Deploying Authorization Mechanisms for Federated Services in the

Shared by: dma94275

Tags

the user, federated identity, identity management, federation services, identity federation, active directory, security token, service providers, network access control, single sign-on, white paper, web service, access control, federated identity management, liberty alliance

Stats

views:: 7
posted:: 8/31/2010
language:: English
pages:: 22

Public Domain

Document Sample

Deploying Authorization Mechanisms for
Federated Services in the EDUROAM
Architecture (DAME)
-Technical Project Proposal-
Óscar Cánovas (UM)
Antonio G. Skármeta (UM)

Diego R. Lopez (RedIRIS)
Klaas Wierenga (SURFnet)

TF-EMC2
February 2006, Zagreb
Overview

 Introduction

 Motivation of this project

 Background and previous work: NAS-SAML

 Main goals

TF-EMC2
Introduction
 DAME is a project that builds upon previous TERENA, GN2,
Internet2, and University of Murcia work:
 EDUROAM, a result of TERENA Mobility Task Force, which defines
an inter-NREN roaming architecture,
 Reports available on the EDUROAM web site
 eduGAIN, the AAI interoperation infrastructure designed by GN2
JRA5
 Documentation available at the GÉANT2 web site
 Shibboleth, a widely deployed federation mechanism developed by
Internet2 and the NSF Middleware Initiative.
 Documentation available on the Shibboleth web site.
 NAS-SAML, a network access control approach for AAA
environments, developed by the University of Murcia (Spain),
based on the SAML and the XACML standards,
 Documentation available on the http://pki.dif.um.es web site
TF-EMC2
Overview

 Introduction

 Motivation of this project

 Background and previous work: NAS-SAML

 Main goals

TF-EMC2
Motivation
 We have experienced the emergence of federated approaches to
resource sharing.
 Access to shared resources with a single identity
 Examples of these approaches: the establishment of academic federations
worldwide and the concepts around Grid Computing.
 Some aspects generally related with integral identity management are
still open, especially those related to user authorization.
 Only allowed users are able to perform the set of allowed actions over each
resource.
 One of the main resources to share is the network, for mobility
purposes.
 The TERENA Mobility Task Force defined and tested an inter-NREN
roaming architecture, called EDUROAM, proposed after identifying the
most suitable techniques currently deployed in the NRENs.

TF-EMC2
Motivation
 EDUROAM allows users of participating institutions to access the
Internet at other participants using their home institution's credentials.
 It would be desirable to extend the EDUROAM architecture with
authentication and authorization mechanisms.
 NAS-SAML is an access control proposal for AAA environments which can
be used to extend EDUROAM to exchange existing credentials.
 Credentials can be expressed in several forms, ranging from
eduGAIN/Shibboleth statements to X.509 Attribute certificates

 Additionally, this authorization mechanism might be used at service-
level, for example for Grid Computing purposes.

 EDUROAM constitutes an exceptional starting point to offer a full and
integrated network access experience to the users.

TF-EMC2
Overview

 Introduction

 Motivation of this project

 Background and previous work: NAS-SAML

 Main goals

TF-EMC2
NAS-SAML
 Main objectives:
 To define a network access control approach based on:
 X.509 PKC authentication
 User attributes (roles)
 Authorization policies. Rules stating the permissions give to each
system role.
 Use of XML to express:
 access control policies (XACML)
 authorization statements (SAML)
 authorization protocols (SAML)
 The scenario should be integrated in the AAA architecture.

TF-EMC2
NAS-SAML
 Architectural elements

TF-EMC2
NAS-SAML
 End User:
 Entity requesting access to the network
 Authentication based on (X.509 PKC or login/passwd pairs)
 AAA Server:
 Requires two ASM modules:
 Source Authority (SA)
 Policy Decision Point (PDP)
 Source Authority (SA):
 Manages the Role Assignment Policy (roles to users)
 Role Assignment Policy:
 “in the source domain Source, the set of roles R1, R2.. Rn can be
assigned to the users contained in the o=org,c=ES X.500 sub-tree for
the period V”
 Based on XACML

TF-EMC2
NAS-SAML
 Policy Decision Point (PDP):
 Generates the statements related to authorization decisions
 Manages the Resource Access Policy
 Policy Administration Point (PAP):
 Defines, signs and publishes the Resource Access Policy
 Resource Access Policy:
 “the users pertaining to the source domain Source, and playing the role
R1, will get access to the network N1 with a QoS1”
 Based on XACML
 Network Access Point (NAP):
 forwards the client requests to the appropriate AAA server of the target
domain
 obtains and enforces the properties of the network connection

TF-EMC2
NAS-SAML
 Example: Inter-domain pull model

TF-EMC2
NAS-SAML
 Current status:
 Architectural elements, protocols, integration with DIAMETER
 G. López, O. Cánovas, A. F. Gómez-Skarmeta, R. Marín. “A Network
Access Control Approach based on the AAA Architecture and Authorization
Attributes”. Journal of Network and Computer Applications
 Implemented and tested.
 Security policies (access control, role assignment, conversion):
 G. López, O. Cánovas, A. F. Gómez-Skarmeta. “Use of XACML Policies for
a Network Access Control Service”. 4th International Workshop of Applied
PKI, IWAP’2005.
 Implemented and tested.
 Integration with PERMIS (in collaboration with D. W. Chadwick):
 G. López, O. Cánovas, A. F. Gómez-Skarmeta, O. Otenko, D.W. Chadwick.
“A Heterogeneous Network Access Service based on PERMIS and SAML”.
2nd European PKI Workshop, EuroPKI’2005.
 Implemented and tested.

