The Fedlet: Real World Examples

Transcription

1 The Fedlet: Real World Examples Sun Iden(ty Management User Group 12 March 2009

2 Agenda BIT Systems Overview Federal Agency Architecture Iden>ty Federa>on Fedlet Introduc>on Enhancing Fedlet Capabili>es Real World Fedlet Applica>ons Fedlet Benefits and Tradeoffs Conclusion and Open Discussion

3 Company Overview BIT Systems, Inc. Founded in 1999 Beginning to end SIGINT Company 290+ TS/SCI cleared employees Loca>ons in Dulles, Denver, Sarasota, and Santa Clara Since 2005, BITS has delivered over 50 fully operagonal systems to 25 sites around the world BITS is the leading provider of SIGINT metadata to IC and DoD consumers, delivering cukng edge web based technologies to solve challenging data access problems Enterprise IT Capabilty Infrastructure Development First to deliver to our customer: Significant web based apps ( 98) Cross site Java apps ( 00) Web service interfaces ( 00) Enterprise database services ( 06) Enterprise Applica>ons SIGINT tasking, mission status, & modeling tools Mission support data warehouse services Common Directory Services So\ware Development Extensive Java, XML, and ESB exper>se Open source, SOA SI JSIS and DCID 6/3 compliant Agile, rapid prototyping

4 Terminology 101 Service Provider (SP) en>ty provider of services, typically web based Iden(ty Provider (IdP) en>ty provider for iden>ty services Circle of Trust (CoT) specifica>on of level of trust between en>ty providers Security Asser(on Markup Language (SAML) XML based standard for exchanging authen>ca>on and authoriza>on data Role/AIribute Based Access Control (RBAC/ABAC) access control methods based on a user s role or abribute value Lightweight Directory Access Protocol (LDAP) protocol for querying and modifying directory services X.509 AIribute Based Sharing Profile (XASP) SAML profile for providing abribute querying for X.509 enabled service providers extensible Access Control Markup Language (XACML) declara>ve access control policy language implemented in XML

5 Federal Agency Architecture The Problem Redundant User Provisioning Agency A No Enterprise Single Sign-on Agency D Federal Community Agency B No Enterprise Federation Standards Agency C Limited Authorization Attributes

6 Federal Agency Architecture The Solution: Identity Federation Limited Provisioning Redundancies Agency A SAML:XASP XACML Agency D Federal Community Agency B Common Authorization Attribute Set Agency C Enterprise Single Sign-on

7 IdenGty FederaGon What is Iden>ty Federa>on? Iden>ty Federa>on can be defined many ways based on the domain and problem with which it is being applied to. In the federal community, there are two primary forms of iden>ty federa>on: Intra Domain Federa>on Iden>ty portability provided by IdP to SPs within domain Common iden>ty assembled from mul>ple data sources in a domain Cross Domain Federa>on iden>ty portability between domains using open standards In the federal community iden>ty federa>on provides the governance and availability of a common iden>ty across the enterprise

8 IdenGty FederaGon Intra-Domain Federation Cross Domain Federation SP SP IdP SP Agency Agency Agency Federal Community

9 Sun Access Management Sun Provides Identity Federation OpenSSO Enterprise OpenSSO Express Federa>on Manager + Access Manager

10 Sun Enterprise SoluGon Agency A Agency B App 1 Abribute Service App A SDK App 2 OpenSSO IdP 2.2 Agent App B 3.0 Agent DSEE LDAP ID WS App 3 Fedlet IDM LDAP App C JNDI

11 IntroducGon to the Fedlet The Fedlet: a lightweight en>ty which enables service providers to quickly federate with an iden>ty provider Introduced in early 2008 in OpenSSO Express builds Commercially introduced with OpenSSO Enterprise in September 2008 Early access.net version of Fedlet available for preview

12 Fedlet Features & Benefits Plug and play federa>on No addi>onal hardware needed for SP. OpenSSO performs all Fedlet configura>on and deployment packaging. SAML v2 enablement Communica>on between IdP and SP uses standards based protocols Developers use Java API to create SAML compliant abribute requests Single Sign on Authen>ca>on tokens with IdP shared by SP Open Source Enables easy extension and maintenance of Fedlet capability Fedlets do not need session management Greatly increases performance and scalability

