1. Identity Management Basics Part 1 of Identity Management with OpenEdge Peter Judge OpenEdge Development pjudge@progress.com

2. © 2012 Progress Software Corporation. All rights reserved. 2 What is Identity Management? It’s about protecting your business data by  Controlling and verifying who accesses your data  Controlling what they can do with your data  Reviewing what they did with your data  Maintaining information about your users You make security decisions on behalf of your customers … understand the maximum loss they might suffer

3. © 2012 Progress Software Corporation. All rights reserved. 3 This is Nothing New Forces aligned against you are more prevalent, and they have more, and more sophisticated weapons And you’ve given people a door and invitation via the internet So now the things you used to do are no longer adequate

4. © 2012 Progress Software Corporation. All rights reserved. 4 It’s about protecting your business data by  Controlling and verifying who accesses your data  Controlling what they can do with your data  Reviewing what they did with your data  Maintaining information about your users What is Identity Management? Authorisation Auditing Administration Authentication

5. © 2012 Progress Software Corporation. All rights reserved. 5 Authentication  Identifies a user, using factors Something the user knows (e.g. password) Something the user has (e.g. security token) Something of the user (e.g. biometric)  Verify that users are who they say they are We need to be able to trust this fact, as do others

6. © 2012 Progress Software Corporation. All rights reserved. 6 Authorisation & Auditing  Authorisation What services can the user access? What data can the user see and/or modify? –Multi-tenancy –Record-level, field-level  Auditing Verifiable trace of a user’s actions

7. © 2012 Progress Software Corporation. All rights reserved. 7 Getting a Passport application forms passport 1 2 3 my permanent record

8. © 2012 Progress Software Corporation. All rights reserved. 8 Using a Passport conferencevisa & entry stamp passport 12 3

9. © 2012 Progress Software Corporation. All rights reserved. 9 my permanent record Application Architecture passport Authentication system Domains Security token User interface application forms Claims / Assertions Security Token Service

10. © 2012 Progress Software Corporation. All rights reserved. 10 What is a Security Token?  A transportable block of data that can be used as proof of user identity by any systems or applications that have a trust relationship with the originator of the security token Exists for same reason passports do: so that a gatekeeper doesn’t have to ask you for everything every time you want to pass  Enables Single Sign On (SSO) Authenticate once and allow access many times across (ABL) processes  Secure, time sensitive and data-integrity protected

11. © 2012 Progress Software Corporation. All rights reserved. 11 The ABL CLIENT-PRINCIPAL  CLIENT-PRINCIPAL = ABL security token  Sets current identity in any connected db or AVM session  AVM creates if not created explicitly  Manage a user’s login session CREATE CLIENT-PRINCIPAL hCP. hCP:INITIALIZE( ) SECURITY-POLICY:SET-CLIENT(hCP). SET-DB-CLIENT(, hCP). SETUSERID(,, ). cmd> $PROEXE –U -P hCP = SECURITY-POLICY:GET- CLIENT(). rCP = hCP:EXPORT-PRINCIPAL. hCP:LOGOUT(). 10.1A+

12. © 2012 Progress Software Corporation. All rights reserved. 12 What Are Domains?  A group of users with a common set of Roles and responsibilities Level of security Data access privileges  Configured in db meta- schema _sec-authentication-domain _Domain-name _Domain-type _Domain-description _Domain-access-code _Domain-runtime-options _Tenant-name _Domain-enabled

13. © 2012 Progress Software Corporation. All rights reserved. 13 Authentication Systems (aka Plug-ins)  Validates requesting entity’s claims Full user login (i.e. user authentication), or Single Sign-On (SSO)  Specifies actual means of performing authentication ABL callbacks available for user- defined systems  Single authentication system can support multiple domains One domain has one authentication system _sec-authentication-system _Domain-type _Domain-type-description _PAM-plug-in _PAM-callback-procedure 11.1+

