Transcript NAS-SAML
Deploying Authorization Mechanisms for Federated Services in the EDUROAM Architecture (DAME) -Technical Project ProposalÓscar Cánovas (UM) Antonio G. Skármeta (UM) Diego R. Lopez (RedIRIS) Klaas Wierenga (SURFnet) TF-EMC2 February 2006, Zagreb Overview Introduction Motivation of this project Background and previous work: NAS-SAML Main goals TF-EMC2 Introduction DAME is a project that builds upon previous TERENA, GN2, Internet2, and University of Murcia work: EDUROAM, a result of TERENA Mobility Task Force, which defines an inter-NREN roaming architecture, eduGAIN, the AAI interoperation infrastructure designed by GN2 JRA5 Documentation available on the Shibboleth web site. NAS-SAML, a network access control approach for AAA environments, developed by the University of Murcia (Spain), based on the SAML and the XACML standards, TF-EMC2 Documentation available at the GÉANT2 web site Shibboleth, a widely deployed federation mechanism developed by Internet2 and the NSF Middleware Initiative. Reports available on the EDUROAM web site Documentation available on the http://pki.dif.um.es web site Overview Introduction Motivation of this project Background and previous work: NAS-SAML Main goals TF-EMC2 Motivation We have experienced the emergence of federated approaches to resource sharing. Access to shared resources with a single identity Examples of these approaches: the establishment of academic federations worldwide and the concepts around Grid Computing. Some aspects generally related with integral identity management are still open, especially those related to user authorization. One of the main resources to share is the network, for mobility purposes. TF-EMC2 Only allowed users are able to perform the set of allowed actions over each resource. The TERENA Mobility Task Force defined and tested an inter-NREN roaming architecture, called EDUROAM, proposed after identifying the most suitable techniques currently deployed in the NRENs. Motivation EDUROAM allows users of participating institutions to access the Internet at other participants using their home institution's credentials. It would be desirable to extend the EDUROAM architecture with authentication and authorization mechanisms. NAS-SAML is an access control proposal for AAA environments which can be used to extend EDUROAM to exchange existing credentials. Credentials can be expressed in several forms, ranging from eduGAIN/Shibboleth statements to X.509 Attribute certificates Additionally, this authorization mechanism might be used at servicelevel, for example for Grid Computing purposes. EDUROAM constitutes an exceptional starting point to offer a full and integrated network access experience to the users. TF-EMC2 Overview Introduction Motivation of this project Background and previous work: NAS-SAML Main goals TF-EMC2 NAS-SAML Main objectives: TF-EMC2 To define a network access control approach based on: X.509 PKC authentication User attributes (roles) Authorization policies. Rules stating the permissions give to each system role. Use of XML to express: access control policies (XACML) authorization statements (SAML) authorization protocols (SAML) The scenario should be integrated in the AAA architecture. NAS-SAML TF-EMC2 Architectural elements NAS-SAML End User: Entity requesting access to the network Authentication based on (X.509 PKC or login/passwd pairs) AAA Server: TF-EMC2 Source Authority (SA) Policy Decision Point (PDP) Source Authority (SA): Requires two ASM modules: Manages the Role Assignment Policy (roles to users) Role Assignment Policy: “in the source domain Source, the set of roles R1, R2.. Rn can be assigned to the users contained in the o=org,c=ES X.500 sub-tree for the period V” Based on XACML NAS-SAML Policy Decision Point (PDP): Generates the statements related to authorization decisions Manages the Resource Access Policy Policy Administration Point (PAP): TF-EMC2 Defines, signs and publishes the Resource Access Policy Resource Access Policy: “the users pertaining to the source domain Source, and playing the role R1, will get access to the network N1 with a QoS1” Based on XACML Network Access Point (NAP): forwards the client requests to the appropriate AAA server of the target domain obtains and enforces the properties of the network connection NAS-SAML TF-EMC2 Example: Inter-domain pull model NAS-SAML Current status: TF-EMC2 Architectural elements, protocols, integration with DIAMETER G. López, O. Cánovas, A. F. Gómez-Skarmeta, R. Marín. “A Network Access Control Approach based on the AAA Architecture and Authorization Attributes”. Journal of Network and Computer Applications Implemented and tested. Security policies (access control, role assignment, conversion): G. López, O. Cánovas, A. F. Gómez-Skarmeta. “Use of XACML Policies for a Network Access Control Service”. 4th International Workshop of Applied PKI, IWAP’2005. Implemented and tested. Integration with PERMIS (in collaboration with D. W. Chadwick): G. López, O. Cánovas, A. F. Gómez-Skarmeta, O. Otenko, D.W. Chadwick. “A Heterogeneous Network Access Service based on PERMIS and SAML”. 