))

Victoriano Giralt Directories and SSO

slide-100
SLIDE 100

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

SPOCP

multiple source AuthZ policies

Some SPOCP key terms S-Expression Policy engine the Less-Permissive function

By applying this function, the engine guarantees that the querying party will receive a formally correct answer, thus assuring the right AuthZ decision.

Victoriano Giralt Directories and SSO

slide-101
SLIDE 101

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

SPOCP

multiple source AuthZ policies

Some SPOCP key terms S-Expression Policy engine AuthZ server Answer to resource AuthZ queries

SPOCP can be implemented as a server that listens on a socket and resolves application queries for AuthZ decisions.

Victoriano Giralt Directories and SSO

slide-102
SLIDE 102

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

SPOCP

multiple source AuthZ policies

Some SPOCP key terms S-Expression Policy engine AuthZ server Boundary condition Attributes from many sources

SPOCP can use different sources for getting attributes on which to base the AuthZ

  • decision. One of this sources is the directory,

as well as relational databases, network information or whatever anyone wants to program for.

Victoriano Giralt Directories and SSO

slide-103
SLIDE 103

Technical details Intro ADS OSSO PERMIS Kerberos eduPermission URNs for AuthZ SPOCP

SPOCP

multiple source AuthZ policies

Some SPOCP key terms S-Expression Policy engine AuthZ server Boundary condition Plug-in The way to reach the attribute sources

This is the basis for boundary conditions. It is based on a modular approach like Apache’s. Any needed boundary condition can be implemented in a module that will be loaded at runtime.

Victoriano Giralt Directories and SSO

slide-104
SLIDE 104

Technical details

A glimpse of the future

A passwordless world

InfoCard

Victoriano Giralt Directories and SSO

slide-105
SLIDE 105

Technical details

A glimpse of the future

A passwordless world

InfoCard Higgins, the OpenSource response

Victoriano Giralt Directories and SSO