1. Keeping access control while moving to the cloud
Password Reuse webcomic:
Required reading
Keeping access control while moving to the cloud
Presented by Zdenek Nejedly
Computing & Communications Services
University of Guelph

2. Keeping access control while moving to the cloud
Presented by Zdenek Nejedly
Computing & Communications Services
University of Guelph

3. Objectives Intro: University of Guelph mail migration
Review: Access Management in the Cloud
Conclusion: Solutions and Lessons Learned
Computing & Communications Services

4. University of Guelph mail migration
Can Access management help ?
Computing & Communications Services

5. Migration project highlights
Migrating 36k undergraduate students
Production Sep 1, 2014
Expanding from one to two mail systems
Google Apps
for Education
Zimbra Collaboration Suite
University of Guelph - Computing & Communications Services -

6. Migration project challenges
User: two mail systems - am I on Google or Zimbra? Or both?
University: policy confirmation before authorizing access to the service - how can we serve it to the users?
Can we have a Single access point?
Can we customize the authN flow?
University of Guelph - Computing & Communications Services -

7. Access Management technologies
for the cloud services
Computing & Communications Services

8. Do you provide Web Access Management on your campus?
Do you provide authentication for cloud services? How?
Shibboleth? CAS? ADFS?
Other SAML 2 or non-SAML?
Custom SSO?

9. Why Web Access Management?
Functions:
authN, authZ, SSO, attrs, audit
Benefits:
Security: secured credentials
Password Reuse xkcd.com/792
User experience: single identity, SSO
Service Providers:  friction -  retention
Identity providers: lower management cost
University of Guelph - Computing & Communications Services -

10. Cloud authentication: the early years
SSO mostly as a custom solution
Secret token exchanged between the parties
Individual solutions
 high cost
University of Guelph - Computing & Communications Services -

11. Cloud authentication: the protocols
Gartner (2013) “…Gartner estimates a penetration well over 50% worldwide for SAML-based federations..”
University of Guelph - Computing & Communications Services -

12. SOAP What do I need to know? Role Based Access Control (RBAC)
Claims Consumer (CC)
Attribute Based Access Control (ABAC)
Security Assertion Markup Language (SAML)
What do I need to know?
One Time Password (OTP)
Identity Provider (IdP)
SOAP
Relying Party (RP)
JSON Web Token (JWT)
Claims Provider (CP)
Asserting Party (AP)
University of Guelph - Computing & Communications Services -

13. HTTP & HTTPS GET & POST HTTP - application protocol (RFC 2616)
Tech Primer
SAML & OAuth
SOAP & REST
XML & JSON
GET & POST
HTTP & HTTPS
HTTP & HTTPS
HTTP - application protocol (RFC 2616)
Stateless
GET & POST
methods in HTTP
GET: resource retrieval, preserved in redirects
POST: sends data to the server in the body, may be lost in redirects
GET HTTP/1.1
POST HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 31
username=jane&password=w0rld2u
HTTP/ Found
Location:
Sample response
University of Guelph - Computing & Communications Services -

14. XML & JSON free open standards eXtensible Markup Language
Tech Primer
SAML & OAuth
SOAP & REST
XML & JSON
GET & POST
HTTP & HTTPS
eXtensible Markup Language
XML & JSON
free open standards
JavaScript Object Notation
<person>
<firstName>John</firstName>
<lastName>Smith</lastName>
<isAnalyst>true</isAnalyst>
<phoneNumbers>
<phone type="home"> </phone>
<phone type=“cell"> </phone>
</phoneNumbers>
</person> {
"firstName": "John",
"lastName": "Smith",
"isAnalyst": true,
"phone": [
{ "type": "home", "number": " " },
{ "type": "fax", "number": " " } ] }
University of Guelph - Computing & Communications Services -

15. SOAP & REST Communication protocol Architectural design style
Tech Primer
SAML & OAuth
SOAP & REST
XML & JSON
GET & POST
HTTP & HTTPS
Communication protocol
SOAP & REST
Architectural design style
University of Guelph - Computing & Communications Services -

16. Tech Primer SAML & OAuth SOAP & REST XML & JSON GET & POST
HTTP & HTTPS
Example of a SOAP fault message (
<env:Envelope xmlns:env="
xmlns:m="
xmlns:xml="
<env:Body>
<env:Fault>
<env:Code>
<env:Value>env:Sender</env:Value>
<env:Subcode>
<env:Value>m:MessageTimeout</env:Value>
</env:Subcode>
</env:Code>
<env:Reason>
<env:Text xml:lang="en">Sender Timeout</env:Text>
</env:Reason>
<env:Detail>
<m:MaxTime>P5M</m:MaxTime>
</env:Detail>
</env:Fault>
</env:Body>
</env:Envelope>
University of Guelph - Computing & Communications Services -

