Embed Size (px)
DESCRIPTION
VoIP service in DAMe/eduroam. Gabriel López. University of Murcia. DAMe: current status. Network authentication in eduroam and SSO token distribution RADIUS hierarchy Token based on SAML Network authorization based on end user attributes Based on eduGAIN BEs - PowerPoint PPT Presentation
Citation preview
University of MurciaGabriel López
Network authentication in eduroam and SSO token distribution◦ RADIUS hierarchy◦ Token based on SAML
Network authorization based on end user attributes◦ Based on eduGAIN BEs◦ XACML authorization policies
Web authN and authZ profile Beside:
◦ Integrated with Shibboleth and PAPI idPs◦ Support for LoA (Level of Assurance)◦ RadSec deployment in progress
New services for SSO Based on the SSO token provided by DAMe Provide APIs for BEs:
Token generation Token validation Authorization
Unified SSO token perfsonar, DAMe, etc
Provide optional authorization for VoIP services based on end user attributes
SIP protocol for testing
Home InstitutionRemote Institution
Invite (Bob)
R-SIP Registar
SIP
SIPUA
Register ()
H-SIP Registar
authentication
401 Unauthorized
SIP
401 Unauthorized
Register (authz_data) Register (authz_data)
200 OK200 OK
R-SIP Proxy
H-SIP Proxy
Register ()
Invite (Bob)
401 Unauthorized 401 Unauthorized
Invite (Bob,authz_data)
Trying
Invite (Bob,authz_data) authentication
Trying
Session in progress
SIP SIP
Reg
istr
atio
nC
all i
nitia
tion
Profile 1: The user has a valid SSO token◦ From the end user network authentication (DAMe)◦ New registration method required◦ Token validation through BEs◦ Extending registration method for authorization
Profile 2: The end user does not have a valid SSO token◦ Receives a new SSO token for further authentications
(VoIP, Web, etc…)◦ Who does the end user authentication?
VoIP Registrar vs idP◦ Who does the token generation? BEs vs idP
Profile 2: SSO token generation delegated to the BEs (DAMe-based)
Profile 2.1 Traditional authentication in the registrar server (HTTP-Digest) Authentication in the registrar server
Profile 2.2 Authentication based on HTTP (HTTP-redirect) Authentication in the idP
Profile 2.3 in-line/native authentication (new method) Authentication in the idP
◦
Home InstitutionRemote Institution
Register (Token)
AuthZRequest(token)
Network authentication
R-SIP Registar
eduGAINR-BE idP Authn
Attrib.
SIP
Federation specificSOAP
Attribute request
Attribute response
Authorizationpolicy
ok200 OK
SIPUA
eduGAINH-BE
Attribute request
Attribute response
SOAP
Register (Token)
H-SIP Registar
AuthNRequest(token)token
validationAutnNResponse200 OK
SOAPSIP
Reg
istr
atio
n
Extension of SIP messages:◦ Register (token)◦ New authentication method
Extension of SIP proxies:◦ Token validation BEs◦ Authorization based on end user and environment
attributes BEs Authorization process (attributes recovery and PDP requests
are transparent for proxies )
Home InstitutionRemote Institution
R-SIP Registar
eduGAINR-BE idP Authn
Attrib.
SIPFederation specificSOAP
SIPUA
eduGAINH-BE
SOAP
H-SIP Registar
Register (authz_data)
AuthNQuery(user)
AuthnResponse
200 OK (Token)
Authn query (user)
Authentication
Register
401 Unauthorized
SSO token
Register
401 Unauthorized
Register (authz_data)
200 OK (Token)
SIP SOAP
Reg
istr
atio
n
Authorization
Extension of SIP messages:◦ OK 200 (token)◦ Classic authentication
Extension of SIP proxies:◦ Token generation request BEs◦ Authorization based on end user and environment
attributes BEs
Home InstitutionRemote Institution
R-SIP Registar
eduGAINR-BE idP Authn
Attrib.