14. © 2012 Progress Software Corporation. All rights reserved. 14 User Credentials Example Schema ADD TABLE "ApplicationUser" AREA "Data" DESCRIPTION "The application's user table. Contains login names, passwords and mappings to login domains." DUMP-NAME "applicationuser" ADD FIELD "LoginName" AS character /* Domain necessary for re-use */ ADD FIELD "LoginDomain" AS character ADD FIELD "Password" AS character ADD FIELD "LastLoginDate" AS datetime-tz /* Last login IP address / host */ ADD FIELD "LastLoginLocation" AS character ADD INDEX "Login" ON "ApplicationUser" AREA "Indexes" UNIQUE INDEX-FIELD "LoginName" ASCENDING INDEX-FIELD "LoginDomain" ASCENDING

15. © 2012 Progress Software Corporation. All rights reserved. 15 Demo

16. © 2012 Progress Software Corporation. All rights reserved. 16 Demo: Desktop Main Form  Basic screen Want to show a list of customers

17. © 2012 Progress Software Corporation. All rights reserved. 17 Demo: login  Login as user anita_andrews Password is letmein (prepopulated)

18. © 2012 Progress Software Corporation. All rights reserved. 18 Demo: Customer List  See basic customer list from Sports2000.

19. © 2012 Progress Software Corporation. All rights reserved. 19 Demo: Help About : Login info  See user name, expiration date, etc

20. © 2012 Progress Software Corporation. All rights reserved. 20 Demo: Logout > Refresh Customer List  Now logout, see clear screen  Try “Refresh Customer List” and see error Expected because we’re not logged in

21. © 2012 Progress Software Corporation. All rights reserved. 21 Application Architecture: Login passport Security token User interface application forms Claims / Assertions Security Token Service my permanent record Authentication system Domains

22. © 2012 Progress Software Corporation. All rights reserved. 22 Application Architecture: Login User interface Claims / Assertions passport Security token application forms Claims / Assertions Security Token Service my permanent record Authentication system Domains RUN login.p ON SERVER hAppServer (cUser, cDomain, cPassword, OUTPUT lcToken) 1

23. © 2012 Progress Software Corporation. All rights reserved. 23 Application Architecture: Login passport Security token application forms Claims / Assertions Security Token Service my permanent record Authentication system Domains RUN login.p ON SERVER hAppServer (cUser, cDomain, cPassword, OUTPUT lcToken) login.p INPUT PARAM pcUser INPUT PARAM pcDomain INPUT PARAM pcPword OUTPUT PARAM pcToken pcToken = STS:Login (pcUser, pcDomain, pcPword). 1 2

24. © 2012 Progress Software Corporation. All rights reserved. 24 Application Architecture: Login passport Security token application forms Claims / Assertions Secure Token Service my permanent record Authentication system Domains /* save token in local session */ 3 login.p INPUT PARAM pcUser INPUT PARAM pcDomain INPUT PARAM pcPword OUTPUT PARAM pcToken pcToken = STS:Login (pcUser, pcDomain, pcPword). 2 RUN login.p ON SERVER hAppServer (cUser, cDomain, cPassword, OUTPUT lcToken) 1

25. © 2012 Progress Software Corporation. All rights reserved. 25 Application Architecture: Login passport Security token application forms Claims / Assertions Secure Token Service my permanent record Authentication system Domains login.p INPUT PARAM pcUser INPUT PARAM pcDomain INPUT PARAM pcPword OUTPUT PARAM pcToken pcToken = STS:Login (pcUser, pcDomain, pcPword). 2 RUN login.p ON SERVER hAppServer (cUser, cDomain, cPassword, OUTPUT lcToken) 1 /* save token in local session */ 3

26. © 2012 Progress Software Corporation. All rights reserved. 26 Managing Security Context charToken = hCP:SESSION-IDrawToken = hCP:EXPORT- PRINCIPAL Client Context Server Context 11.2+11.0+ Entire security context for session in sealed C-P Sealed C-P moves between server and client Server validates C-P & uses it to establish security context Used in stateful apps that run in stateless server environments More data transmitted per call = more overhead Less secure, unless C-P encrypted or in SSL session Entire security context for session stored on server, using C-P’s SESSION-ID as key (“CCID”) CCID moves between server and client. CCID used to find context in cache & rehydrate C-P Server validates C-P & uses it to establish security context Used in stateful applications Less data transmitted = lower overhead More secure, since C-P not at risk of exposure

