Why SSO With SSO(Single Sign-On), users need not remember so many passwords to login to different systems or applications. Other SSO technology: Cooki

Size: px

Start display at page:

Download "Why SSO With SSO(Single Sign-On), users need not remember so many passwords to login to different systems or applications. Other SSO technology: Cooki"

郭分蓬
5 years ago
Views:

1 SAML-based Identity Federation and SSO Introduction 楊哲男中正大學

2 Why SSO With SSO(Single Sign-On), users need not remember so many passwords to login to different systems or applications. Other SSO technology: Cookie OTP(One Time Password.) LDAP or Radius Authentication Process But they can t meet the authorization required.

3 Interrealm authorization: current approaches Single ID and shared passwords are distributed, perhaps widely, presenting significant accountability risks. Content providers limit access by IP address, leaving campus users on DSL/cable modems at home frustrated Campuses operate proxy services or VPNs that inconvenience users and present performance bottlenecks. Sometimes campuses must load user identities into vendor databases, incurring additional cost, stale data, and potential privacy violations. Users get new userids and passwords in each realm, incurring huge overhead (and they often set all their passwords to be the same ) 2

4 Words SAML,Security Assertion Markup Language, is a product of the OASIS identity provider(idp), holding the credentials and doing the AuthN service provider(sp), holding the requested resource and doing the AuthZ WAYF service, Where Are You From service Attribute, A value/name pair that describes a user: uid/rrsum 3

5 Security Assertion Markup Language Components of the SAML 2.0 standard SAML-Assertions Authentication, attribute and entitlement information (Issuer, Subject, Conditions, AuthnStatement, AttributeStatement, AuthzDecisionStatement) SAML-Protocol Request/Response pairs e.g. obtaining assertions (Assertion Query and Request,Authentication Request, Artifact Resolution, Name Identifier Management, Name Identifier Mapping, Single Logout) SAML-Bindings Mapping SAML protocols to communication standards (SAML SOAP, Reverse SOAP,HTTP Redirect, HTTP POST, HTTP Artifact, SAML URI) SAML-Profiles Combining bindings, protocols, assertions to specific use-cases (SSO Profiles [IdP Discovery, Web Browser SSO, SLO ], Attribute Profiles [XACML, LDAP, Basic, UUID, ], Artifact Resolution, Name Identifier Mapping, Assertion Query / Request) 4

6 Why SAML? Security SAML 2.0 定義了完整的機密性信任授權之解決方案 Access For Internet SSO, SAML 提供了一種可跨 domain 做聯合身分認證以達到 SSO 的系統 Admin SAML 具有較好之資源管理授權機制 (Attribute) 適合聯盟化之運作

7 Shibboleth AuthN. Flow WAYF Service Http Request / Response 4 3 Http Redirect Credentials 8 Handle 1 2 Server to Server Connection Identity Provider Attribute 9 Handle 10 Service Provider Idp 服務提供者接收到使用者的當身分確認成功 WAYF SP 所送來的訊息傳送一個 HTML,Idp,Idp 會將使用者頁面導引至會傳送使用者屬性給 handle, 並在要求時 WAYF 的頁面, 會直接 SP, 使用者會被導引使用者透過瀏覽器欲使用服務提供者下受使用者選擇完原屬單位後 WAYF 將使用者之認證資料需求導引至使用者輸入帳號密碼 (redirect) Idp 至 Login WAYF(Where, 將使用者之選擇資訊送給頁面給使用者, 並回傳至 Are Idp, SAML You 做確認請求身分確認 From) 保護的資源之伺服器 WAYF SP 會使用此屬性內容來做存取控制及其他應用層級的決定送一個屬性需求當初使用者向利用下拉式選單上選擇使用者之原屬單位 (attribute SP 所要求的服務之使用頁面 request) 給身分提供者 6

8 What is a Federation? Federations establish the trust relationship among organizations through the following: Governance that formulates policy, operational standards and practices, establishes a common set of attributes and definitions. Legal Agreement that defines the basic responsibilities, official signatory and establishment of trust, conflict and dispute resolution, basic protections Distributing trusted metadata and functioning as a Trust Notary among organizations. Technical Interoperability of standards, software, and attributes. 7

9 Present State of Federation 8

Leading products in this area Shibboleth from Internet2 Separate IdP/SP/DS SAML 2.0 IdP is Java SP is C supports Apache + IIS http://shibboleth.

10 Leading products in this area Shibboleth from Internet2 Separate IdP/SP/DS SAML 2.0 IdP is Java SP is C supports Apache + IIS simplesamlphp from UNINETT Integrated IdP/SP/Bridge/Disco SAML 2.0/OAuth/OpenID Facebook, Google, Windows Live PHP Multi-lingual interface (includes support for RTL languages).

11 How to Install Shibboleth or simpelsamlphp Idp and SP software. Cross-domain federation(ds/wayf). User attribute specification. Accounting system.

12 In the Future Providing a secure and privacy-preserving trust fabric for research and higher education institutions, and their partners, in Taiwan. Extending local identity management to ubiquitous authentication. To share existing protected web applications to more users. To push new application among universities.

13 One login, all the cloud. Thank You 12

科研信息化技术与应用,2015, 6 (1) of identity and the framework of identity management, this paper analyses the development trend of Identity Management

科研信息化技术与应用,2015, 6 (1) of identity and the framework of identity management, this paper analyses the development trend of Identity Management 科研信息化技术与应用 2015, 6(1): 41 49 应用 / APPLICATION 身份管理发展趋势和中国科学院身份管理系统薛聪 1,2, 向继 1 1, 高能 1. 中国科学院信息工程研究所信息安全国家重点实验室, 北京 100093 2. 中国科学院大学, 北京