17. REST (Roy Fielding 2000) Tech Primer SAML & OAuth SOAP & REST
XML & JSON
GET & POST
HTTP & HTTPS
REST (Roy Fielding 2000)
University of Guelph - Computing & Communications Services -

18. SAML 2.0 & OAuth 2.0 AuthN, authZ, attrs Intended for Authorization
Tech Primer
SAML & OAuth
SOAP & REST
XML & JSON
GET & POST
HTTP & HTTPS
AuthN, authZ, attrs
Intended for
Authorization
SAML 2.0 & OAuth 2.0
Server-side Web App
Web Browser SSO Profile
University of Guelph - Computing & Communications Services -

19. SAML Authentication Flow for Google Apps (Web Browser SSO Profile)
Service Provider (Google)
Tech Primer
SAML & OAuth
SOAP & REST
XML & JSON
GET & POST
HTTP & HTTPS
GET 1 5
User’s Gmail content returned 2
POST 4
GET
Identity Provider 3 3
SAML Authentication Flow for Google Apps (Web Browser SSO Profile)
Browser requests Gmail content
Browser redirected to IdP with AuthnRequest
IdP identifies the user
Browser posts Response to Google with NameID
Google returns Gmail content
University of Guelph - Computing & Communications Services -

20.     Tech Primer SAML & OAuth Client/ Claims Consumer (web app)
SOAP & REST
XML & JSON
GET & POST
HTTP & HTTPS
Accessing app content   1
API calls  6  5 7 2 4
Request authZ code
Authorization Server (API Provider) 3
OAuth 2 Authorization flow (Server Side Web App profile)
Browser accesses Claim Consumer (CC)
Browser redirected to the Authorization Server (AS)
User authenticates, AS issues Authorization Code 
Browser redirected to CC with 
CC posts  to AS
CC receives JSON response with Access Token 
CC makes an API call to the API Provider with Access Token 
University of Guelph - Computing & Communications Services -

21. More on OAuth 2.0 and OpenID Connect
Talk by Ryan Boyd
Getting started with OAuth 2.0
O’Reilly (2012)
University of Guelph - Computing & Communications Services -

22. Solutions, lessons learned
and the next steps
Computing & Communications Services

23. Challenge: where is my mail?
Zimbra
Staff, faculty, grads
Multiple roles?
Transient entitlements?
Undergrads
Gmail
University of Guelph - Computing & Communications Services -

24. Solution: Single access point
Zimbra
Mail SSO Middleware determines the correct
mail system and routes the user accordingly
Gmail
University of Guelph - Computing & Communications Services -

25. Challenge: can we add a business process into the authN flow?
Default Google Apps
SAML2 AuthN Flow
Service Provider (Google) 1 5
User’s Gmail content returned 2 4
UofG Identity Provider 3 3
University of Guelph - Computing & Communications Services -

26. Solution: insert middleware
User confirms the Policies served by
the Mail SSO Middleware (2a-2c)
Service Provider (Google) 1 5
User’s Gmail content returned 2a 4 2b 2c
Mail
SSO Middleware
with the Policy engine
UofG Identity Provider 3 3
University of Guelph - Computing & Communications Services -

27. University of Guelph - Computing & Communications Services - www
University of Guelph - Computing & Communications Services -

28. Availability expectations for WAM?
Clustering?
Standby infrastructure?

29. Next steps - opportunities
Weak points?
Efficiency?
Re-used for multifactor authN
Build the policy module into the
Access Manager authentication
University of Guelph - Computing & Communications Services -

30. And remember - don’t reuse your password
Takeaway points
With Access Management we can:
create a single access point for both systems
build a policy confirmation even into proprietary services
With increasing dependencies comes increasing requirement on high availability.
Re-used for multifactor authN
And remember - don’t reuse your password
University of Guelph - Computing & Communications Services -

31. Acknowledgements
Universities already on Google Apps - Thank you for sharing your experience with us.
University of Guelph Gryph Mail SSO team:
Fazil, Hugh, Jill, Leo, Matt, Paul, Rob, Saveena, and Zdenek
Computing & Communications Services

32. External identities
Predicts 2014: Identity and Access Management (Gartner): “..by % identities interacting with the enterprise will come from external IdPs (up from 10% today)…”
Are you using (or plan to) social identities on your campus?