TF-EMC2
Overview

 Introduction

 Motivation of this project

 Background and previous work: NAS-SAML

 Main goals and summary of activities

TF-EMC2
Main goals
 First Goal: Extension of EDUROAM using NAS-SAML
 User mobility controlled by assertions and policies expressed in SAML
and XACML.
 Enhanced interoperability among organizations (common language)

XACML
Policies

Policy Decision
Source Attribute
Point
Authority

RADIUS + SAML

TF-EMC2
Main goals
 First Goal: Extension of EDUROAM using NAS-SAML
 RELATED ACTIVITIES:
 Activity 1. Integration of the NAS-SAML architecture in the EDUROAM
network.
 Task 1. Analysis of the current status of the EDUROAM network.
 Task 2. Analysis of the required user attributes and policies for roaming.
 Task 3. Development of the Source Authority and Policy Decision Points.
 Task 4. Development a custom SAML module for RADIUS and DIAMETER servers.
 Task 5. Create a translator to convert RADIUS messages into DIAMETER and vice versa.
 Task 6. Validate the resulting architecture for mobility purposes.
 Activity 2. Development of a user-friendly management interface for
authorization policies.
 Task 1. Analysis of the different existing proposals for privilege administration.
 Task 2. Development of a high level interface able to be integrated with common office
applications.
 Task 3. Creation of interpreters and translators able to convert policies into XACML.
 Task 4. Validate the resulting interface.
TF-EMC2
Main goals
 Second Goal: Use of eduGAIN/Shibboleth as AuthN and AuthZ
backend
 NAS-SAML has been already integrated with other proposals (X.509 AC)
 Link between the AAA servers (now acting as Service Providers) and the
Identity Providers of the federation.

XACML
Policies (SAML)
Authentication Statement
Attribute Statements Identity Provider
Policy Decision (Shibboleth)
Point

Access point
Shibboleth
Federation
Network Access Service
(RADIUS/DIAMETER
Acting as Service Provider)
TF-EMC2
Main goals
 Second Goal: Preliminary design.
Home SD Target SD

EU Attr IP SP NAP AAA SA PDP
Auth

Login/Pass
authenticate
user
SAMLRes.
AuthNSt or
Artifact Authorization
process
EAP-SUCCESS
SAMLRes. attributes
AuthNSt or
Artifact

SAMLRes.
AuthNSt or
Artifact SAMLRes
.
artifact

SAMLRes
.
AuthNSt

HTTP 200OK

EAP-PEAP PI
HTTPS
SOAP

HTTPS
TF-EMC2 HTTPS
Main goals
 Second Goal: Use of eduGAIN/Shibboleth as AuthN and AuthZ
backend
 RELATED ACTIVITIES:
 Activity 3. Use of eduGAIN/Shibboleth as authentication back-end for
NAS-SAML
 Task 1. Analysis of the proposed profiles for SSO. Identification of the possible
modifications that would require some of those profiles.
 Task 2. Development of a Shibboleth Service Provider module responsible for
the creation and exchange of Shibboleth data exchange
 Task 3. Development of an eduGAIN BE to provide direct access to the con-
federation infrastructure
 Task 4. Definition of the authentication methods to be used by the end users in
order to demonstrate their digital identity.
 Task 5. Extension of the existing XACML context manager in order to interpret
the eduGAIN/Shibboleth SAML credentials.
TF-EMC2  Task 6. Validate the resulting architecture.
Main goals
 Third Goal: Global Single Sign On (SSO)
 Users will be authenticated once, during the network access control phase
 The eduGAIN/Shibboleth authentication would be bootstrapped from the
NAS-SAML
 New PEAP method for delivering authentication credentials and new
security middleware
XACML
Policies (SAML)
Authentication Statement
Attribute Statements Identity Provider
Policy Decision (Shibboleth)
Point

Shibboleth
Federation
Network Access Service
(SAML) (RADIUS/DIAMETER)
Authentication Statement or
Artifact
Additional SAML
(SAML) Service Provider Attributes
Authentication Statement or
Artifact
Assertion Consumer

Target Resource
TF-EMC2
Main goals
 Third Goal: Global Single Sign On (SSO)
 RELATED ACTIVITIES:
 Activity 4. Development of a global SSO
 Task 1. Analysis of the requirements of a new PEAP authentication method
able to exchange the necessary eduGAIN/Shibboleth signed tokens.
 Task 2. Development of the client and server software modules
implementing the specified PEAP method..
 Task 3. Design and develop the middleware able to manage the signed
Shibboleth tokens that will be then provided to the resource providers
 Task 4. Modify the existing service providers in order to include a custom
SSO profile based on a push method, that is, a method where the end users
are able to provide the required authentication credentials.
 Task 5. Validate the resulting system.

TF-EMC2
Main goals
 Fourth Goal: Authorization mechanisms for application-level services
 Mainly focused on Grid Computing
 Grid Services have specific components for authorization purposes
 We plan to link that components with the existing authorization infrastructure, using
standard extension points:
 OGSA-Authz
 MyProxy
 GridShib
 RELATED ACTIVITIES:
 Activity 5. Deployment of an authorization mechanism for an application-level
service: Grid Computing.
 Task 1. Analysis of the different Grid platforms that are being currently used in the different
European initiatives.
 Task 2. Analysis of the GridShib tool as starting point to provide authorization services to
Grids.
 Task 3. Definition of the set of attributes used to describe grid-relevant properties.
 Task 4. Modify the existing network of AAA servers in order to add the Grid-related policies
and attributes.
TF-EMC2  Task 5. Validate the resulting authorization services.

Related docs