PAPI based federation as a test-bed for a common security infrastructure in EFDA sites

EFDA Federation Para ver esta película, debedisponer de QuickTime™ y deun descompresor TIFF (LZW).

PAPI based federation as a test-bed for a common security infrastructure in EFDA sites

R. Castro , J. Vega , A. Portas, D. R. López, S. Balme , J.M. Theis , P. Lebourg , H. Fernandes , A. Neto , A. Duarte , F. Oliveira , F. Reis , K.

Purahoo , K Thomsen , W. Schiller , J. Kadlecsik

Para ver esta película, debedisponer de QuickTime™ y deun descompresor TIFF (LZW).












EFDA Federation



Index Motivation Federation as solution PAPI PAPI for Federation EFDA Federation Future lines

EFDA Federation



Motivation Security framework for service access control Necessity in organizations of sharing resources for

collaborative work Transparency Simple management

EFDA Federation



Federation Set of organizations sharing resources based on:

Trust Policies agreements An Authentication and Authorization system

Requirements Single Sign On Secure Access Users Mobility Simple Management and Scalability Transparency Common tools compatibility

EFDA Federation



PAPI system Distributed AA system

Authentication Server (AS) Point of Access (PoA) Group Point of Access (GPoA) PAPI Front-End Server

Authentication modules X.509 certificates LDAP SQL Local file

EFDA Federation



How does it work?

HTTP Client

Authenticationdata

AuthenticationServer

Encry-cookie S1 Encry-cookie S2

PoATemporalSigned-URLs Signed-URL

Signed-URL

Encry-cookie

Encry-cookie

HTTPServer S1

HTTPServer S2

PoA

EFDA Federation



Group Point of Access

One credential -> Many resources

GPoA 1

Point ofAccess

Point ofAccess

Point ofAccess

Point ofAccess

GPoA 2

HTTP Client

1

2

EFDA Federation



Front-End Service Easy services integration

One XML configuration point

PoA

PoA

PoA

GPoA

HTTPServer

HTTPService

HTTPServer

EFDA Federation



PAPI for Federation Fulfills federation requirements

Trust among components based on PKI Client types:

Common web browsers JAVA applications (JWS supported)

Standard java library (version > 1.5) RT-HTTPClient

[http://www.innovation.ch/java/HTTPClient/] jakarta commons-httpclient

[http://jakarta.apache.org/commons/httpclient/] Service types:

Web page servers Application servers (example Tomcat) Wiki integration (XWIKI)

EFDA Federation



PAPI in a Federated Organization

EFDA Federation



Federation Architecture Easy management

EFDA Federation



Federation Mechanism

Webbrowser

AuthenticationServer

FederatedSerice

User Repository

Federation GPoA

Federated Organization

Federated Organization

User’s home Organization

FederatedSerice

Federation WAYF

??

EFDA Federation



EFDA Federation Starting decision: meeting 28/11/2006 in JET


EFDA Federation



Coordination EFDA wiki site

RP -> Authentication and Authorisation Systems Mail list

[email protected] EFDA Jabber

EFDA Federation



Current State CEA

Federated, Attributes, Java Apps EFDA wiki federated !!!

CIEMAT Federated, Attributes, Java Apps

EFDA Federating

HAS/KFKI Federating, Integrating PAPI and Shibboleth

IST Federated, Attributes, Java Apps

JET Federated, Attributes, Java Apps

EFDA Federation



Future lines Evaluation of results of PAPI - Shibboleth integration New authentication mechanisms New services available in the federation Agreements on polices Evaluate new coordinated technologies taking

advantage of trust and policy agreement

EFDA Federation



Thank you for your attention













R. Castro , J. Vega , A. Portas, D. R. López, S. Balme , J.M. Theis , P. Lebourg , H. Fernandes , A. Neto , A. Duarte , F. Oliveira , F. Reis ,

K. Purahoo , K Thomsen , W. Schiller , J. Kadlecsik

PAPI based federation as a test-bed for a common security infrastructure in EFDA sites

Documents

Transcript of PAPI based federation as a test-bed for a common security infrastructure in EFDA sites