We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byJacey Nie
Modified over 2 years ago
1© Nokia Siemens Networks SAML Name Identifier Request-Response Protocol Contribution to OASIS Security Services TC Christian Günther, Thinh Nguyenphu Nokia Siemens Networks
2 © Nokia Siemens Networks SAML Name Identifier Request – Response Protocol What is being proposed? New SAML request-response protocol by means of which – an IdP can request an identifier for a user from a SP, in case the IdP has no unique identifier of this user of the SP, and, – after User validation, the SP sends a response back to the IdP that includes a unique identifier for the User. The IdP may use this identifier in the future to authenticate the User. The proposed SAML Name Identifier request-response protocol – frees the SP from the need to import all of their Users into IdP databases as soon as they have become part of an IdP's circle of trust, – instead, the SP registers its Users with the IdP "on-the-fly" as the need arises.
3 © Nokia Siemens Networks SAML Name Identifier Request – Response Protocol Why this proposal? Impact on existing SAML specifications? Reason for this contribution – SAML supports SPs to get attributes about users from an IdP, e.g., regarding name identifiers, the SP usually sends an AuthnRequest to the IdP who sends an AuthnResponse containing a NameIdentifier ("Subject"). – However, if a SP is newly added to the circle of trust of an IdP, the IdP will not know of the identifiers for Users of the SP, which is required in order for the IdP to authenticate the Users of a SP. Impact on existing SAML specifications – The proposed Name Identifier request-response protocol would lead to an extension of: protocol schema and saml-core-2.0-os saml-profile-2.0 Name Identifier Request-Response profile saml-conformance-2.0-os possible implementations, feature matrix – No modification of assertion schema required
4 © Nokia Siemens Networks SAML Name Identifier Request – Response Protocol Why an extension to SAML is required According to the existing SAML specifications, – if the IdP does not know of an identifier of the user for the given SP, the IdP would either send an error message or a random but unique identifier to the SP. This means, the IdP can react in a deficient way only, without being able to solve the problem where it occurs (namely, at the IdP). According to the proposed Name Identifier Request-Response protocol, – the IdP would not send an error message or a random identifier but send a NameIdentifierRequest to the SP, who sends the requested identifier back to the IdP. – These NameIdentifierRequest/Respose messages are interlaced into the AuthenticationRequest/Response message exchange. – Hence, SP and IdP agree upon unique identifiers "on-the-fly", thereby synchronizing their databases as the need arises.
5 © Nokia Siemens Networks SAML Name Identifier Request – Response Protocol How? High level message flow black = standard SAML 2.0red = new messages
6 © Nokia Siemens Networks SAML Name Identifier Request – Response Protocol Example Instance of Name Identifier Request http://idm.nsn.com
7 © Nokia Siemens Networks SAML Name Identifier Request – Response Protocol Example Instance of Name Identifier Response C=US, O=NCSA-TEST, OU=User, CNfirstname.lastname@example.org tom.smith
8 © Nokia Siemens Networks SAML Name Identifier Request – Response Protocol Example Instance of Name Identifier Response (cont'd) Tom email@example.com
9 © Nokia Siemens Networks SAML Name Identifier Request – Response Protocol Conclusion NSN asks the SS TC for – working on the specification of a SAML Name Identifier request-request protocol as outlined in this contribution, – since this protocol enables IdPs and SPs to solve a deficiency of the existing SAML specifications in an appropriate way directly at the places where the deficiency occurs. Impact on existing SAML specifications – The Name Identifier request-response protocol would lead to an extension of: protocol schema and saml-core-2.0-os saml-profile-2.0 Name Identifier Request-Response profile saml-conformance-2.0-os possible implementations, feature matrix – No modification of assertion schema required
1© Nokia Siemens Networks SAML Attribute Management Request-Response Protocol Contribution to OASIS Security Services TC Thinh Nguyenphu, Christian Günther.
Saml-v1_x-tech-overview-dec051 Security Assertion Markup Language SAML 1.x Technical Overview Tom Scavo NCSA.
X509-bindings-profiles-sep061 Bindings and Profiles for Attribute-based Authz in the Grid Tom Scavo NCSA.
Shibboleth-intro-dec051 Shibboleth A Technical Overview Tom Scavo NCSA.
Saml-intro-dec051 Security Assertion Markup Language A Brief Introduction to SAML Tom Scavo NCSA.
SAML 2.1 Building on Success. Outline n Summary of SAML 2.0 n Work done since 2.0 n Objectives of SAML 2.1 n Proposed Task List n Undecided Issues n Invitation.
SAML Right Here, Right Now Hal Lockhart September 25, 2012.
Federated Identity for Grid Architects Tom Scavo NCSA
A Use Case for SAML Extensibility Ashish Patel, France Telecom Paul Madsen, NTT.
Workshop on Security for Web Services. Amsterdam, April 2010 Applying SAML to Identity Data Exchange.
