1. Federating non-web services with LDAP-Façade

2. What is LDAP-Façade
A solution developed by KIT which enables non web-based services to join SAML-based federations
Combines SAML logic and LDAP directory interface
Appears to be a local LDAP directory to the service
Appears to be a SP to the SAML federation
LDAP-Facade - 9th FIM4R Workshop, , Vienna

3. ECP: Enhanced Client and Enhanced Proxy
SP as an enhanced proxy
Service client as an enhanced client
SP as an enhanced proxy
Service client as an enhanced client
Courtesy of J. Köhler, M. Simon, M. Nussbaumer, H. Hartenstein
LDAP-Facade - 9th FIM4R Workshop, , Vienna

4. User registration with the service
Registration is web-based, using SAML Web-SSO profile
A local account is established for the user upon the registration
Contains service-specific info: UID, home dir, etc.
Allows user to accept the policies of the SP
User logs into LDF with her home IdP account
User clicks on the service registration link.
User accepts the policies of the SP
The SAML assertion released to the LDF during the login is used to authenticate the user and fill in the attributes for the local account
LDAP-Facade - 9th FIM4R Workshop, , Vienna

5. SSH example (enhanced proxy case)
6. AuthN OK, user attrs
SSH server
PAM LDAP authN
1. username, pwd
LDF
------
Apache DS
==========
Reg-App (SAML SP logic)
2. LDAP authN for the user, pwd forwarded to LDF
3. HTTPS
IdP
4. Login with user’s creds
5. SAML assertion
7. User logged in
LDAP-Facade - 9th FIM4R Workshop, , Vienna

6. SSH example (enhanced client case)
6. AuthN OK, user attrs
SSH server
PAM LDAP authN
1. username, pwd
LDF
------
Apache DS
==========
Reg-App (SAML SP logic)
4. LDAP authN for the user, SAML assertion forwarded to LDF
5. HTTPS
IdP
3. SAML assertion wrapped in the password
2. SAML assertion
7. User logged in
LDAP-Facade - 9th FIM4R Workshop, , Vienna

7. SSH example (enhanced client case)
Strategies of passing the SAML assertion to the service provider’s server
Wrapping into the password
Limitations
URL to the assertion to be downloaded by the LDF
LDAP-Facade - 9th FIM4R Workshop, , Vienna

8. Demonstrations
SSH with Home Organisation password forwarding to the SSH server
SSH without Home Organisation password forwarding to the SSH server
LDAP-Facade - 9th FIM4R Workshop, , Vienna

9. Current usage Approx. 17600 users 13755 active users of bwSync&Share
1020 users of bwUniCluster, 1007 users of bwFileStorage
Production LDF servers at KIT, Ulm University
Member of DFN-AAI
Pre-production LDF server in Mannheim
Test LDF servers in Esslingen, Tübingen, Freiburg (last two will go into production)
LDAP-Facade - 9th FIM4R Workshop, , Vienna

10. The roadmap 12/2015 Public prototype for DFN + eduGAIN
SAML-Token support
03/2016
Zero-Attribute requirements
For simplified support of additional IdPs
Support additional IdPs / federations
e.g. Umbrella, B2ACCESS, ...
06/2016
OpenID Connect support
Integration with globus grid-security-infrastructure
i.e. grid-FTP to use LDAP-Facade for (UID, [GID])
12/2016
Support for 3rd party group membership (e.g. via Attribute Authorities)
e.g. Unity (B2ACCESS), VOMS-SAML, ...
LDAP-Facade - 9th FIM4R Workshop, , Vienna

11. References
J. Köhler, M. Simon, M. Nussbaumer, H. Hartenstein: Federating HPC access via SAML: Towards a plug-and-play solution. International Supercomputing Conference, Leipizig, Germany, June 2013
LDAP-Facade - 9th FIM4R Workshop, , Vienna

12. Thank you!
LDAP-Facade - 9th FIM4R Workshop, , Vienna