Identity management. Tuomas Aura T Information security technology. Aalto University, autumn 2011
|
|
- Erik Armstrong
- 6 years ago
- Views:
Transcription
1 Identity management Tuomas Aura T Information security technology Aalto University, autumn 2011
2 Outline 1. Single sign-on 2. OpenId 3. SAML and Shibboleth 4. Corporate IAM 5. Strong identity 2
3 Single sign-on (SSO) Users have too many user accounts Cannot remember the passwords Service access slow and inconvenient Forgotten, unmanaged accounts are a security risk Need for an SSO solution Pseudo-SSO: separate authentication to each service; client software manages the credentials and hides the login from user Proxy-based SSO: proxy in network manages user credentials and hides the login details from the client True SSO: user authenticates to a separate authentication service, which asserts user identity to other services Federated SSO: authentication between administrative domains Main problem with SSO systems: there re so many of them 3
4 OPENID 4
5 OpenId architecture End user / user agent UA Relying party RP Identity provider OP Register OpenId for user account Authenticate Create OpenId Standard for SSO to web sites End user creates an OpenId (=identity) at some OpenId provider (OP) End user registers the OpenId at various relaying parties (RP) i.e. web sites End user authenticates to RP with the help of OP The end user needs a web browser i.e. user agent (UA) 5
6 OpenId 2.0 protocol End user / user agent UA Relying party RP Identity provider OP 1. Identifier 2. OP discovery [3. Association: DH] 4. Redirect: authentication request 5. User authentication: e.g. password 6. Redirect: authentication approved/failed 8. Service access [7. Direct verification] (only if no step 3) Identifier is an HTTP URL (or XRI): gives the OP address e.g. username.myopenid.com, Direct messages use HTTP POST Indirect messages use HTTP redirect Data fields sent as URL parameters via the browser Method of user authentication not specified; typically a password 6
7 OpenId 2.0 security End user / user agent UA Relying party RP Identity provider OP User must check OP name and RP name 1. Identifier 8. Service access 2. OP discovery [3. Association: DH] 4. Redirect: authentication request 5. User authentication: e.g. password 6. Redirect: authentication approved/failed [7. Direct verifivation] TLS to authenticate the DH key exchange TLS to protect the password MAC with the association key (only if no step 3) TLS to authenticate result Approval /failure message from OP to RP is authenticated with a timestamp and MAC RP can establish a MAC key with Diffie-Hellman, or ask OP to verify the MAC for it TLS not required by OpenId spec but needed for real security: RP must authenticate OP in the Diffie-Hellman or direct verification step UA must authenticate OP before user types in the password TLS can be used between UA and RP to protect service access (Q: does it matter?) User must pay attention: Check HTTPS and OP name in the browser address bar before typing in the password Check RP name presented by OP to approve login 7
8 OpenId notes What does open mean? Anyone can become an identity provider User can choose any identity provider Services accept the identity chosen by the user Works on any web browser without proprietary software In practice, not always so open: RP policy may determine which OPs are accepted OP policy may determine which RPs are accepted User-provided id may just point to OP without identifying the user e.g. OpenId specification is poorly written Assumes the reader knows previous versions Uses XRI, Yadis and XRDS: very complex and incomplete specifications Security not obvious: Focus on web technology, not on secure protocol design Vague security claims especially when used without TLS 8
9 SAML AND SHIBBOLETH 9
10 SAML 2.0 architecture Principal Service provider SP Identity provider IdP Trust relation Register user Authenticate Security assertion markup language (SAML 2.0) OASIS standard (combines ideas from SAML 1.1, Liberty Alliance identity-federation framework 1.2, and Shibboleth 1.3) Service provider (SP) and identity provider (IdP) establish a trust relation by exchanging metadata Principal (= user, subject) registers with the IdP Principal authenticates to IdP and SP 10
11 SAML SAML is a complex family of protocols: Assertions are statements by IdP about a principal, written in XML Protocols define message flows for requesting assertions Bindings define how protocol messages are transported over HTTP, SOAP etc. Profiles define useful combinations of assertions, protocols and bindings Metadata defines trust relations Unlike OpenId, SAML is based on contractual relations Metadata must be exchanged between IdP and SP Federation may set rules for its member IdPs and SPs User cannot decide which id to use where Typical profile: SAML web browser SSO profile 11
