Post on 15-Jan-2015
description
Practical Federated Identity
Use Cases From The Real World
Johann Nallathamby, Senior Software Engineer Selvaratnam Uthaiyashankar, Director-Cloud Solutions
What is Iden,ty • “the fact of being who or what a person or thing is”
• h3p://oxforddic8onaries.com/defini8on/english/iden8ty
• Who you are… • Why important?
• Whatever you do associated with your iden8ty
• Digital Iden8ty
Problems with Digital Iden,ty • Different Iden8ty in Different Applica8ons / Domains
– Remembering Password – Loosing possible collabora8on
Federated Iden,ty • “The agreements, standards, and technologies that make iden8ty and en8tlements portable across autonomous domains.” -‐ Burton Group
Service Providers Service Providers
Service Providers
Identity Provider
Service Providers
Authentication
Service Consumption
Trust
Key Requirements For Iden,ty Federa,on Iden,ty Management and Authen,ca,on
• Authen8ca8on – Mul8-‐Factor Authen8ca8on
• Iden8ty Management – A3ributes / Claims
Key Requirements For Iden,ty Federa,on Trust Between Domains
• Trust – Pre-‐established
• Common in Enterprise scenarios
– Established only when accessing the service • Common in web scenarios
• Iden8ty Provider Discovery
Key Requirements For Iden,ty Federa,on Iden,ty and AAribute Mapping
• Mapping user iden8ty of one system to another – Username – Out of Band – Pseudonym
• Transient • Persistent
• Mapping a3ribute names in different systems • Mapping a3ribute values in different systems
Key Requirements For Iden,ty Federa,on AAribute Exchange
• One system reques8ng addi8onal a3ributes from another system
Protocols and Standards • OpenID • SAML2 Web Browser SSO • WS-‐Trust & WS-‐Federa8on
OpenID
http://openid.net/get-an-openid/
OpenID Iden,fiers • Google
– h3ps://profiles.google.com/YourGoogleID
• Blogger – h3p://blogname.blogspot.com/
• MySpace – h3p://www.myspace.com/username
OpenID
Identity Provider
Service Provider A
Provide OpenID
Single Sign-On Service
1
2
4
5
4
Allow Access to Service
Relying Party
Browser Redirect to IdP
Discover Provider (XRI Resolution, Yadis, HTML Based Discovery)
6
7
3 Create shared secret
Demo -‐ OpenID
SAML2 Web Browser SSO
SAML 2.0 Web Browser SSO Profile
SAML2 Web Browser SSO
Identity Provider
Service Provider A
Access Service
Single Sign-On Service
123
5
4
Allow Access to Service
Trust
Assertion Consumer Service
Browser Redirect to IdP
Select Identity Provider
6
7
Demo – SAML2 Web Browser SSO
WS-‐Trust Identity Provider
Service Provider A
Authentication (Username/x509/etc.)
Security Token Service 1 2
3
5
4 Verify Token (e.g.: Check signature)
Security Token
Trust
Some Federa,on PaAerns Using WSO2 Iden,ty Server
Token Exchange
IdP Proxy PaAern
IdP Proxy PaAern
IdP Proxy PaAern
Resource STS PaAern
Client STS
Client Proxy Resource Proxy
Resource STS
OAuth AS
DMZ Proxy
STS
Federa,on for REST APIs
SaaS Applica,on with Trusted Iden,ty Providers
• SaaS Applica8on • Application deployed by the super-tenant • Application used by all the tenants • Application authorization logic written against shared roles • Tenant users physically only exist in the Identity Provider and not in the
Application server • The users’ attributes are with the Trusted Identity Provider
• Trusted Iden8ty Providers (Trusted IdPs) • Each tenant will have its own Trusted Identity Provider • The SaaS application will delegate authentication by redirecting the user to the
Trusted Identity Provider and then validate the signed token response with attributes.
• Identity Provider roles are mapped to shared roles in the application server and authorization logic is performed based on them.
SaaS Applica,on with Trusted Iden,ty Providers
WSO2 Iden,ty Server
Ques,ons?
Photos Credit • h3p://images.motoring.co.uk/images/newsImages/driving-‐licence-‐exchange-‐rules-‐8ghtened-‐52313-‐1.jpg
• h3p://www.vectors4all.net/preview/people-‐business-‐male-‐clip-‐art.jpg