Dorian Grid Identity Management and Federation Dialogue Workshop II Edinburgh, Scotland February 9-10, 2006 Stephen Langella Department.
SSO Best Practices Suchin Rengan Principal Technical Architect Salesforce.com.
Saml-v2_0-intro-dec051 Security Assertion Markup Language An Introduction to SAML 2.0 Tom Scavo NCSA.
WS-Trust “From each,according to his ability;to each, according to his need. “ Karl marx Ahmet Emre Naza Selçuk Durna
Shib-Grid Integrated Authorization (Shintau) George Inman (University of Kent) TF-EMC2 Meeting Prague, 5 th September 2007.
SAML & OAuth V2 Nov 19/09. Goals Explore (useful) combinations of SAML & Oauth Builds on 2008 proposal from Ping ID for combining SAML SSO & Oauth authz.
Comments on SAML Attribute Mgmt Protocol Contribution to OASIS Security Services TC Phil Hunt & Prateek Mishra
1 SAML 2.0: Federation Models, Use-Cases and Standards Roadmap Prateek Mishra Principal identity Co-Chair, OASIS SSTC (SAML Committee)
Gridshib-intro-dec051 GridShib An Introduction Tom Scavo NCSA.
SAML CCOW Work Item HL7 Working Group Meeting San Antonio - January 2008 Presented by: David Staggs, JD CISSP VHA Office of Information Standards.
Step Up Authentication in SAML (and XACML) Hal Lockhart February 6, 2014.
SAML in Authorization Policies draft-guenther-geopriv-saml-policy-00.
Grid Authorization Landscape and Futures Von Welch NCSA
JRA1.4 Models for implementing Attribute Providers and Token Translation Services Andrea Biancini.
For internal use only 1© Nokia Siemens Networks R 255 G 211 B 8 R 255 G 175 B 0 R 127 G 16 B 162 R 163 G 166 B 173 R 137 G 146 B 155 R 175 G 0 B 51 R 52.
University of Murcia Gabriel López. Network authentication in eduroam and SSO token distribution ◦ RADIUS hierarchy ◦ Token based on SAML Network.
Review of Liberty Alliance 1.1 Web Browser Profiles Prateek Mishra Netegrity.
Https://aarc-project.eu Authentication and Authorisation for Research and Collaboration Taipei - Taiwan Mechanisms of Interfederation 13th March 2016 Alessandra.
Payment in Identity Federations David J. Lutz Universitaet Stuttgart.
Federation management A mess? Nordunet Conference Mikael Linden CSC, the Finnish IT Center for Science.
Identity Management Report By Jean Carreon and Marlon Gonzales.
1 Addressing security challenges on a global scaleGeneva, 6-7 December 2010.
SIMDAT Authentification and Autorisation Matteo Dell’Acqua ET-CTS meeting, Toulouse, May 2008.
SAML CCOW Work Item: Task 2 HL7 Working Group Meeting Phoenix – May Presented by: David Staggs, JD CISSP VHA Office of Information Standards.
Authentication protocol providing user anonymity and untraceability in wireless mobile communication systems Computer Networks Volume: 44, Issue: 2, February.
E-Authentication October Objectives Provide a flexible, easy to implement authentication system that meets the needs of AES and its clients. Ensure.
Status Update on Other GFIPM Activity Threads GFIPM Delivery Team Meeting November 2011.
NRL Security Architecture: A Web Services-Based Solution Anya Kim Naval Research Lab Washington D.C.
5th TF-EMC2 Meeeting. Zagreb How AA-RR Says “Hello, SAML” José Manuel Macías Diego R. Lopez.
© 2010, University of KentPrimeLife Vienna, 10 Sept CardSpace in the Cloud David Chadwick, George Inman University of Kent.
Shibboleth at the U of M Christopher A. Bongaarts code-people June 2, 2011.
SAML: An XML Framework for Exchanging Authentication and Authorization Information + SPML, XCBF Prateek Mishra August 2002.
1 Multi Cloud Navid Pustchi April 25, 2014 World-Leading Research with Real-World Impact!
Distributed Authentication in Wireless Mesh Networks Through Kerberos Tickets draft-moustafa-krb-wg-mesh-nw-00.txt Hassnaa Moustafa
General Overview of Various SSO Systems: Active Directory, Google & Facebook Antti Pyykkö Mikko Malinen Oskari Miettinen.
SWITCHaai Team Introduction to Shibboleth.
EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks OpenSAML extension library and API to support.
Eunice Mondésir Pierre Weill-Tessier 1 Federated Identity with Ping Federate Project Supervisor: M. Maknavicius-Laurent ASR Coordinator: G. Bernard ASR.
Shibboleth access management: a replacement for Athens and more? Mark Norman and Christian Fernau OUCS 21 June 2007.
Connect. Communicate. Collaborate eduGAIN in Real Life! Ajay Daryanani, RedIRIS TERENA Networking Conference Brugge, 20th May 2008.
© 2017 SlidePlayer.com Inc. All rights reserved.