12 SAML web browser SSO profile IdP-initiated or SP-initiated SSO: User first logs into the IdP, or first connects to SP Bindings to HTTP messages Redirect: message from SP to IdP is sent in GET URL via browser, with help of HTTP redirection POST: message between SP and IdP is sent in HTTP form via browser, with the help of user or script Artifact: reference to message is sent in GET URL via browser, with the help of HTTP redirection, and the actual message is retrieved directly from sender Other profiles support SOAP bindings 12
13 SAML web browser SSO profile Principal Service provider SP Identity provider IdP 1. Access request 2. <AuthnRequest> SP-initiated SSO 3. User login to IdP 4. <Response> Resource access Protocol for SP-initiated SSP: AuthnRequest and Response How to send these messages over HTTP? Need to choose bindings; 6 different combinations 13
14 SAML web browser SSO profile Principal Service provider SP Identity provider IdP 1. Access request 2. Redirect: <AuthnRequest> 3. User login to IdP 4. Redirect with artifact SP-initiated SSO SAML Redirect- Artifact binding 7. Resource access 5. Resolve artifact 6. Artifact response (<Response>) Example: redirect-artifact binding: SP sends <AuthnRequest> to IdP in GET URL with HTTP redirect IdP sends an artifact to SP in GET URL with HTTP redirect SP retrieves <Response> from IdP with artifact resolution protocol 14
15 SAML security Principal Service provider SP Identity provider IdP 1. Access request 2. Redirect: <AuthnRequest> 3. User login to IdP 4. Redirect with artifact TLS for all connections 7. Resource access 5. Resolve artifact 6. Artifact response <Response> Sign with IdP signature key Response must be signed by IdP TSL needed for all connections: Protects password; protects secrecy of attributes; prevents redirection to wrong site Attributes in Response signed by IdP 15
16 Shibboleth 2 Open-source implementation of SAML 2.0 for web SSO (wiki) Developed by the Internet 2 project Used mainly in research and educational institutions; many other commercial and open-source SAML implementation exist If SP supports multiple IdPs, SP-initiated authentication goes via the where are you from (WAYF) page One more step of redirection for the AuthnRequest Two kinds of sessions: IdP session with the IdP (cookies from IdP) SP session with each SP (cookies from SP) user only needs to type in password once; not single logout Federation is a group of IdPs and SPs that share metadata in one signed file agree on an attribute schema agree on CA for TLS have a service agreement that sets out rules for the federation e.g. Haka federation 16
17 SAML attributes In addition to user identity, <Response> from IdP to SP contains user attributes Attributes sent to each SP are selected based on attribute filters in metadata Example: cn = Tuomas Aura o = Teknillinen korkeakoulu edupersonaffiliation = employee;faculty;member Try User attributes are personal data For legal reasons, IdP needs user confirmation before transferring attributes to SP the annoying check box after IdP login 17
18 CORPORATE IAM 18
19 Corporate IAM Federated identity and authentication is not sufficient: Need to configure access permissions for users in the services Need to monitor access control state in the system Need to revoke access rights Identity and access management (IAM) systems Define roles and groups for the organization Enable centralized role assignment, revocation and monitoring Example: student enrolls to university, then becomes employee, then graduates, finally leaves employment Central IAM server and IAM agent at each supported service more expensive to develop and deploy than federated authentication 19
20 [Internet 2 Middleware Initiative] 20
21 STRONG IDENTITY 21
22 Strong authentication Goal: authentication equivalent to verifying national identity card or passport Why is it needed? Initial id check when registering new users, e.g. students enrolling to university Required by law for access to government services and personal information Increasing trust in commercial online transactions but this has already been solved in other ways Why not use OpenId or SAML? OpenId allows user to choose identifier no link to real person SAML works internally in organizations and between organizations that have a contract not for new or adhoc relations 22
23 Finnish electronic identity card Finnish identity cards (HST-kortti) have a smartcard chip with three key pairs Signature, encryption and authentication keys Keys are certified by the national population register (VRK) Has not gained popularity; few people have an id card; even fewer ever use it for electronic authentication Why? 23
24 Tupas authentication Tupas uses bank accounts for strong authentication Defined by Federation of Finnish Financial Services Developed from online the payment system (commonly used in Finland for online purchases) User authentication with one-time passwords Advantage: everyone has a bank account, and banks are required to know the identity of their customers no cost for identity proofing Example: 24