13 Fedlet Development Fedlet deploys to container as a web archive (WAR) Consists of: Code libraries Java Archive files (JARs) Exposes Java API for communica>on with IdP (OpenSSO) Proper>es and configura>on files Proper>es contain Java Server Pages (JSPs) Web pages which contain sample code to perform federa>on opera>ons (SSO, SAML, Abribute Queries) Fedlet services are easy to access and extend: Map map = SPACSU>ls.processResponseForFedlet(request, response); Response samlresp = (Response) map.get(saml2constants.response); Asser>on asser>on = (Asser>on) map.get(saml2constants.assertion); Subject subject = (Subject) map.get(saml2constants.subject); Map abrs = (Map) map.get(saml2constants.attribute_map);

14 CreaGng a Fedlet Fedlets can be created in OpenSSO console in 2 minutes! Define SP Add SP to CoT Create Fedlet Deploy fedlet.war to SP

15 OASIS SAML v2 Compliant SAML v2 tags <samlp:response xmlns:samlp="urn:oasis:names:tc:saml:2.0:protocol" ID="s2a21adbdb831e263d646018bc45f80fdccda53061 " InResponseTo="s26a5d2b878e962deb84e78b a09fc4c536" Version="2.0" IssueInstant=" T19:31:41Z Destination=" xmlns:saml="urn:oasis:names:tc:saml :2.0:assertion"> xmlns:samlp="urn:oasis:names:tc:saml:2.0:protocol"> <samlp:statuscode xmlns:samlp="urn:oasis:names:tc:saml:2.0:protocol"value="urn:oasis:names:tc:saml:2.0:status:success"> </samlp:statuscode> <saml:attributestatement><saml:attribute Name=" Address"><saml:AttributeValue xmlns:xs=" " xmlns:xsi=" <saml:attribute Name="address"><saml:AttributeValue xmlns:xs= xmlns:xsi=" xsi:type="xs:string">herndon</saml:attributevalue></saml:attribute> </saml:attributestatement> Schema Compliant Attribute Value Burden of creating SAML compliant messages is lifted from the SP developer

16 Extending the Fedlet Fedlets provide federa>on and single sign on using SAML 2.0 between an IdP and SP Fedlets can be extended to support specific business cases XASP: in a PKI enabled environment where authen>ca>on is X.509 cer>ficate based SAML queries can be configured to use X.509 dis>nguished name XACML: when policy decisions need to be extended beyond basic SAML authoriza>on decision statement

17 Extending the Fedlet: XASP XASP is suited for deployments where: service providers perform cer>ficate based authen>ca>on IdP can resolve queries using dis>nguished name from X.509 cer>ficate Cross domain iden>ty federa>on using dis>nguished names Fedlet Java code uses dis>nguished name from presented X.509 cer>ficate: SAML2Constants.X509_SUBJECT_ATTR_QUERY_PROFILE X509Cer>ficate[] allcerts = (X509Cer>ficate[]) request.getabribute("javax.servlet.request.x509cer>ficate"); String userid = allcerts[0].getsubjectdn().tostring(); Response samlresp = AbributeQueryU>l.sendAbributeQuery(abrQuery, abrauthorityen>tyid, realm, abrqueryprofile, abributeprofile, SAML2Constants.SOAP);

18 XASP SpecificaGon Intra-Domain Federation Principal Service Provider Iden>ty Provider Service Request X.509 Authentication Attribute Request Ac>ons governed by OASIS XASP Specifica>on {XASP enabled Fedlet capabili>es} Attribute Response Service Response