2nd European PKI Workshop, EuroPKI’2005. Implemented and tested. Overview Introduction Motivation of this project Background and previous work: NAS-SAML Main goals and summary of activities TF-EMC2 Main goals First Goal: Extension of EDUROAM using NAS-SAML User mobility controlled by assertions and policies expressed in SAML and XACML. Enhanced interoperability among organizations (common language) XACML Policies Policy Decision Point RADIUS + SAML TF-EMC2 Source Attribute Authority Main goals First Goal: Extension of EDUROAM using NAS-SAML RELATED ACTIVITIES: TF-EMC2 Activity 1. Integration of the NAS-SAML architecture in the EDUROAM network. Task 1. Analysis of the current status of the EDUROAM network. Task 2. Analysis of the required user attributes and policies for roaming. Task 3. Development of the Source Authority and Policy Decision Points. Task 4. Development a custom SAML module for RADIUS and DIAMETER servers. Task 5. Create a translator to convert RADIUS messages into DIAMETER and vice versa. Task 6. Validate the resulting architecture for mobility purposes. Activity 2. Development of a user-friendly management interface for authorization policies. Task 1. Analysis of the different existing proposals for privilege administration. Task 2. Development of a high level interface able to be integrated with common office applications. Task 3. Creation of interpreters and translators able to convert policies into XACML. Task 4. Validate the resulting interface. Main goals Second Goal: Use of eduGAIN/Shibboleth as AuthN and AuthZ backend NAS-SAML has been already integrated with other proposals (X.509 AC) Link between the AAA servers (now acting as Service Providers) and the Identity Providers of the federation. XACML Policies Policy Decision Point (SAML) Authentication Statement Attribute Statements Access point Shibboleth Federation Network Access Service (RADIUS/DIAMETER Acting as Service Provider) TF-EMC2 Identity Provider (Shibboleth) Main goals Second Goal: Preliminary design. Home SD Attr Auth EU Target SD SP IP NAP AAA SA Login/Pass Login/Pass authenticate user SAMLRes. AuthNSt or Artifact EAP-SUCCESS SAMLRes. AuthNSt or Artifact Authorization process attributes SAMLRes. AuthNSt or Artifact SAMLRes . artifact SAMLRes . AuthNSt HTTP 200OK EAP-PEAP PI HTTPS SOAP HTTPS TF-EMC2 HTTPS PDP Main goals Second Goal: Use of eduGAIN/Shibboleth as AuthN and AuthZ backend RELATED ACTIVITIES: TF-EMC2 Activity 3. Use of eduGAIN/Shibboleth as authentication back-end for NAS-SAML Task 1. Analysis of the proposed profiles for SSO. Identification of the possible modifications that would require some of those profiles. Task 2. Development of a Shibboleth Service Provider module responsible for the creation and exchange of Shibboleth data exchange Task 3. Development of an eduGAIN BE to provide direct access to the confederation infrastructure Task 4. Definition of the authentication methods to be used by the end users in order to demonstrate their digital identity. Task 5. Extension of the existing XACML context manager in order to interpret the eduGAIN/Shibboleth SAML credentials. Task 6. Validate the resulting architecture. Main goals Third Goal: Global Single Sign On (SSO) Users will be authenticated once, during the network access control phase The eduGAIN/Shibboleth authentication would be bootstrapped from the NAS-SAML New PEAP method for delivering authentication credentials and new security middleware XACML Policies Policy Decision Point (SAML) Authentication Statement Attribute Statements Identity Provider (Shibboleth) Shibboleth Federation (SAML) Authentication Statement or Artifact Network Access Service (RADIUS/DIAMETER) (SAML) Authentication Statement or Artifact Service Provider Assertion Consumer TF-EMC2 Target Resource Additional SAML Attributes Main goals Third Goal: Global Single Sign On (SSO) RELATED ACTIVITIES: Activity 4. Development of a global SSO Task 1. Analysis of the requirements of a new PEAP authentication method able to exchange the necessary eduGAIN/Shibboleth signed tokens. Task 2. Development of the client and server software modules implementing the specified PEAP method.. Task 3. Design and develop the middleware able to manage the signed Shibboleth tokens that will be then provided to the resource providers Task 4. Modify the existing service providers in order to include a custom SSO profile based on a push method, that is, a method where the end users are able to provide the required authentication credentials. TF-EMC2 Task 5. Validate the resulting system. Main goals Fourth Goal: Authorization mechanisms for application-level services Mainly focused on Grid Computing Grid Services have specific components for authorization purposes We plan to link that components with the existing authorization infrastructure, using standard extension points: OGSA-Authz MyProxy GridShib RELATED ACTIVITIES: TF-EMC2 Activity 5. Deployment of an authorization mechanism for an application-level service: Grid Computing. Task 1. Analysis of the different Grid platforms that are being currently used in the different European initiatives. Task 2. Analysis of the GridShib tool as starting point to provide authorization services to Grids. Task 3. Definition of the set of attributes used to describe grid-relevant properties. Task 4. Modify the existing network of AAA servers in order to add the Grid-related policies and attributes. Task 5. Validate the resulting authorization services.