25 Tupas authentication User Online service Bank 1. Bank selection 2. POST redirection 3. One-time password login to bank 4. POST redirection: name, national id id number, MAC 5. Service access TLS for all connections Authenticated with a shared key; id number may be encrypted Three-corner authentication model: user, user s bank, online service Each service must set up a shared key with each bank Smaller banks are not supported by all online services 25
26 Mobile signature Mobile phone operators install a signature key on the SIM ETSI standard Developed from earlier business SIM No direct access from phone to signature key; signatures are requested via the operator s mobile signature service provider (MSSP) Advantages: everyone has a SIM card, and operators have 24/7 service for revocation Four-corner authentication model: Mobile operators have contracts with each other Each service and user only needs to have a contract with one operator Deployment and adoption has been slow Heavy requirements for identity proofing Operators want a fee for every transaction low number of transactions no business model 26
27 Online: Reading material OpenId 2.0, SAML 2.0 Technical Overview, 27
28 Exercises How much security does OpenId exactly give if TLS is not used? Learn about XRI name space and XRI discovery. If XRI is used as the user identifier in OpenId, how is the user supposed to authenticate the OP before typing in the password? What is the difference to security and privacy if the user-provided id points to the OP without identifying the user, and the user identity is entered only at the OP site? Look at the Haka federation metadata for Shibboleth 2. How does this create trust between an IdP and SP? What ways are there to limit the trust? Can you capture the AuthnRequest and Response messages when logging into Noppa? Which bindings are used? Why exactly is TLS needed at each stage in SAML/Shibboleth authentication, or is it? Despite similarities in the protocols, OpenId, SAML and Tupas have different goals and make different assumptions about the relations between entities. What differences are there? 28
Identity management. Tuomas Aura CSE-C3400 Information security. Aalto University, autumn 2014
Identity management Tuomas Aura CSE-C3400 Information security Aalto University, autumn 2014 Outline 1. Single sign-on 2. SAML and Shibboleth 3. OpenId 4. OAuth 5. (Corporate IAM) 6. Strong identity 2
More informationWeb Based Single Sign-On and Access Control
0-- Web Based Single Sign-On and Access Control Different username and password for each website Typically, passwords will be reused will be weak will be written down Many websites to attack when looking
More informationISA 767, Secure Electronic Commerce Xinwen Zhang, George Mason University
Identity Management and Federated ID (Liberty Alliance) ISA 767, Secure Electronic Commerce Xinwen Zhang, xzhang6@gmu.edu George Mason University Identity Identity is the fundamental concept of uniquely
More informationIdentity Provider for SAP Single Sign-On and SAP Identity Management
Implementation Guide Document Version: 1.0 2017-05-15 PUBLIC Identity Provider for SAP Single Sign-On and SAP Identity Management Content 1....4 1.1 What is SAML 2.0.... 5 SSO with SAML 2.0.... 6 SLO with
More informationSAML-Based SSO Solution
About SAML SSO Solution, page 1 Single Sign on Single Service Provider Agreement, page 2 SAML-Based SSO Features, page 2 Basic Elements of a SAML SSO Solution, page 3 Cisco Unified Communications Applications
More informationCA SiteMinder. Federation in Your Enterprise 12.51
CA SiteMinder Federation in Your Enterprise 12.51 This Documentation, which includes embedded help systems and electronically distributed materials (hereinafter referred to as the Documentation ), is for
More informationSAML-Based SSO Solution
About SAML SSO Solution, page 1 SAML-Based SSO Features, page 2 Basic Elements of a SAML SSO Solution, page 2 SAML SSO Web Browsers, page 3 Cisco Unified Communications Applications that Support SAML SSO,
More informationFederated Identity Manager Business Gateway Version Configuration Guide GC
Tivoli Federated Identity Manager Business Gateway Version 6.2.1 Configuration Guide GC23-8614-00 Tivoli Federated Identity Manager Business Gateway Version 6.2.1 Configuration Guide GC23-8614-00 Note
More informationWarm Up to Identity Protocol Soup
Warm Up to Identity Protocol Soup David Waite Principal Technical Architect 1 Topics What is Digital Identity? What are the different technologies? How are they useful? Where is this space going? 2 Digital
More informationTest Plan for Liberty Alliance SAML Test Event Test Criteria SAML 2.0
1 2 3 4 5 6 7 8 9 10 11 Test Plan for Liberty Alliance SAML Test Event Test Criteria SAML 2.0 Version 3.1 Editor: Kyle Meadors, Drummond Group Inc. Abstract: This document describes the test steps to achieve
More informationCA CloudMinder. SSO Partnership Federation Guide 1.51