19 XASP: Enterprise FederaGon Cross Domain Federation Agency A Sun OpenSSO RSA FIM PingFederate Agency C XASP Agency B

20 Extending the Fedlet: XACML XACML Used to query policies defined in OpenSSO SAML v2 schema can be extended to support XACML request/response Embedded in xacml context schema within SAML payload Can be used by Fedlet or SDK to support authoriza>on requests XACML policy queries built using Java API in Fedlet JSP Attribute attribute = ContextFactory.getInstance().createAttribute(); attribute.setattributeid(new URI(XACMLConstants.SUBJECT_ID)); attribute.setattributeid(new URI(XACMLConstants.RESOURCE_ID)); attribute.setattributeid(new URI(XACMLConstants.TARGET_SERVICE)); Response xacmlresponse = XACMLRequestProcessor.getInstance().processRequest(Xrequest, pdpentityid, pepentityid);

21 BITS Web ApplicaGon Service Provider BITS_APP1 User Browser X.509 Tomcat Fedlet Identity Provider OpenSSO 1. User establishes TLS/SSL connec>on with BITS_APP1 a. User s X.509 cer>ficate presented to container (Tomcat) hos>ng BITS_APP1 Directory Server

22 BITS Web ApplicaGon Service Provider BITS_APP1 User Browser X.509 Tomcat Fedlet Identity Provider OpenSSO 2. BITS_APP1 container authen>cates user a. Cer>ficate validity dates confirmed b. Signing Authority validated c. Cer>ficate revoca>on data checked Directory Server

23 BITS Web ApplicaGon Service Provider BITS_APP1 User Browser X.509 Tomcat Fedlet Identity Provider OpenSSO 3. BITS_APP1 fedlet performs SAML/XACML query using dis>nguished name (DN) value from user cer>ficate Directory Server

24 BITS Web ApplicaGon Service Provider BITS_APP1 User Browser X.509 Tomcat Fedlet Identity Provider OpenSSO 4. OpenSSO confirms whether user is authorized to access BITS_APP1 a. Access to BITS_APP1 is governed via OpenSSO policy b. BITS_APP1 policy uses filtered role (ABAC) to check user s clearancelevel, na>onality_extended, and siteloca>on abribute values Directory Server

25 BITS Web ApplicaGon Service Provider BITS_APP1 User Browser X.509 Tomcat Fedlet Identity Provider OpenSSO 5. BITS_APP1 receives XACML decision and either permits or denies user access to applica>on Directory Server

26 BITS Web ApplicaGon Service Provider BITS_APP1 User Browser X.509 Tomcat Fedlet Identity Provider OpenSSO Create Fedlet: 2 min Create Policy: 2 min Deploy Fedlet in SP: 5 min Modify SP to use Fedlet: 2 hrs Total Time to enable SP for SAML:XASP w/xacml : ~2 hrs Directory Server

27 Conclusion The Fedlet is an exci>ng new tool in the Sun Access Management offerings The Fedlet offers a low cost solu>on to iden>ty federa>on enablement Adheres to open standards (SAML, XACML) Ideal candidate for access management in a PKI enabled enterprise Perfect agencies in the federal government BIT Systems has many deployment varia>ons of the Fedlet on classified and unclassified networks Please contact BIT Systems to discuss enablement of Iden>ty and Access in your enterprise

28 Questions?

29 Contact InformaGon Dan Rolph Iden1ty & Security Services Lead Business Court Dulles, VA sys.com Phone: x154 Robin Heyner Business Development Business Court Dulles, VA sys.com Phone: x163 Ryan Fairchild Business Development Business Court Dulles, VA sys.com Phone: x264 Brad Worsham CTO, Business Development Business Court Dulles, VA sys.com Phone: x248

30

31 Fedlet References Fedlet GnR video hbps://slx.sun.com/download/ /prod_ mp4 Sun OpenSSO Enterprise 8.0 Deployment Planning Guide hbp://dlc.sun.com/pdf/ / pdf Sun OpenSSO Java API hbp://docs.sun.com/source/ / Steven Jarosz Wiki hbp://wikis.sun.com/display/mylabnotes/steven+jarosz Sun OpenSSO Enterprise 8.0 Technical Overview hbp://dlc.sun.com/pdf/ / pdf OpenSSO Fedlet Demo (deployed in Jboss) hbp://tech.gpuri.com/wp content/uploads/2009/01/fedlets demo.doc OpenSSO Open Source Project (OpenSSO Express) hbps://opensso.dev.java.net/ Sun OpenSSO Enterprise product page hbp://