Design and Implementation of unified Identity Authentication System Based on LDAP in Digital Campus

Transcription

1 Advanced Materials Research Online: ISSN: , Vols , pp doi: / Trans Tech Publications, Switzerland Design and Implementation of unified Identity Authentication System Based on LDAP in Digital Campus Zhiyuan Wu 1, a, Weiping Huang 1,b and Lei Yu 1,c 1 Information Network Center, China University of Geosciences, Beijing, , China a zywu@cugb.edu.cn, b huangwp@cugb.edu.cn, c yul@cugb.edu.cn Keywords: LDAP; digital campus; CAS; directory service Abstract. With the development of digital campus in university, more and more application systems have been used. In these systems, authentication function has been repeatedly design, which can be easy to cause multiple accounts and passwords, and brought inconvenience to users and administrators. Unified identity authentication system based on LDAP is a good solution to this problem. In this paper, based on the analysis of LDAP protocol and CAS, the unified identity authentication system built for digital campus is designed and implemented, and LDAP management system is also developed to achieve unified management of directory information in the university. Introduction Digital campus which is based on digital information and network can provide unified planning, unified information standard, unified data management, unified application platform. It standardizes business processes, eliminates information island on campus, and is to constructs virtual university environment which aggregates a set of teaching, scientific research, management and service. With the widely sharing of resources of teaching, research, administration and service, teachers and students improve the ability to obtain information, analyze information, process information and keep up with modern society. The ultimate goal of digital campus is to achieve comprehensive information, improve the competitiveness of the university. The identity authentication mode of the original application systems which were independent each other was difficult to accommodate the application environment of digital campus. An independent, safe, efficient and reliable identity authentication system is required. Unified identity authentication system is the system that provides unified authentication for all application systems. With the system, users access resources of all application systems of digital campus with the appropriate permissions simply logging in once. LDAP Overview LDAP (Lightweight Directory Access Protocol) which is based on x. 500 standard is a kind of Directory Access Protocol. It simplifies the implementation of so called Lightweight Directory service. Compared with the relational database usually used for authentication, LDAP based directory service tends to contain descriptive, attribute based information, and supports for complex filter operations. The data organization of LDAP is tree structure, which is called directory Information tree (DIT) in directory service. The basic unit of DIT is called entry which contains multiple attributes and can be extended. The LDAP protocol specifies the DN naming method, access control method, search format, copy method, etc, and provides service for access to the information. Because of the tree structure of data organization, directory lookup can be done in any branch of DIT. This feature makes that the speed of data processing of directory service is several orders of magnitude faster than relational database. Distributed directory service which distributes data of DIT to multiple physical servers can be realized through the function of partition and replication. In consideration of information storage and management in applications and services, a scalable architecture is provided supporting a wide range of application programming language, such as C, Java, PHP, Perl, etc. All All rights reserved. No part of contents of this paper may be reproduced or transmitted in any form or by any means without the written permission of Trans Tech Publications, (ID: , Pennsylvania State University, University Park, USA-05/03/16,22:38:10)

2 1214 Frontiers of Advanced Materials and Engineering Technology II of the languages have their own LDAP API. Users can easily choose the programming language to which they prefer in application development. At present, LDAP has become the cross-platform and standard protocol which is widely used in unified identity authentication. It is easy to integrate different application systems, and has become one of the important infrastructure technology for network systems. In short, LDAP is a prior scheme to unified identity authentication. Design of the unified identity authentication system Design of LDAP directory for digital campus Based on the above introduction and analysis, our unified identity authentication system will use LDAP directory database as the user information database rather than relational database for digital campus. The directory database stores all basic information for students, teachers and others. For example, the account, name, password, department, , phone number, etc. In LDAP, there are four basic models - the information model which describes how to represent the LDAP information; naming model which describes how to organize the LDAP data; function model which describes how to of access and operate LDAP data; security model which describes the security mechanism. Information model and naming model are all associated with the LDAP data structure. The following will focus on the two models in directory design. 1. Information model The information model of LDAP is similar to the concept of object-oriented. Each entry must belong to one or more object class, and each Object Class is made up of multiple attribute. Each attribute has the corresponding grammar and matching rules. The definition of object classes and attributes contains the concept of inheritance. The object class one entry belongs to must be defined before the entry is created. Values of the required attributes in the object class must also be provided. Multiple values can be corresponding to one attribute. In LDAP, object classes, attributes, grammatical and matching rules are collectively referred to as schema. There are many system object classes, attributes, grammatical and matching rules, which called system schema are defined in LDAP specification. Different application area of LDAP has its own schema. Users can define their customized schema when needed. RFC2758 defines a LDAP object class named inetorgperson and a set of available attributes used in the object class. Inetorgperson are commonly used in directory service, but the information it could represent can t describe the user identity information in the university. So new object class must be defined. Given that the system object class named person includes the basic attributes required in authentication and hasn t other redundant attributes, new object object class can be extended from person. There are several steps in customizing a new schema in LDAP. First, create a new schema. Second, define the attributes which are required by user identity information. Then, extend the system object class person and define the customized object class cugbuser, and import the defined attributes to cugbuser. Finally, import the new schema into LDAP. 2. Naming model LDAP naming model represents the locate mode of the LDAP entries and describes how the LDAP data is organized. In order to store and search for objects in DIT more efficiently, all entries in directory are arranged hierarchically according to the hierarchical model. Every entry has its own DN and RDN. DN is the unique identification of entry in entire tree, and RDN is the unique identification of entry within the parent node. Similar to the file system, DN is the file name with path, and RDN is the file name. According to the naming model, basic information of students, teachers and others can be hierarchical division when categorized by their identity type. With the result of hierarchical division, design of DIT is easy. Organized from top to bottom, the DIT (shown in Fig. 1) of China University of Geosciences (cugb) can be built.