CA CloudMinder SSO Partnership Federation Guide 1.51 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the Documentation ) is
More informationCA SiteMinder Federation
CA SiteMinder Federation Partnership Federation Guide 12.52 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the Documentation
More informationRealMe. SAML v2.0 Messaging Introduction. Richard Bergquist Datacom Systems (Wellington) Ltd. Date: 15 November 2012
RealMe Version: Author: 1.0 APPROVED Richard Bergquist Datacom Systems (Wellington) Ltd Date: 15 November 2012 CROWN COPYRIGHT This work is licensed under the Creative Commons Attribution 3.0 New Zealand
More informationOracle Utilities Opower Solution Extension Partner SSO
Oracle Utilities Opower Solution Extension Partner SSO Integration Guide E84763-01 Last Updated: Friday, January 05, 2018 Oracle Utilities Opower Solution Extension Partner SSO Integration Guide Copyright
More informationEnhancing cloud applications by using external authentication services. 2015, 2016 IBM Corporation
Enhancing cloud applications by using external authentication services After you complete this section, you should understand: Terminology such as authentication, identity, and ID token The benefits of
More informationMajor SAML 2.0 Changes. Nate Klingenstein Internet2 EuroCAMP 2007 Helsinki April 17, 2007
Major SAML 2.0 Changes Nate Klingenstein Internet2 EuroCAMP 2007 Helsinki April 17, 2007 Tokens, Protocols, Bindings, and Profiles Tokens are requests and assertions Protocols bindings are communication
More informationExtending Services with Federated Identity Management
Extending Services with Federated Identity Management Wes Hubert Information Technology Analyst Overview General Concepts Higher Education Federations eduroam InCommon Federation Infrastructure Trust Agreements
More informationMorningstar ByAllAccounts SAML Connectivity Guide
Morningstar ByAllAccounts SAML Connectivity Guide 2018 Morningstar. All Rights Reserved. AccountView Version: 1.55 Document Version: 1 Document Issue Date: May 25, 2018 Technical Support: (866) 856-4951
More informationApril Understanding Federated Single Sign-On (SSO) Process
April 2013 Understanding Federated Single Sign-On (SSO) Process Understanding Federated Single Sign-On Process (SSO) Disclaimer The following is intended to outline our general product direction. It is
More informationCA SiteMinder Federation
CA SiteMinder Federation Legacy Federation Guide 12.52 SP1 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the Documentation
More informationAuthentication. Katarina
Authentication Katarina Valalikova @KValalikova k.valalikova@evolveum.com 1 Agenda History Multi-factor, adaptive authentication SSO, SAML, OAuth, OpenID Connect Federation 2 Who am I? Ing. Katarina Valaliková
More informationU.S. E-Authentication Interoperability Lab Engineer
Using Digital Certificates to Establish Federated Trust chris.brown@enspier.com U.S. E-Authentication Interoperability Lab Engineer Agenda U.S. Federal E-Authentication Background Current State of PKI
More informationConfiguring Single Sign-on from the VMware Identity Manager Service to Marketo
Configuring Single Sign-on from the VMware Identity Manager Service to Marketo VMware Identity Manager JANUARY 2016 V1 Configuring Single Sign-On from VMware Identity Manager to Marketo Table of Contents
More informationCA SiteMinder. Federation Manager Guide: Legacy Federation. r12.5
CA SiteMinder Federation Manager Guide: Legacy Federation r12.5 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the Documentation
More informationCA CloudMinder. SSO Partnership Federation Guide 1.53
CA CloudMinder SSO Partnership Federation Guide 1.53 This Documentation, which includes embedded help systems and electronically distributed materials (hereinafter referred to as the Documentation ), is
More informationSAML Authentication with Pulse Connect Secure and Pulse Secure Virtual Traffic Manager
SAML Authentication with Pulse Connect Secure and Pulse Secure Virtual Traffic Manager Deployment Guide Published 14 December, 2017 Document Version 1.0 Pulse Secure, LLC 2700 Zanker Road, Suite 200 San
More informationPublic Key Infrastructure PKI. National Digital Certification Center Information Technology Authority Sultanate of Oman
Public Key Infrastructure PKI National Digital Certification Center Information Technology Authority Sultanate of Oman Agenda Objectives PKI Features etrust Components Government eservices Oman National
More informationLiberty Alliance Project
Liberty Alliance Project Federated Identity solutions to real world issues 4 October 2006 Timo Skyttä, Nokia Corporation Director, Internet and Consumer Standardization What is the Liberty Alliance? The
More informationUsing Your Own Authentication System with ArcGIS Online. Cameron Kroeker and Gary Lee
Using Your Own Authentication System with ArcGIS Online Cameron Kroeker and Gary Lee Agenda ArcGIS Platform Structure What is SAML? Meet the Players Relationships Are All About Trust What Happens During