SIP Federation specific
SOAP
SIPUA
eduGAINH-BE
SOAP
H-SIP Registar
authentication
200 OK (Token)
AuthnRequest (user:pass)
artifact
Register
401 Unauthorized
Register
401 Unauthorized
Register (artifact) Register (artifact)
200 OK (Token)
Recover statementAuthNRequest(artifact)
SSO token
SIP SOAP
HTTP/Federation specific
Reg
istr
atio
n
Authorization
Extension of SIP messages:◦ REGISTER (artifact)◦ OK 200 (token)◦ HTTP redirection authN
Extension of SIP proxies:◦ Token generation request BEs◦ Authorization based on end user and environment
attributes BEs
Home InstitutionRemote Institution
R-SIP Registar
eduGAINR-BE idP Authn
Attrib.
SIP Federation specific
SOAP
SIPUA
eduGAINH-BE
SOAP
H-SIP Registar
authentication
200 OK (token)
Register (creds)
Register
401 Unauthorized
Register
401 Unauthorized
200 OK (token)
AuthNRequest(creds)
Authen statement
Register (creds)
SSO Token
SIP SOAP
AuthNRequest(creds)
Reg
istr
atio
n
Authorization
Extension of SIP messages:◦ OK 200 (token)◦ Register includes end user creds (protected channel
needed) Extension of SIP proxies:
◦ Token generation request BEs◦ Authorization based on end user and environment
attributes BEs
AuthnRequest(SSOToken): Boolean◦ SSOToken validation (profile 1)
Validity Period, signature (PKC chain, trust anchors, etc) AuthnQuery(user): SSOToken
◦ Requests authentication statement from idP (profile 2.1)◦ Generates SSO token
AuthnRequest(artifact): SSOToken◦ AuthN statement recovery from idP (profile 2.2)◦ SSO token generation
AuthnRequest(creds): SSOToken◦ Sends authentication requests (application specific to idP)
(profile 2.3)◦ SSO token generation
AuthzRequest(SSOToken): Boolean (+obligations)◦ Recover end user attributes from home domain
Through eduGAIN BEs Directly from the AttributeProvider
◦ Request an Authorization Decision To the local PDP Based on End User id, End User attributes, resource, action,
other info (date/time, network load, etc.)
SIP allows the extension of standard messages◦ Extension Service Instruction
Authentication methods have already been proposed in other works
BE-API valid for other services? Compliant with other SAML/SIP proposals
(Tschofenig) Security of the token
◦ alice R-SIP Registrar◦ SIP/SSL, IPSec, token encryption
backup
Home Institution
Remote Insitution
SAMLResp.AttributeStat.
attributes
Access-Accept (with handle)
translateobligations
ACCESS-ACCEPT+ propertiesEAP-SUCCESS
eduroam
SearchRequest(uid:handle, action,
resource)
SearchResult(obligations)
Network authentication
RADIUSRADIUS
End User
NAP eduGAINBE
PDP(AuthZEngine)
eduGAINBE
idP Authn
Attrib.
SAMLRequestAttributeQuery
handle
EAPOL
EAPRADIUS
Federation specific
RADIUS / EAP
SOAP
LDAP SOAP
XACMLResourceAccessPolicy
SAMLResponseXACMLAuthZDecSt.
XACMLResponseresult obligs.
SAMLRequestXACMLAuthZDecisionQ
XACMLRequesthandle
res. actionevidence
attrs.
User’s Device
Service Provider Domain
Request Access
Receive eduToken
User
NAP SPR-BE
(token-enabled)
uSSOClient
SupplicantToken
Manager
RMI PEAP
Browser(Java
plugin)
Network authentication
Encrypt and store eduToken
Redirect
WAYF
Redirect
Select „via eduToken“
Token Fetcher Applet
Fetch eduToken
Decrypt eduToken
Return eduToken
POST eduToken
ValidateeduToken
Create Assertion
Send AssertionGrant Access
HTTPS
HTTPS
HTTPS
HTTPS HTTPS