27. © 2012 Progress Software Corporation. All rights reserved. 27 Application Architecture: Login passport Security token application forms Claims / Assertions Secure Token Service my permanent record Authentication system Domains login.p INPUT PARAM pcUser INPUT PARAM pcDomain INPUT PARAM pcPword OUTPUT PARAM pcToken pcToken = STS:Login (pcUser, pcDomain, pcPword). 2 /* save token in local session */ 3 RUN login.p ON SERVER hAppServer (cUser, cDomain, cPassword, OUTPUT lcToken) 1

28. © 2012 Progress Software Corporation. All rights reserved. 28 Desktop.MainForm.cls method public logical LoginUser( input pcUserName as char, input pcDomain as char, input pcPassword as char): run Security/Login.p on hAppServer ( pcUserName, pcDomain, pcPassword, output cUserContextId). if cUserContextId eq '' then return false. /* set the CCID on the business logic server so that it's transported with every request. */ hAppServer:request-info:ClientContextId = cUserContextId. return true. end method.

29. © 2012 Progress Software Corporation. All rights reserved. 29 Application Architecture: Login passport Security token application forms Claims / Assertions Secure Token Service my permanent record Authentication system Domains /* save token in local session */ 3 RUN login.p ON SERVER hAppServer (cUser, cDomain, cPassword, OUTPUT lcToken) 1 login.p INPUT PARAM pcUser INPUT PARAM pcDomain INPUT PARAM pcPword OUTPUT PARAM pcToken pcToken = STS:Login (pcUser, pcDomain, pcPword). 2

30. © 2012 Progress Software Corporation. All rights reserved. 30 Security/Login.p define input parameter pcUser as character no-undo. define input parameter pcDomain as character no-undo. define input parameter pcPassword as character no-undo. define output parameter pcToken as character no-undo. pcToken = Security.SecurityTokenService:Instance :LoginUser(pcUser, pcDomain, pcPassword).

31. © 2012 Progress Software Corporation. All rights reserved. 31 method public char LoginUser(input pcUserName as char, input pcUserDomain as char, input pcPassword as char): define variable hClientPrincipal as handle no-undo. create client-principal hClientPrincipal. hClientPrincipal:initialize( substitute('&1@&2', pcUserName, pcUserDomain), ?, /* unique session id */ add-interval(now, 8, 'hours'), /* login expiration */ pcPassword). /* passes authentication work off to authentication system */ security-policy:set-client(hClientPrincipal). /* writes security context into DB */ WriteClientPrincipalToStore(hClientPrincipal). /* return character value */ return hClientPrincipal:session-id. end method. Security.SecurityTokenService.cls

32. © 2012 Progress Software Corporation. All rights reserved. 32 method public char LoginUser(input pcUserName as char, input pcUserDomain as char, input pcPassword as char): define variable hClientPrincipal as handle no-undo. create client-principal hClientPrincipal. hClientPrincipal:initialize( substitute('&1@&2', pcUserName, pcUserDomain), ?, /* unique session id */ add-interval(now, 8, 'hours'), /* login expiration */ pcPassword). /* passes authentication work off to authentication system */ security-policy:set-client(hClientPrincipal). /* writes security context into DB */ WriteClientPrincipalToStore(hClientPrincipal). /* return character value */ return hClientPrincipal:session-id. end method. Security.SecurityTokenService.cls

33. © 2012 Progress Software Corporation. All rights reserved. 33 create _sec-authentication-system. _Domain-type = 'TABLE-ApplicationUser'. _Domain-type-description = 'The ApplicationUser table serves as the authentication domain'. _PAM-plug-in = true. _PAM-callback-procedure = 'Security/AppUserAuthenticate.p'. _sec-authentication-system

