Upload
evadne
View
71
Download
1
Tags:
Embed Size (px)
DESCRIPTION
SAML Right Here, Right Now. Hal Lockhart September 25, 2012. Outline. Summary of SAML 2.0 Specifications & Deployments Work done since 2.0 Objectives of SAML 2.1 Proposed Task List Other Possible Work Invitation to Participate. Status Overview. SAML 2.0 - OASIS Standard - March 2005 - PowerPoint PPT Presentation
Citation preview
SAMLRight Here, Right Now
Hal Lockhart
September 25, 2012
Outline Summary of SAML 2.0
Specifications & Deployments Work done since 2.0 Objectives of SAML 2.1 Proposed Task List Other Possible Work Invitation to Participate
Status Overview SAML 2.0 - OASIS Standard - March 2005 ITU-T Rec. X.1141 – June 2006 Work since 2005 has consisted of defining
additional Profiles 3 Oasis Standards 24 Committee Specifications 1 Committee Draft Errata & Updated Technical Overview
SAML Deployment Overview
Dominant technology for enterprise SSO Small number of very large federations
Millions of users and/or hundreds of SPs and/or IdPs
Primarily Research, Education and Govt Government services to ALL citizens in a
number of countries
Representative Deployments
NASA Launchpad IdP National Association of Realtors (US) SSO Service for Google Apps SSO for Salesforce.com CRM Chevron Corp Cloud Based Services REFEDS Research & Education worldwide 2010 Vancouver Winter Olympics Carolinas HealthCare System
SAML 2.0 Specifications Conformance
Requirements Required “Operational
Modes” for SAML implementations
Assertions and Protocols The “Core” specification
Bindings Maps SAML messages
onto common communications protocols
Profiles “How-to’s” for using SAML
to solve specific business problems
MetadataConfiguration data for establishing connections between SAML entities
Authentication ContextDetailed descriptions of user authentication mechanisms
Security and Privacy ConsiderationsSecurity and privacy analysis of SAML 2.0
GlossaryTerms used in SAML 2.0
Post 2.0 Profiles by CategoryCategory Number of ProfilesMetadata 7
Attributes 2
Holder-of-Key 2
Deployment 2
New Protocols 4
Authentication Context 3
Kerberos 3
Other 5
Selected Highlights Simple Sign Binding
Simple, efficient signing w/o C14N SP Request Initiation
Allows specification of how AuthN is done Identity Provider Discovery Service
Enhanced IdP Discovery LDAP/X.500 Attribute Profile
Corrects original SAML 2.0 Profile
Key Metadata Profiles - 1
Metadata Extension for Entity Attributes Associate attributes with SPs & IdPs
Metadata Interoperability Profile Use metadata to configure keys
Metadata Profile for Algorithm Support Configure crypto details & key rollover
Key Metadata Profiles – 2
Metadata Extensions for Login and Discovery User Interface Configure user choices for AuthN
Metadata Extensions for Registration and Publication Information Document business processes
Errata and Non-normative
Approved Errata Official under OASIS TC process
SAML 2.0 Technical Overview Greatly improved Many diagrams, usecases, etc.
SAML 2.1 Objectives
Make specifications easier to use Retain backward compatibility Improve specification quality Make small improvements
Improve Usability Apply errata Remove deprecated text Provide everything needed to
implement a component (e.g. SP) in one place
Provided detailed guidance on how to counter threats
Backward Compatibility
Retain formats, protocols, namespaces, except to correct errors
Retain interoperability with deployed implementations Where not possible minimize and
clearly identify differences Retain Version=“2.0” in XML
Improve Specification Quality
Incorporate popular Profiles in core Update normative references
e.g. XML Signature Re-factor Conformance Requirements Better integration of Metadata
Some Metadata support mandatory
Improvements
Incorporate Profiles listed in slide 8 Present SP and IdP implementation
considerations separately Incorporate Metadata profiles listed
in slides 9 & 10 Move text on little used features out
of main specifications
Other Possible Work*
Improved SSO based on field experience Use HTML5 features Additional session semantics JOSE instead of Simple Sign Limited unlinkability between SP and IDP Emphasize data format compatibility
* Not Committed
Get Involved An opportunity to influence the future
of SAML Resolve issues your organization has
with SAML Join the Security Services TC All work available online and by email Telephone meetings alternate
Tuesdays 12:00 PM ET
Useful Links
SAML 2.1 Wiki https://wiki.oasis-open.org/security/SAML2Revision
Wikipedia – SAML Products & Services http://
en.wikipedia.org/wiki/SAML-based_products_and_services#Libraries_and_took_kits_to_develop_SAML_actors_and_SAML-enable_services
Kantara Global Trust Framework Survey http://
kantarainitiative.org/confluence/display/bctf/Global+Trust+Framework+Survey
More Links - 1
NASA Launchpad https://www.oasis-open.org/apps/org/workgroup/security/download.php/46740/N
ASA_launchpad_SAML_Aug2012.pdf National Association of Realtors
http://www.projectliberty.org/liberty/content/download/3774/24912/file/Clareity%20Case%20Study%20FINAL%20%5B2%5D%5B1%5D.pdf
SSO for Google Apps https://developers.google.com/google-apps/sso/saml_reference_implementation
SSO for Salesforce.com CRM https://blogs.oracle.com/rangal/entry/saml2_salesforce_com
More Links - 2
Chevron Corporation http://
2011.cloudidentitysummit.com/local/upload/SanFran-An-Enterprise-Case-Study-Chevron.pdf
Research & Education Federations https://refeds.terena.org/index.php/FederationsTable
2010 Vancouver Winter Olympics http://www.multichannel.com/content/race-finish-nbc-universal-affiliates
Carolinas HealthCare System http://www.gosecureauth.com/cloud/adp/
Questions?