More informationIntroducing Shibboleth. Sebastian Rieger
Introducing Shibboleth Sebastian Rieger sebastian.rieger@gwdg.de Gesellschaft für wissenschaftliche Datenverarbeitung mbh Göttingen, Germany CLARIN AAI Hands On Workshop, 25.02.2009, Oxford eresearch Center
More informationDissecting NIST Digital Identity Guidelines
Dissecting NIST 800-63 Digital Identity Guidelines KEY CONSIDERATIONS FOR SELECTING THE RIGHT MULTIFACTOR AUTHENTICATION Embracing Compliance More and more business is being conducted digitally whether
More informationKerberos for the Web Current State and Leverage Points
Kerberos for the Web Current State and Leverage Points Executive Advisory Board Meeting and Financial Services Security Summit New York, 3-4 November 2008. Towards Kerberizing Web Identity and Services
More informationThe Business of Identity: Business Drivers and Use Cases of Identity Web Services
The Business of Identity: Business Drivers and Use Cases of Identity Web Services Roger Sullivan, Vice President, Liberty Alliance Vice President, Oracle Corporation Liberty s Architecture Liberty Identity
More informationIBM InfoSphere Information Server Single Sign-On (SSO) by using SAML 2.0 and Tivoli Federated Identity Manager (TFIM)
IBM InfoSphere Information Server IBM InfoSphere Information Server Single Sign-On (SSO) by using SAML 2.0 and Tivoli Federated Identity Manager (TFIM) Installation and Configuration Guide Copyright International
More informationOracle Utilities Opower Energy Efficiency Web Portal - Classic Single Sign-On
Oracle Utilities Opower Energy Efficiency Web Portal - Classic Single Sign-On Configuration Guide E84772-01 Last Update: Monday, October 09, 2017 Oracle Utilities Opower Energy Efficiency Web Portal -
More information1z0-479 oracle. Number: 1z0-479 Passing Score: 800 Time Limit: 120 min.
1z0-479 oracle Number: 1z0-479 Passing Score: 800 Time Limit: 120 min Exam A QUESTION 1 What is the role of a user data store in Oracle Identity Federation (OIF) 11g when it is configured as an Identity
More informationEnhanced OpenID Protocol in Identity Management
Enhanced OpenID Protocol in Identity Management Ronak R. Patel 1, Bhavesh Oza 2 1 PG Student, Department of Computer Engg, L.D.College of Engineering, Gujarat Technological University, Ahmedabad 2 Associate
More informationAccess Management Handbook
Access Management Handbook Contents An Introduction 3 Glossary of Access Management Terms 4 Identity and Access Management (IAM) 4 Access Management 5 IDaaS 6 Identity Governance and Administration (IGA)
More informationIntroduction to application management
Introduction to application management To deploy web and mobile applications, add the application from the Centrify App Catalog, modify the application settings, and assign roles to the application to
More informationTest Plan for Kantara Initiative Test Event Test Criteria SAML 2.0
1 2 3 4 5 6 7 8 9 10 11 Test Plan for Kantara Initiative Test Event Test Criteria SAML 2.0 Version: 3.3 Date: 2010-07-21 12 13 14 Editor: Kyle Meadors, Drummond Group Inc. Scott Cantor, Internet2 John
More informationLesson 13 Securing Web Services (WS-Security, SAML)
Lesson 13 Securing Web Services (WS-Security, SAML) Service Oriented Architectures Module 2 - WS Security Unit 1 Auxiliary Protocols Ernesto Damiani Università di Milano element This element
More informationDESIGN OF WEB SERVICE SINGLE SIGN-ON BASED ON TICKET AND ASSERTION
DESIGN OF WEB SERVICE SINGLE SIGN-ON BASED ON TICKET AND ASSERTION Abstract: 1 K.Maithili, 2 R.Ruhin Kouser, 3 K.Suganya, 1,2,3 Assistant Professor, Department of Computer Science Engineering Kingston
More informationConfigure Unsanctioned Device Access Control
Configure Unsanctioned Device Access Control paloaltonetworks.com/documentation Contact Information Corporate Headquarters: Palo Alto Networks 3000 Tannery Way Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-support
More informationIntegrated Security Context Management of Web Components and Services in Federated Identity Environments
Integrated Security Context Management of Web Components and Services in Federated Identity Environments Apurva Kumar IBM India Research Lab. 4, Block C Vasant Kunj Institutional Area, New Delhi, India-110070
More informationINCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES
INCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES Participation in the InCommon Federation ( Federation ) enables a federation participating organization ("Participant") to use Shibboleth identity
More informationIdentity Systems and Liberty Specification Version 1.1 Interoperability
Identity Systems and Liberty Specification Version 1.1 Interoperability A Liberty Alliance Technical Whitepaper 14 th February, 2003 Document Description: Liberty and 3rd Party Identity Systems White Paper-07.doc.
More informationIntroduction... 5 Configuring Single Sign-On... 7 Prerequisites for Configuring Single Sign-On... 7 Installing Oracle HTTP Server...