34. © 2012 Progress Software Corporation. All rights reserved. 34 procedure AuthenticateUser: def input param phClientPrincipal as handle no-undo. def input param pcSystemOptions as character extent no-undo. def output param piPAMStatus as integer init ? no- undo. def output param pcErrorMsg as character no-undo. find ApplicationUser where ApplicationUser.LoginName eq phCP:user-id and ApplicationUser.LoginDomain eq phCP:domain-name no-lock no-error. if not available ApplicationUser then piPAMStatus = Progress.Lang.PAMStatus:UnknownUser. else if ApplicationUser.Password ne encode(phCP:primary-passphrase) then piPAMStatus = Progress.Lang.PAMStatus:AuthenticationFailed. else /* we're good to go */ piPAMStatus = Progress.Lang.PAMStatus:Success. return. end procedure. Security/AppUserAuthenticate.p

35. © 2012 Progress Software Corporation. All rights reserved. 35 Security.SecurityTokenService.cls method public char LoginUser(input pcUserName as char, input pcUserDomain as char, input pcPassword as char): define variable hClientPrincipal as handle no-undo. create client-principal hClientPrincipal. hClientPrincipal:initialize( substitute('&1@&2', pcUserName, pcUserDomain), ?, /* unique session id */ add-interval(now, 8, 'hours'), /* login expiration */ pcPassword). /* passes authentication work off to authentication system */ security-policy:set-client(hClientPrincipal). /* writes security context into DB */ WriteClientPrincipalToStore(hClientPrincipal). /* return character value */ return hClientPrincipal:session-id. end method.

36. © 2012 Progress Software Corporation. All rights reserved. 36 Security.SecurityTokenService.cls method protected void WriteClientPrincipalToStore( input phClientPrincipal as handle): define buffer lbSecurityContext for SecurityContext. /* scope this transaction as small as possible */ do for lbSecurityContext transaction: find lbSecurityContext where lbSecurityContext.SessionId eq phClientPrincipal:session-id exclusive-lock no-wait no-error. if not available lbSecurityContext then do: create lbSecurityContext. lbSecurityContext.SessionId = phClientPrincipal:session-id. end. lbSecurityContext.ClientPrincipal = phClientPrincipal:export- principal(). lbSecurityContext.LastAccess = now. end. end method.

37. © 2012 Progress Software Corporation. All rights reserved. 37 Security.SecurityTokenService.cls method public char LoginUser(input pcUserName as char, input pcUserDomain as char, input pcPassword as char): define variable hClientPrincipal as handle no-undo. create client-principal hClientPrincipal. hClientPrincipal:initialize( substitute('&1@&2', pcUserName, pcUserDomain), ?, /* unique session id */ add-interval(now, 8, 'hours'), /* login expiration */ pcPassword). /* passes authentication work off to authentication system */ security-policy:set-client(hClientPrincipal). /* writes security context into DB */ WriteClientPrincipalToStore(hClientPrincipal). /* return character value */ return hClientPrincipal:session-id. end method.

38. © 2012 Progress Software Corporation. All rights reserved. 38 Application Architecture: Login passport Security token application forms Claims / Assertions Secure Token Service my permanent record Authentication system Domains login.p INPUT PARAM pcUser INPUT PARAM pcDomain INPUT PARAM pcPword OUTPUT PARAM pcToken pcToken = STS:Login (pcUser, pcDomain, pcPword). 2 RUN login.p ON SERVER hAppServer (cUser, cDomain, cPassword, OUTPUT lcToken) 1 /* save token in local session */ 3

39. © 2012 Progress Software Corporation. All rights reserved. 39 Desktop.MainForm.cls method public logical LoginUser( input pcUserName as char, input pcDomain as char, input pcPassword as char): run Security/Login.p on hAppServer ( pcUserName, pcDomain, pcPassword, output cUserContextId). if cUserContextId eq '' then return false. /* set the CCID on the business logic server so that it's transported with every request. */ hAppServer:request-info:ClientContextId = cUserContextId. return true. end method.

