Federated Identity with Ping Federate
February 7th, 20071 ASR Final Project Federated Identity with Ping Federate -------------------------------------------Eunice Mondésir Pierre Weill-Tessier -------------------------------------------- Project Supervisor: M. Maknavicius-Laurent ASR Coordinator: G. Bernard Eunice Mondésir Pierre Weill-Tessier 2 Agenda 1. 2. 3. 4. 5. 6. Introduction Federated Identity concepts Presentation of Ping Federate server Platform implementation Demonstrations Conclusion Eunice Mondésir Pierre Weill-Tessier Introduction Federated Identity Concepts 5 Federated Identity concepts 1. 2. 3. 4. 5. Why Federated Identity? What is Federated Identity? Participants of Circle of Trust Single Sign On and Single Log Out SAML langage Eunice Mondésir Pierre Weill-Tessier Federated Identity Concepts 6 1. Why federated identity? Eunice Mondésir Pierre Weill-Tessier 7 Federated Identity Concepts 1. Why federated identity? Multiple authentication parameters Heterogeneous authentification and access control methods No control on personal information’s exhibition Need for easier and faster acces to services Eunice Mondésir Pierre Weill-Tessier 8 Federated Identity Concepts 2. What is federated identity? Set of agreements, standards and technologies Trust relationships between organizations Integrity and privacy perserved Independance of organizations Eunice Mondésir Pierre Weill-Tessier 9 Federated Identity Concepts 3. Circle of Trust (CoT) participants Service Provider (SP): Provides one or more services within a federation Access control policy Identity Provider (IdP): Creates, maintains, manages identity information user must authenticate at an IdP recognized by a SP Eunice Mondésir Pierre Weill-Tessier 10 Federated Identity Concepts 3. Circle of Trust (CoT) participants CoT Circle of trust: Federation of IdP and SP Business relationships Operational agreements Secured communication channels Seamless environment Eunice Mondésir SP SP SP IdP SP SP SP Pierre Weill-Tessier 11 Federated Identity Concepts 4.SSO and SLO Liberty alliance Single Sign On (SSO): Sign on once at a site (single account) Seamless signed-on for other sites No extra authentication SP both within and across circles of trusts Single Log Out (SLO): Synchronized session logout All sessions authenticated by Eunice Mondésir an IdP closed Pierre Weill-Tessier 12 Federated Identity Concepts 5. SAML (Security Assertion Markup Langage) XML standard developped by OASIS Exchanging authentication & authorization data between security domains (IdP and SP) SSO solution beyond the intranet Exchange of assertions between IdP and SP Eunice Mondésir Pierre Weill-Tessier Presentation of Ping Federate 14 Presentation of Ping Federate server 1. 2. How does Ping Federate work ? Communication tools of Ping Federate Eunice Mondésir Pierre Weill-Tessier 15 Presentation of Ping Federate server 1. How does Ping Federate work ? Server that passes identities between CoTs Distinction between two roles: IdP and SP Both roles can be combined Ping Federate does not interfere with local usage of the application Eunice Mondésir Pierre Weill-Tessier 16 Presentation of Ping Federate server 2. Communication tools in PF server different environments: how communicate? Ping Federate provides Integration Toolkits** Application or IdM X PF Token programming SAML language agent Eunice Mondésir adapter Pierre Weill-Tessier Plateform Implementation 18 Platform Implementation 1. 2. 3. 4. 5. Needs LDAP Postfix Tomcat Ping Federate server Eunice Mondésir Pierre Weill-Tessier 19 Platform Implementation 1. Needs Applications often interacts with a database for authentication Ping Federate server asks for parameters of a mail server to send notification mail Ping Federate’s sample application runs on Tomcat Application Server Eunice Mondésir Pierre Weill-Tessier 20 Platform Implementation 2. LDAP Why this protocol ? LDAP adapter proposed by PF Authentication to IdPs via pop-up window Our configuration: Server OpenLDAP Client LDAPBrowser to check our entries Simple tree: root + inetOrgPerson class instances Eunice Mondésir Pierre Weill-Tessier Platform Implementation 21 2. LDAP Example of LDAP Tree: dn: o=INT,c=FR dn: cn=Eunice, o=INT, c=FR dn: cn=Pierre, o=INT, c=FR