Oracle Access Manager Configuration Guide for On-Premises Version 17 October 2017 Contents Introduction... 5 Configuring Single Sign-On... 7 Prerequisites for Configuring Single Sign-On... 7 Installing
More informationCA SiteMinder. Federation Manager Guide: Partnership Federation. r12.5
CA SiteMinder Federation Manager Guide: Partnership Federation r12.5 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the Documentation
More informationIntegration Guide. SafeNet Authentication Manager. Using SAM as an Identity Provider for PingFederate
SafeNet Authentication Manager Integration Guide Technical Manual Template Release 1.0, PN: 000-000000-000, Rev. A, March 2013, Copyright 2013 SafeNet, Inc. All rights reserved. 1 Document Information
More informationCloud Secure Integration with ADFS. Deployment Guide
Cloud Secure Integration with ADFS Deployment Guide Product Release 8.3R3 Document Revisions 1.0 Published Date October 2017 Pulse Secure, LLC 2700 Zanker Road, Suite 200 San Jose CA 95134 http://www.pulsesecure.net
More informationINCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES
INCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES Participation in the InCommon Federation ( Federation ) enables a federation participating organization ("Participant") to use Shibboleth identity
More informationFrom UseCases to Specifications
From UseCases to Specifications Fulup Ar Foll Liberty Technical Expert Group Master Architect, Global Software Practice Sun Microsystems Why Identity Related Services? Identity-enabling: Exposes identity
More informationOPENID CONNECT 101 WHITE PAPER
OPENID CONNECT 101 TABLE OF CONTENTS 03 04 EXECUTIVE OVERVIEW WHAT IS OPENID CONNECT? Connect Terminology Relationship to OAuth 08 Relationship to SAML CONNECT IN MORE DETAIL Trust Model Discovery Dynamic
More informationegov Profile SAML 2.0
1 2 3 4 5 6 7 8 9 egov Profile SAML 2.0 Version 1.5 Editor: Kyle Meadors, Drummond Group Inc. Abstract: This document describes the egovernment profile for SAML 2.0. Filename: LibertyAlliance_eGov_Profile_1.5.odt
More informationIdentität und Autorisierung als Grundlage für sichere Web-Services. Dr. Hannes P. Lubich IT Security Strategist
Identität und Autorisierung als Grundlage für sichere Web-Services Dr. Hannes P. Lubich IT Security Strategist The Web Services Temptation For every $1 spent on software $3 to $5 is spent on integration
More informationINCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES
INCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES Participation in the InCommon Federation ( Federation ) enables a federation participating organization ("Participant") to use Shibboleth identity
More informationVersion 7.x. Quick-Start Guide
Version 7.x Quick-Start Guide 2005-2013 Ping Identity Corporation. All rights reserved. PingFederate Quick-Start Guide Version 7.x September, 2013 Ping Identity Corporation 1001 17th Street, Suite 100
More informationINCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES
INCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES Participation in the InCommon Federation ( Federation ) enables a federation participating organization ("Participant") to use Shibboleth identity
More informationNew trends in Identity Management
New trends in Identity Management Peter Gietz, DAASI International GmbH peter.gietz@daasi.de Track on Research and Education Networking in South East Europe, Yu Info 2007, Kopaionik, Serbia 14 March 2007
More informationPASS4TEST. IT Certification Guaranteed, The Easy Way! We offer free update service for one year
PASS4TEST IT Certification Guaranteed, The Easy Way! \ http://www.pass4test.com We offer free update service for one year Exam : 000-575 Title : IBM Tivoli Federated Identity Manager V6.2.2 Implementation
More informationOpenID Cloud Identity Connector. Version 1.3.x. User Guide
OpenID Cloud Identity Connector Version 1.3.x User Guide 2016 Ping Identity Corporation. All rights reserved. PingFederate OpenID Cloud Identity Connector User Guide Version 1.3.x January, 2016 Ping Identity
More informationWebEx Connector. Version 2.0. User Guide
WebEx Connector Version 2.0 User Guide 2016 Ping Identity Corporation. All rights reserved. PingFederate WebEx Connector User Guide Version 2.0 May, 2016 Ping Identity Corporation 1001 17th Street, Suite
More informationCanadian Access Federation: Trust Assertion Document (TAD)
Participant Name: Royal Society of Chemistry Canadian Access Federation: Trust Assertion Document (TAD) 1. Purpose A fundamental requirement of Participants in the Canadian Access Federation is that they
More informationCanadian Access Federation: Trust Assertion Document (TAD)
Participant Name: University of Guelph Canadian Access Federation: Trust Assertion Document (TAD) 1. Purpose A fundamental requirement of Participants in the Canadian Access Federation is that they assert
More informationCERN Certification Authority
CERN Certification Authority Emmanuel Ormancey (IT/IS) What are Certificates? What are Certificates? Digital certificates are electronic credentials that are used to certify the identities of individuals,
More informationInCommon Federation: Participant Operational Practices
InCommon Federation: Participant Operational Practices Participation in the InCommon Federation ( Federation ) enables a federation participating organization ( Participant ) to use Shibboleth identity
More informationSecurity analysis of OpenID, followed by a reference implementation of an npabased OpenID provider
Security analysis of OpenID, followed by a reference implementation of an npabased OpenID provider Sebastian Feld, Norbert Pohlmann Institute for Internet-Security, if(is) Gelsenkirchen University of Applied
More informationThe AAF - Supporting Greener Collaboration