3 Advanced Materials Research Vols Fig. 1 Directory Information tree of cugb Architecture design of the system In the application environment of digital campus, unified authentication system should achieve unified management of user authentication information and single sign-on for all application systems. Fig. 3 shows the structure of unified identity authentication framework. Fig. 2 The structure of unified identity authentication framework As can be seen from Fig. 2, LDAP directory service is the basis of unified identity authentication for digital campus. LDAP management system manages the LDAP directory service by the manner of web browser. LDAP directory service extracts user information from the public database; converts it into LDAP entry affiliated to the object class named cugbuser defined early, and imports it into the LDAP directory database. So LDAP database can be initialized. Liferay Portal and other application systems login through the single sign-on system CAS. CAS accesses LDAP directory service in order to authenticate the user identity. In liferay portal, user information and group information are

4 1216 Frontiers of Advanced Materials and Engineering Technology II required and this can be provided by LDAP. So liferay portal connects to LDAP directory service, synchronizes the user and group information from LDAP directory database. The core of the unified identity authentication system mainly includes two parts. One is LDAP directory service; the other is the single sign-on system. Product selection and design of these two parts are crucial to the implementation, running and maintenance of the system. ApacheDS is an extensible and embeddable directory server entirely written in Java, which has been certified LDAPv3 compatible by the Open Group. Apache Directory Studio particularly designed for ApacheDS is a complete directory tooling platform intends to be used with any LDAP server. Considered by the features such as lightweight, cross platform, easy development and management, ApacheDS is chosen as the directory server for digital campus. As the single sign-on system chosen by unified identity authentication system, CAS is an enterprise SSO solution built on open protocols. It is open source, security, light weight, strong extensibility, and easy to deploy. CAS includes CAS server and CAS client. Fig. 3 shows the main process of CAS authentication. Fig. 3 Process of CAS authentication Implementation of the system Unified identity authentication platform building Based on above analysis and design, to build a unified identity authentication platform for digital campus, the main steps are as follows: 1. Install ApacheDS; use Apache Directory Studio to connect to ApacheDS; create the partition named "dc=cugb, dc=edu, dc=cn"; set up the corresponding OU in the partition according the DIT of cugb, and import the customized schema defined early into ApacheDS. 2. Deploy the CAS single sign-on system, and customize CAS. Integrate LDAP with CAS through configuration of data source in CAS. Design and develop the portal login page for digital campus. Replace the default login page of CAS with the designed portal login page. Modify the CAS source code and ensure that CAS is in the normal operation. Implementation of the directory management system Spring LDAP is based on spring's JdbcTemplate model. It can help developers simplify the operation of LDAP using java. The LDAP management System is developed using Struts 2 + Spring + Spring LDAP framework. Similar to the development process using the popular Struts2 + Spring + Hibernate (SSH2) framework, three-tier structure (Action layer, Service layer, Dao layer) is also applied. But the Dao layer is different from SSH2. In the development, spring LDAP API is used to operate the LDAP database and the operations of LDAP are packages into Dao layer, while SSH2 uses hibernate to operate relational database in Dao layer.

5 Advanced Materials Research Vols Main functions of the system are as follows: 1. Data import and synchronization Synchronize user information from the public database into LDAP, including automatic and manual synchronization. 2. Basic LDAP operations Implement the basic operations of LDAP, such as browse, add, delete, modify, search, lookup, etc. 3. Account operations Locking and unlocking user accounts, timing lock, timing unlock, passwords reset and other operations related to account. For example, timing lock of the account according to the students' graduation time. If locked, the account can t pass identity authentication in unified identity authentication system. 4. User group operations Creation and deletion of LDAP user group. Users can be added and deleted within the group. Group information is needed by Liferay Portal. Summary Through above implementation, unified identity authentication system of digital campus has been realized. Users only need to maintain a set of user name and password. Having logged in the unified portal login page once, all application systems no longer need authentication respectively in digital campus. Thus "a sign, more roaming" is realized. The directory management system greatly facilitate the administrator s daily maintenance to a large amount of LDAP directory information. The unified identity authentication system has been put into use in the digital campus of China University of Geosciences (Beijing), and problem from authentication has been solved. Acknowledgement It is a project supported by the National Infrastructure for Science and Technology - National Infrastructure of Mineral, Rock and Fossil Specimen Resources, and the Data Resources Integration and Standardized Reorganization for National Special Program on Geological field Basic Science and Technology Research of China (2013FY ). References [1] WANG Si-yi: Coal Technology. Vol. 31 (2012) No.04, p.212. [2] CHANG Pan, SHEN Fuke: Computer Engineering. Vol. 33 (2007) No.05, p.281. [3] Zhang Bei, Li Xiaonan: Computer Engineering. Vol. 26 (2000) Supplementary Issue, p.291. [4] ZHANG Yong-qiang, CHEN Wei: Software. Vol. 32 (2011) No.02, p.14. [5] Ming, Jing Wei, in: Advanced Materials Research, v , p , 2013, Information Technology Applications in Industry, Computer Engineering and Materials Science. [6] Huang, Weili, in: Journal of Information and Computational Science, v 5, n 3, p , May [7] Lin, Jian,Yan, Hua, Wu, Bing, in: Communications in Computer and Information Science, v 238 CCIS, p , [8] Information on [9] Information on

6 Frontiers of Advanced Materials and Engineering Technology II / Design and Implementation of Unified Identity Authentication System Based on LDAP in Digital Campus / DOI References [6] Huang, Weili, in: Journal of Information and Computational Science, v 5, n 3, pp , May (2008) /