40. © 2012 Progress Software Corporation. All rights reserved. 40 Application Architecture: Business Logic conference Auditing Application business logic User interfaceSecurity tokenAuthentication Domains Authorisation

41. © 2012 Progress Software Corporation. All rights reserved. 41 Application Architecture: Business Logic conference Auditing Application business logic User interfaceSecurity tokenAuthentication Domains Authorisation RUN getcustomerlist.p ON SERVER hAppServer (OUTPUT DATASET dsCustomer) 1

42. © 2012 Progress Software Corporation. All rights reserved. 42 Application Architecture: Business Logic conference Auditing Application business logic User interfaceSecurity tokenAuthentication Domains Authorisation RUN getcustomerlist.p ON SERVER hAppServer (OUTPUT DATASET dsCustomer) 1 activate.p STS:ValidateToken (INPUT cToken). security-policy:set- client ( >) 2

43. © 2012 Progress Software Corporation. All rights reserved. 43 Application Architecture: Business Logic conference Auditing Application business logic User interfaceSecurity tokenAuthentication Domains Authorisation RUN getcustomerlist.p ON SERVER hAppServer (OUTPUT DATASET dsCustomer) 1 activate.p STS:ValidateToken (INPUT cToken). security-policy:set- client ( >) AuthoriseService ("getcustomer.p"). 2 3

44. © 2012 Progress Software Corporation. All rights reserved. 44 Application Architecture: Business Logic conference Auditing Application business logic User interfaceSecurity tokenAuthentication Domains Authorisation getcustomerlist.p OUTPUT PARAM DATASET dsCustomer RUN getcustomerlist.p ON SERVER hAppServer (OUTPUT DATASET dsCustomer) 4 1 activate.p STS:ValidateToken (INPUT cToken). security-policy:set- client ( >) AuthoriseService ("getcustomer.p"). 2 3

45. © 2012 Progress Software Corporation. All rights reserved. 45 Application Architecture: Business Logic conference Auditing Application business logic User interfaceSecurity tokenAuthentication Domains Authorisation RUN getcustomerlist.p ON SERVER hAppServer (OUTPUT DATASET dsCustomer) 1 activate.p STS:ValidateToken (INPUT cToken). security-policy:set- client ( >) AuthoriseService ("getcustomer.p"). deactivate.p security-policy:set- client ( >) 5 getcustomerlist.p OUTPUT PARAM DATASET dsCustomer 4 2 3

46. © 2012 Progress Software Corporation. All rights reserved. 46 Application Architecture: Business Logic conference Auditing Application business logic User interfaceSecurity tokenAuthentication Domains Authorisation deactivate.p security-policy:set- client ( >) 5 getcustomerlist.p OUTPUT PARAM DATASET dsCustomer 4 3 activate.p STS:ValidateToken (INPUT cToken). security-policy:set- client ( >) AuthoriseService ("getcustomer.p"). 2 RUN getcustomerlist.p ON SERVER hAppServer (OUTPUT DATASET dsCustomer) 1

47. © 2012 Progress Software Corporation. All rights reserved. 47 Desktop.MainForm.cls method protected void RefreshCustomerList(): define variable hAppServer as handle no-undo. run BusinessLogic/GetCustomerList.p on hAppServer (output dataset dsCustomerOrder). open query qryCustomer preselect each ttCustomer by ttCustomer.CustNum. bsCustomer:Handle = query qryCustomer:handle. query qryCustomer:reposition-to-row(1). end method.

48. © 2012 Progress Software Corporation. All rights reserved. 48 Application Architecture: Business Logic conference Auditing Application business logic User interfaceSecurity tokenAuthentication Domains Authorisation RUN getcustomerlist.p ON SERVER hAppServer (OUTPUT DATASET dsCustomer) 1 deactivate.p security-policy:set- client ( >) 5 getcustomerlist.p OUTPUT PARAM DATASET dsCustomer 4 3 activate.p STS:ValidateToken (INPUT cToken). security-policy:set- client ( >) AuthoriseService ("getcustomer.p"). 2

49. © 2012 Progress Software Corporation. All rights reserved. 49 Security/Activate.p hClientPrincipal = Security.SecurityTokenService:Instance: GetClientPrincipal( session:current-request-info:ClientContextId). /* authenticate client-principal */ security-policy:set-client(hClientPrincipal).