SPUSC 2008 SOUTH PACIFIC USER SERVICES CONFERENCE The AAF - Supporting Greener Collaboration Stuart Allen MAMS MELCOE Macquarie University sallen@melcoe.mq.edu.au What is the AAF? The Australian Access
More informationSAP Single Sign-On 2.0 Overview Presentation
SAP Single Sign-On 2.0 Overview Presentation June 2014 Public Legal disclaimer This presentation is not subject to your license agreement or any other agreement with SAP. SAP has no obligation to pursue
More informationINCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES
INCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES Participation in InCommon Federation ( Federation ) enables the participant to use Shibboleth identity attribute sharing technologies to manage access
More informationINCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES
INCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES Participation in the InCommon Federation ( Federation ) enables a federation participating organization ("Participant") to use Shibboleth identity
More informationINCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES
INCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES Participation in the InCommon Federation ( Federation ) enables a federation participating organization ("Participant") to use Shibboleth identity
More informationINCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES
INCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES Participation in the InCommon Federation ( Federation ) enables a federation participating organization ("Participant") to use Shibboleth identity
More informationesignlive SAML Administrator's Guide Product Release: 6.5 Date: July 05, 2018 esignlive 8200 Decarie Blvd, Suite 300 Montreal, Quebec H4P 2P5
esignlive SAML Administrator's Guide Product Release: 6.5 Date: July 05, 2018 esignlive 8200 Decarie Blvd, Suite 300 Montreal, Quebec H4P 2P5 Phone: 1-855-MYESIGN Fax: (514) 337-5258 Web: www.esignlive.com
More informationNimsoft Service Desk. Single Sign-On Configuration Guide. [assign the version number for your book]
Nimsoft Service Desk Single Sign-On Configuration Guide [assign the version number for your book] Legal Notices Copyright 2012, CA. All rights reserved. Warranty The material contained in this document
More informationArcGIS Server and Portal for ArcGIS An Introduction to Security
ArcGIS Server and Portal for ArcGIS An Introduction to Security Jeff Smith & Derek Law July 21, 2015 Agenda Strongly Recommend: Knowledge of ArcGIS Server and Portal for ArcGIS Security in the context
More informationINCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES
INCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES Participation in InCommon Federation ( Federation ) enables the participant to use Shibboleth identity attribute sharing technologies to manage access
More informationBELNET R&E federation Technical policy
BELNET R&E federation Technical policy Version 1.0 Version Date 0.1 11/03/09 First draft for advisory committee 0.2 11/05/09 Added attribute schema; changes after 1st meeting 0.3 01/07/10 Changed metadata
More informationINCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES
INCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES Participation in the InCommon Federation ( Federation ) enables a federation participating organization ("Participant") to use Shibboleth identity
More informationFederal Identity, Credentialing, and Access Management. OpenID 2.0 Profile. Version Release Candidate
Federal Identity, Credentialing, and Access Management OpenID 2.0 Profile Version 1.0.1 Release Candidate November 18, 2009 Document History Status Release Date Comment Audience Release Candidate Release
More informationNew Zealand Security Assertion Messaging Standard
New Zealand Security Assertion Messaging Standard Version 1.0 - June 2008 New Zealand Security Assertion Messaging Standard New Zealand Security Assertion Messaging Standard (NZ SAMS) State Services Commission
More informationQualys SAML 2.0 Single Sign-On (SSO) Technical Brief
Qualys SAML 2.0 Single Sign-On (SSO) Technical Brief Qualys provides its customers the option to use SAML 2.0 Single SignOn (SSO) authentication with their Qualys subscription. When implemented, Qualys
More informationQuick Connection Guide
WebEx Connector Version 1.0.1 Quick Connection Guide 2014 Ping Identity Corporation. All rights reserved. PingFederate WebEx Connector Quick Connection Guide Version 1.0.1 March, 2014 Ping Identity Corporation
More informationFederated Authentication for E-Infrastructures
Federated Authentication for E-Infrastructures A growing challenge for on-line e-infrastructures is to manage an increasing number of user accounts, ensuring that accounts are only used by their intended
More informationINCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES
INCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES Participation in the InCommon Federation ( Federation ) enables a federation participating organization ("Participant") to use Shibboleth identity
More informationINCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES
INCOMMON FEDERATION: PARTICIPANT OPERATIONAL PRACTICES Participation in the InCommon Federation ( Federation ) enables a federation participating organization ("Participant") to use Shibboleth identity
More informationTestKings.C _120,QA
TestKings.C2150-575_120,QA Number: C2150-575 Passing Score: 800 Time Limit: 120 min File Version: 23.05 http://www.gratisexam.com/ These are the most accurate study questions. Just focus on these and sit
More informationNational Identity Exchange Federation. Terminology Reference. Version 1.0
National Identity Exchange Federation Terminology Reference Version 1.0 August 18, 2014 Table of Contents 1. INTRODUCTION AND PURPOSE... 2 2. REFERENCES... 2 3. BASIC NIEF TERMS AND DEFINITIONS... 5 4.
