IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA •...
-
Upload
nguyenkhue -
Category
Documents
-
view
219 -
download
3
Transcript of IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA •...
![Page 1: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/1.jpg)
IT’S TIME FOR A SPA
Jeff McCullough UC Berkeley
© 2015 Internet2
Long Term Departmental Accounts
![Page 2: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/2.jpg)
Today’s conversa.on
It’s Time for a SPA
• Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made. • Your input and questions…
© 2015 Internet2
[ 2 ]
![Page 3: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/3.jpg)
[ 3 ]
© 2015 Internet2
Authenticating using CAS
![Page 4: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/4.jpg)
[ 4 ]
© 2015 Internet2
Authenticating using CAS
![Page 5: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/5.jpg)
Background
• Two previous implementations • SSO requirement • Integration with multiple systems
[ 5 ]
© 2015 Internet2
![Page 6: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/6.jpg)
Use cases
Data storage for a team or department. Functional account for a position that changes frequently. Account for a program/department/team that needs to send/receive email and calendar events.
[ 6 ]
© 2015 Internet2
![Page 7: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/7.jpg)
SPA Environment
[ 7 ]
© 2015 Internet2
![Page 8: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/8.jpg)
How do SPAs differ from regular accounts?
Extra LDAP attributes LDAP groups Grouper groups Surrogate login
[ 8 ]
© 2015 Internet2
![Page 9: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/9.jpg)
Extra attributes
• Create date • Expiration date – 5 years • User access group • Purpose • New affiliate type • (Department Number)
[ 9 ]
© 2015 Internet2
![Page 10: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/10.jpg)
User access groups
• Grouper groups • LDAP groups
[ 10 ]
© 2015 Internet2
![Page 11: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/11.jpg)
Authentication
• Surrogate login (SSO) • Kerb password (non UI app or AD) • Google Key
[ 11 ]
© 2015 Internet2
![Page 12: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/12.jpg)
Surrogate login
• CAS login module (CAS/Shib) • SPA-ID+My-Account-ID • +My-Account-ID • Both use user’s password
[ 12 ]
© 2015 Internet2
![Page 13: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/13.jpg)
Delegated Access within Apps
• Google • Box • Other systems
[ 13 ]
© 2015 Internet2
![Page 14: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/14.jpg)
Authorization
• LDAP user group • Begins as a grouper group
[ 14 ]
© 2015 Internet2
![Page 15: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/15.jpg)
SPA Admin
• List of SPA that have already been created • Create SPA / Delete SPA • Namespace checks • Sub-domains • Links for group admin and google account creation
[ 15 ]
© 2015 Internet2
![Page 16: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/16.jpg)
Provisioning an account
• Using OpenIDM • > Kerberos • > AD • > LDAP • > Grouper
[ 16 ]
© 2015 Internet2
![Page 17: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/17.jpg)
Surrogate login and groups
• Looks up all groups for user • Determines which groups are related to SPAs • Shows list to user • Logs user in as SPA using either CAS/Shib • Adds info to logs
[ 17 ]
© 2015 Internet2
![Page 18: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/18.jpg)
Issues and changes…
• Previously had authorizer/owner. • Any employee. • The shell game.
[ 18 ]
© 2015 Internet2
![Page 19: IT’S TIME FOR A SPA - Events | Internet2 · Today’s(conversaon It’s Time for a SPA • Example SSO login. • Why SPA? • How do they work? • Issues and changes we’ve made.](https://reader033.fdocuments.us/reader033/viewer/2022052608/5abfcf3c7f8b9aa15e8e73e8/html5/thumbnails/19.jpg)
Q/A
• What do you think? • Do you have an implemention of SPAs?
[ 19 ]
© 2015 Internet2