50. © 2012 Progress Software Corporation. All rights reserved. 50 Security.SecurityTokenService.cls method public handle GetClientPrincipal(input pcContextId as char): define variable hClientPrincipal as handle no-undo. define variable rClientPrincipal as raw no-undo. define buffer lbSecurityContext for SecurityContext. /* scope this transaction as small as possible */ do for lbSecurityContext transaction: find lbSecurityContext where lbSecurityContext.SessionId eq pcContextId exclusive-lock no-wait no-error. if not available lbSecurityContext then undo, throw new AppError('Context does not exist'). assign rClientPrincipal = lbSecurityContext.ClientPrincipal lbSecurityContext.LastAccess = now. end. create client-principal hClientPrincipal. hClientPrincipal:import-principal(rClientPrincipal). return hClientPrincipal. end method.

51. © 2012 Progress Software Corporation. All rights reserved. 51 Security/Activate.p hClientPrincipal = Security.SecurityTokenService:Instance: GetClientPrincipal( session:current-request-info:ClientContextId). /* authenticate client-principal */ security-policy:set-client(hClientPrincipal).

52. © 2012 Progress Software Corporation. All rights reserved. 52 create _sec-authentication-system. _Domain-type = 'TABLE-ApplicationUser'. _Domain-type-description = 'The ApplicationUser table serves as the authentication domain'. _PAM-plug-in = true. _PAM-callback-procedure = 'Security/AppUserAuthenticate.p'. _sec-authentication-system

53. © 2012 Progress Software Corporation. All rights reserved. 53 procedure AfterSetIdentity: def input param phClientPrincipal as handle no-undo. def input param pcSystemOptions as character extent no-undo. /* At this point the CLIENT-PRINCIPAL is sealed and the user authenticated */ /* Load user/application (as opposed to security) context here */ return. end procedure. Security/AppUserAuthenticate.p

54. © 2012 Progress Software Corporation. All rights reserved. 54 Application Architecture: Business Logic conference Auditing Application business logic User interfaceSecurity tokenAuthentication Domains Authorisation RUN getcustomerlist.p ON SERVER hAppServer (OUTPUT DATASET dsCustomer) 1 3 activate.p STS:ValidateToken (INPUT cToken). security-policy:set- client ( >) AuthoriseService ("getcustomer.p"). 2 deactivate.p security-policy:set- client ( >) 5 getcustomerlist.p OUTPUT PARAM DATASET dsCustomer 4

55. © 2012 Progress Software Corporation. All rights reserved. 55 {BusinessLogic/dsCustomerOrder.i} define output parameter dataset for dsCustomerOrder. define variable oBusinessEntity as CustomerOrderBE no- undo. oBusinessEntity = new CustomerOrderBE(). oBusinessEntity:GetCustomers(output dataset dsCustomerOrder). /* eof */ BusinessLogic/GetCustomerList.p

56. © 2012 Progress Software Corporation. All rights reserved. 56 Application Architecture: Business Logic conference Auditing Application business logic User interfaceSecurity tokenAuthentication Domains Authorisation RUN getcustomerlist.p ON SERVER hAppServer (OUTPUT DATASET dsCustomer) 1 getcustomerlist.p OUTPUT PARAM DATASET dsCustomer 4 3 activate.p STS:ValidateToken (INPUT cToken). security-policy:set- client ( >) AuthoriseService ("getcustomer.p"). 2 deactivate.p security-policy:set- client ( >) 5

57. © 2012 Progress Software Corporation. All rights reserved. 57 Security/Deactivate.p define variable hClientPrincipal as handle no-undo. hClientPrincipal = dynamic-function( 'GetAgentClientPrincipal' in hStartupProc) security-policy:set-client(hClientPrincipal). /* eof */

58. © 2012 Progress Software Corporation. All rights reserved. 58 Desktop.MainForm.cls method protected void RefreshCustomerList(): define variable hAppServer as handle no-undo. run BusinessLogic/GetCustomerList.p on hAppServer (output dataset dsCustomerOrder). open query qryCustomer preselect each ttCustomer by ttCustomer.CustNum. bsCustomer:Handle = query qryCustomer:handle. query qryCustomer:reposition-to-row(1). end method.