More informationNovell Access Manager
Setup Guide AUTHORIZED DOCUMENTATION Novell Access Manager 3.1 SP3 February 02, 2011 www.novell.com Novell Access Manager 3.1 SP3 Setup Guide Legal Notices Novell, Inc., makes no representations or warranties
More informationIntegrating YuJa Active Learning into ADFS via SAML
Integrating YuJa Active Learning into ADFS via SAML 1. Overview This document is intended to guide users on how to setup a secure connection between YuJa (the Service Provider, or SP) and ADFS (the Identity
More informationSelfTestEngine.C _135,Q&A
SelfTestEngine.C2150-575_135,Q&A Number: C2150-575 Passing Score: 800 Time Limit: 120 min File Version: 26.12 This VCE has a lot of questions where all answers are up-to-date. The material is well organized
More informationSession 2.1: Federations: Foundation. Scott Koranda Support provided by the National Institute of Allergy and Infectious Diseases
Session 2.1: Federations: Foundation Scott Koranda Support provided by the National Institute of Allergy and Infectious Diseases Scott Koranda's participation has been funded in whole or in part with federal
More informationAdvanced Client Conor P. Cahill Systems Technology Lab Intel Corporation
Advanced Client Conor P. Cahill Systems Technology Lab Intel Corporation Disclaimer This presentation discusses work-in-progress within the Liberty Alliance Technology Expert Group. The end result of the
More informationIntegrating VMware Workspace ONE with Okta. VMware Workspace ONE
Integrating VMware Workspace ONE with Okta VMware Workspace ONE You can find the most up-to-date technical documentation on the VMware website at: https://docs.vmware.com/ If you have comments about this
More informationLiferay Security Features Overview. How Liferay Approaches Security
Liferay Security Features Overview How Liferay Approaches Security Table of Contents Executive Summary.......................................... 1 Transport Security............................................
More informationCanadian Access Federation: Trust Assertion Document (TAD)
Participant Name:_Gale_Cengage Learning Canadian Access Federation: Trust Assertion Document (TAD) 1. Purpose A fundamental requirement of Participants in the Canadian Access Federation is that they assert
More informationAll about SAML End-to-end Tableau and OKTA integration
Welcome # T C 1 8 All about SAML End-to-end Tableau and OKTA integration Abhishek Singh Senior Manager, Regional Delivery Tableau Abhishek Singh Senior Manager Regional Delivery asingh@tableau.com Agenda
More informationConfiguration Guide - Single-Sign On for OneDesk
Configuration Guide - Single-Sign On for OneDesk Introduction Single Sign On (SSO) is a user authentication process that allows a user to access different services and applications across IT systems and
More informationToken-based Payment in Dynamic SAML-based Federations
Token-based Payment in Dynamic SAML-based Federations David J. Lutz 1 and Burkhard Stiller 2 1 Rechenzentrum Universitaet Stuttgart Allmandring 30; 70550 Stuttgart; Germany David.Lutz@rus.uni-stuttgart.de
More informationTrust Services for Electronic Transactions
Trust Services for Electronic Transactions ROUMEN TRIFONOV Faculty of Computer Systems and Control Technical University of Sofia 8 st. Kliment Ohridski bul., 1000 Sofia BULGARIA r_trifonov@tu-sofia.bg
More information