within eduGAIN Research Project: 2 Supervisor: Brook Schofield - - PowerPoint PPT Presentation

▶
within edugain
SMART_READER_LITE
LIVE PREVIEW

within eduGAIN Research Project: 2 Supervisor: Brook Schofield - - PowerPoint PPT Presentation

Nov 13, 2023 198 likes •394 views

Calculating metadata propagation time within eduGAIN Research Project: 2 Supervisor: Brook Schofield GANT Marcel den Reijer Thursday July 4, 2019 UvA System & Network Engineering 1 of 18 In Introduction eduGAIN

slide-1
SLIDE 1

Calculating metadata propagation time within eduGAIN

Research Project: 2 Supervisor: Brook Schofield GÉANT

Marcel den Reijer

Thursday July 4, 2019 UvA – System & Network Engineering

1 of 18

slide-2
SLIDE 2

In Introduction

  • eduGAIN
  • “Identity” Federation
  • Full Mesh
  • 3 types of metadata files
  • Security Assertion Markup Language (SAML)
  • Identity Provider (IdP)
  • Service Provider (SP)

2 of 18 7/4/2019 Research project: 2

https://wiki.geant.org/display/ed uGAIN/Federation+Architectures

slide-3
SLIDE 3

Motivation

  • SAML XML metadata file
  • Security threats
  • Key rollover
  • Updates to service configuration
  • Attribute release information

3 of 18 7/4/2019 Research project: 2

slide-4
SLIDE 4

Research question

  • What is the propagation time of metadata throughout SAML identity

federations?

  • Can manual vs automatic metadata updates be detected by looking at

metadata propagation times?

  • What levels of cohesion are there within federation?

4 of 18 7/4/2019 Research project: 2

slide-5
SLIDE 5

Related work

  • Alex Stuart (2018) has measured the propagation time in the UK
  • Federation. Stuart proposed a method for measuring the propagation

time from the metadata of SPs to IdPs using SAML2.0 ”AuthnRequest” messages.

5 of 18 7/4/2019 Research project: 2

slide-6
SLIDE 6

Approach

  • Run script every 30 minutes with Cron
  • Download local, pubished and eduGAIN metadata files
  • Create MD5 hashes of every metadata file and detect changes to it based on

the creation time stamp.

  • Changes in the hash is equal to changes in the metadata file
  • XML attributes
  • <md:SPSSODescriptor>
  • <md:IDPSSODescriptor>
  • Using regular expressions in order to count the IdPs and SPs of the

local, published and eduGAIN XML metadata files

6 of 18 7/4/2019 Research project: 2

slide-7
SLIDE 7

Results – automatic update detection

8 of 18 7/4/2019 Research project: 2

slide-8
SLIDE 8

Results – automatic update detection

9 of 18 7/4/2019 Research project: 2

slide-9
SLIDE 9

Results – Manual update detection

10 of 18 7/4/2019 Research project: 2

slide-10
SLIDE 10

Results – update detection Unknown

11 of 18 7/4/2019 Research project: 2

slide-11
SLIDE 11

Results – update time eduGAIN

12 of 18 7/4/2019 Research project: 2

slide-12
SLIDE 12

Results – Cohesion of Id IdPs and and SPs

13 of 18 7/4/2019 Research project: 2

slide-13
SLIDE 13

Results – Cohesion of Id IdPs and and SPs

14 of 18 7/4/2019 Research project: 2

slide-14
SLIDE 14

Results – Cohesion of Id IdPs and and SPs

15 of 18 7/4/2019 Research project: 2

slide-15
SLIDE 15

Conclusion part 1.

  • Can manual vs automatic metadata updates be detected?
  • Yes, eduGAIN member WAYF has a different pattern
  • What levels of cohesion are there within federations?
  • eduGAIN knows 15,0% of all SPs (2491/16561 local SPs published)
  • eduGAIN knows 27,9% of all IdPs (3034/10862 local IdPs published)
  • eduGAIN aggregate 99, 6% of all SPs (2480 SPs)
  • eduGAIN aggregate 2,4% more IdPs (3107 IdPs)

16 of 18 7/4/2019 Research project: 2

slide-16
SLIDE 16

Conclusion part 2.

  • What is the propagation time of metadata throughout SAML identity

federations?

  • EduGAIN updates its metadata file every 60 minutes at 1:00 am, 2:00 am, 3.00

am etc.

  • Max 60 minutes)

17 of 18 7/4/2019 Research project: 2

slide-17
SLIDE 17

Discussion

  • The script in this research runs every 30 minutes at 00:00, 00:30,

01:00 and so on, therefore is it unknown exactly when the changes to the XML metadata files happened

  • Time limitations
  • SIR, ACOnet, IUCCIF, eduid.mk, eduidm.ma and AAIedu.HR have not updated

their metadata files

  • Manually or automatically detection is very hard
  • Oman KID, ARNaai, CAF, COFRe, Carsi & SIFULAN have updated their metadata

files once

  • Manually or automatically detection is very hard

18 of 18 7/4/2019 Research project: 2

slide-18
SLIDE 18

Future work

  • First, research via external assessment of metadata exchange, cashing

different versions of metadata

  • Second, calculating the propagation time in a environment where

every party has implemented the Metadata Query Protocol (MDQ)

  • last subject may be researching if and what bilateral agreement may

be exposed by looking at metadata exchange

19 of 18 7/4/2019 Research project: 2

slide-19
SLIDE 19

Questions

20 of 18 7/4/2019 Research project: 2