59. © 2012 Progress Software Corporation. All rights reserved. 59 Application Architecture: Business Logic conference Auditing Application business logic User interfaceSecurity tokenAuthentication Domains Authorisation RUN getcustomerlist.p ON SERVER hAppServer (OUTPUT DATASET dsCustomer) 1 getcustomerlist.p OUTPUT PARAM DATASET dsCustomer 4 3 activate.p STS:ValidateToken (INPUT cToken). security-policy:set- client ( >) AuthoriseService ("getcustomer.p"). 2 deactivate.p security-policy:set- client ( >) 5 startup.p security-policy:load- domains() STS:Login('agent', 'system'). security-policy:set-client ( >). 0

60. © 2012 Progress Software Corporation. All rights reserved. 60 Security/Startup.p define input parameter pcStartupData as character no-undo. define variable cAgentSessionId as character no-undo. define variable hClientPrincipal as handle no-undo. /* load domains */ security-policy:load-domains('sports2000'). /* immediately set session user to a low-privilege agent user */ cAgentSessionId = Security.SecurityTokenService:Instance :LoginUser('agent', 'system','oech1::3c373b2a372c3d'). hClientPrincipal = Security.SecurityTokenService:Instance :GetClientPrincipal(cAgentSessionId). security-policy:set-client (hClientPrincipal). function GetAgentSessionId returns character (): return cAgentSessionId. end function. function GetAgentClientPrincipal returns handle(): return hClientPrincipal. end function. /* eof */

61. © 2012 Progress Software Corporation. All rights reserved. 61 Security/Shutdown.p Security.SecurityTokenService:Instance :LogoutUser( dynamic-function('GetAgentSessionId' in hStartupProc)). /* eof */

62. © 2012 Progress Software Corporation. All rights reserved. 62 Separate AppServers for STS & Business Logic Security Token Service AppServer Business Logic AppServer UI Client

63. © 2012 Progress Software Corporation. All rights reserved. 63 Separate AppServers for STS & Business Logic Security Token Service AppServer Business Logic AppServer UI Client Security/Startup.p session:export( 'Security/Login.p' + ',Security/LoginSSO.p' + ',Security/Logout.p' + ',Security/GetClientPrincipal.p' + ',Security/ValidateToken.p' + ',Security/ValidateClientPrincipal.p ' + ',Security/RegisterServer.p' + ',Security/DeregisterServer.p').

64. © 2012 Progress Software Corporation. All rights reserved. 64 Separate AppServers for STS & Business Logic LoginUser() login.p Security Token Service AppServer Business Logic AppServer UI Client

65. © 2012 Progress Software Corporation. All rights reserved. 65 Separate AppServers for STS & Business Logic getcustomer.p ValidateToken() GetClientPrincipal() Security Token Service AppServer Business Logic AppServer UI Client

66. © 2012 Progress Software Corporation. All rights reserved. 66 Separate AppServers for STS & Business Logic getcustomer.p security-policy:set-client( ) Security Token Service AppServer Business Logic AppServer UI Client Domain name, Access code

67. © 2012 Progress Software Corporation. All rights reserved. 67 _sec-authentication-system & -domain create _sec-authentication-system. _Domain-type = 'TABLE- ApplicationUser'. _PAM-plug-in = true. _PAM-callback-procedure = 'Security/AppUserAuthenticate.p'. create _sec-authentication-system. _Domain-type = 'TABLE- ApplicationUser'. _PAM-plug-in = true. _PAM-callback-procedure = 'Security/NoLoginAuthenticate.p'. create _sec-authentication-domain. _Domain-name = 'employee'. _Domain-type = 'TABLE-ApplicationUser'. _Domain-access-code = audit-policy:encrypt-audit-mac-key( ‘s00perSecr1tK3y4EMPLOYEE'). _Domain-enabled = true. Security Token Service Business Logic Service Common