Attributes we used: Eunice Mondésir cn, sn mail, userPassword title Pierre Weill-Tessier 22 Platform Implementation 3. Postfix Why ? No database associated : only one user ! mail server working on Linux O.S “Lighter” configuration than Sendmail [email protected] [email protected] is a “fake” address used for the notification only. IMAP server as a MDA Eunice Mondésir Pierre Weill-Tessier 23 Platform Implementation 4. Tomcat Why ? Required applications server to test the samples Multi-technologies support server (jsp, html) Identification tools: Eunice Mondésir Double authentication based on Role and Login Default configuration LDAP-using configuration JNDI Pierre Weill-Tessier 24 Platform Implementation 4. Tomcat Key configuration files Eunice Mondésir server.xml: defines the database connection web.xml: defines the security constraint Pierre Weill-Tessier 25 Platform Implementation 5. Ping Federate Standalone web administration https://cubitus.int-evry.fr:9999/pingfederate/app Support of multi-account administration Modifiable role selection (IdP, SP or both) Ease of management Eunice Mondésir Server configuration Partner configuration Pierre Weill-Tessier 26 Platform Implementation 5. Ping Federate Server settings Eunice Mondésir Local settings Base URL: where reaching the server ? Federation Info: choice of technologies Entity ID / realm: outside Ping Federate alias IdP/SP events: systematic redirections Pierre Weill-Tessier Platform Implementation 27 5. Ping Federate Server settings Eunice Mondésir Local settings IdP/SP adapters management Data Store management Metadata export Pierre Weill-Tessier 28 Platform Implementation 5. Ping Federate Partner settings’ connections IdP connections = we are SP SP connections = we are IdP According to partners’ configuration = Each CoT defines its policy independently Eunice Mondésir SP affiliations = 2+ partners’ Federation Pierre Weill-Tessier Demonstrations 30 Test Platform implementation 1. 2. 3. 4. 5. 6. Before Ping Federate servers Simplification Ping Federate servers setting-up IdP initiated SSO with ITAM SP initiated SSO with ITAM SP initiated SSO with LDAP adapter Eunice Mondésir Pierre Weill-Tessier 31 1. Before Ping Federate servers Connection to INT services within INT INT CoT S1 S2 S3 IdM ITAM CoT INT Services IdM S1 S2 S3 ITAM Services Eunice Mondésir Pierre Weill-Tessier 32 1. Before Ping Federate servers Connection to INT services from outside INT INT CoT S1 S2 S3 IdM ITAM CoT INT Services IdM S1 S2 S3 ITAM Services Eunice Mondésir Pierre Weill-Tessier 33 1. Before Ping Federate servers Connection to ITAM services within INT or from outside INT not possible INT CoT S1 S2 S3 IdM ITAM CoT INT Services IdM S1 S2 S3 ITAM Services Eunice Mondésir Pierre Weill-Tessier 34 2. Simplification •All aplications hosted by tomcat server INT CoT S1 S1 S2 S3 IdM IdM •Authentcation files serving as database ITAM CoT INT Services S1 S1 S2 S3 IdM IdM ITAM Services Eunice Mondésir Pierre Weill-Tessier 35 3. PF servers setting up INT CoT IdM IdP & SP S1 ITAM CoT cubitus IdP IdM •For INT CoT: only one PF server (IdP and SP server) •For ITAM CoT: two PF servers, one IdP and one SP Eunice Mondésir S1 SP oberon titania Pierre Weill-Tessier 36 4. IdP initiated SSO with ITAM INT CoT SSO IdP IdM SAML 2.0 S1 cubitus ITAM CoT Sarah IdP IdM Sarah connected to S1 without having passed by ITAM IdM Eunice Mondésir S1 SP oberon titania Pierre Weill-Tessier 37 5. SP initiated SSO with ITAM INT CoT SAML 2.0 IdP IdM S1 cubitus Bob ITAM CoT SAML 2.0 IdP IdM S1 SSO SP oberon titania Eunice Mondésir Pierre Weill-Tessier 38 6. SP initiated SSO with LDAP adapter LDAP adapter INT CoT standard adapter SAML 2.0 IdP IdM LDAP S1 cubitus Sam ITAM CoT SAML 2.0 IdP IdM S1 INT IdP interaction with LDAP directory via a pop-up window Eunice Mondésir SSO SP oberon titania Pierre Weill-Tessier Conclusion 40 Conclusion What remains to do ? Adapt INTest with Ping Federate (Token) Test Multi-partners federation Perform tests on security and privacy Other solutions ? Eunice Mondésir Microsoft CardSpace (.NET) WS-Federation Servers (Sun One Identity Server, IBM Tivoli, Microsoft ADFS…) Pierre Weill-Tessier 41 Thanks for your attention Questions ? Eunice Mondésir Pierre Weill-Tessier
© Copyright 2024