68. © 2012 Progress Software Corporation. All rights reserved. 68 _PAM-callback-procedure procedure AuthenticateUser: /* snipped parameters*/ find ApplicationUser where ApplicationUser.LoginName eq phCP:user-id and ApplicationUser.LoginDomain eq phCP:domain- name no-lock no-error. if not available ApplicationUser then piPAMStatus = Progress.Lang.PAMStatus:UnknownUser. else if ApplicationUser.Password ne encode(phCP:primary-passphrase) then piPAMStatus = Progress.Lang.PAMStatus:AuthenticationFailed. else /* we're good to go */ piPAMStatus = Progress.Lang.PAMStatus:Success. return. end procedure. procedure AuthenticateUser: /* snipped parameters*/ /* we're not allowed to do any logins here */ piPAMStatus = PAMStatus:InvalidConfiguration. return. end. Security Token Service Business Logic Service

69. © 2012 Progress Software Corporation. All rights reserved. 69 Separate AppServers for STS & Business Logic getcustomer.p Security Token Service AppServer Business Logic AppServer UI Client security-policy:set-client( ) CustomerBE:Get Data( )

70. © 2012 Progress Software Corporation. All rights reserved. 70 Separate AppServers for STS & Business Logic LogoutUser() logout.p Security Token Service AppServer Business Logic AppServer UI Client

71. © 2012 Progress Software Corporation. All rights reserved. 71 ValidateToken() Separate AppServers for STS & Business Logic Security Token Service AppServer Business Logic AppServer UI Client getcustomer.p

72. © 2012 Progress Software Corporation. All rights reserved. 72 Separate AppServers for STS & Business Logic Security Token Service AppServer Business Logic AppServer UI Client ? getcustomer.p

73. © 2012 Progress Software Corporation. All rights reserved. 73 Separate AppServers for STS & Business Logic Security Token Service AppServer Business Logic AppServer UI Client getsecrets.p

74. © 2012 Progress Software Corporation. All rights reserved. 74 OpenEdge Provides …  A security token CLIENT-PRINCIPAL available in multiple clients Automatic creation in some cases  Token available in activate procedure  PAM modules Configurable, plug-in architecture Guaranteed, consistent, trusted code-paths

75. © 2012 Progress Software Corporation. All rights reserved. 75 OpenEdge Does Not …  Have a prescriptive model  Manage security context for an entire application  Automatic import of external systems’ tokens For example, SAML for federated authentication

76. © 2012 Progress Software Corporation. All rights reserved. 76 Coming Soon … {std/disclaimer.i}  More authentication systems / PAM modules Better SSO support (Windows workstation) LDAP ActiveDirectory  Upgraded security for _User  OpenEdge realm for BPM & REST Progress.Security.Realm.IHybridRealm

77. © 2012 Progress Software Corporation. All rights reserved. 77 Summary  Identity management is a process that helps protect your business data  Applications must have security designed in Delegation of responsibility Multiple layers  OpenEdge provides components of identity management CLIENT-PRINCIPAL Authentication Systems Transportation of security token

78. © 2012 Progress Software Corporation. All rights reserved. 78 Extra materials  This session Slides to be posted on PUG Challenge site Supporting code at https://github.com/nwahmaet/IdM_Samplehttps://github.com/nwahmaet/IdM_Sample  Other PUG Challenge sessions Coding with Identity Management & Security (Part 2) Peter Judge, PSC Advanced OpenEdge REST/Mobile Security Mike Jacobs, PSC Programming with the Client-Principal Object Chris Longo, BravePoint Image Credits: Passport designed by Catia G, Time designed by wayne25uk, Database designed by Anton Outkine, Code designed by Nikhil Dev, Imposter designed by Luis Prado, User designed by T. Weber, Fingerprint designed by Andrew Forrester, Document designed by Samuel Green, Certificate designed by VuWorks, Network designed by Ben Rex Furneaux, Beer designed by Leigh Scholten; all from The Noun Project

79. October 6–9, 2013 Boston #PRGS13 www.progress.com/exchange-pug Special low rate of $495 for PUG Challenge attendees with the code PUGAM And visit the Progress booth to learn more about the Progress App Dev Challenge!