1. Insert Your Name Insert Your Title Insert Date Client Registration Examples Alan Frindell Denis Pochuev 4/27/2011

2. Summary of updates since Feb F2F  Complex structures scrapped for simpler ones with better v1.0 compatibility  More discretion left to server implementers  Credential is now a “first class” Attribute in addition to a base object Facilitates Credential updates with minimal spec angst  Minor updates based on F2F feedback 2

3. Certificate Entity: Implicit self-registration  Server implicitly creates Entity record as a side effect of another KMIP request  No special TTLV required – KMIP server extracts needed values from TLS certificate  Client MAY already have a cert signed by a CA trusted by KMIP server  Resulting Object: Entity UUID: ABCD-1234 Attribute Attribute Name: “Credential” Attribute Value: Credential Type: Transport Certificate Credential Value: Certificate Certificate Type: X.509 Certificate Value: 3

4. Certificate Entity: Explicit self-registration Register Object Type=Entity Template-Attribute Attribute Attribute Name: “Credential” Attribute Value: Credential Type: Transport Certificate Credential Value:  Certificate fields extracted from TLS 4

5. Certificate Entity: Registration Register Object Type=Entity Template-Attribute Attribute Attribute Name: “Credential” Attribute Value: Credential Type: Transport Certificate Credential Value: Certificate Certificate Type: X.509 Certificate Value:  Assumption: Registering Entity has privilege to register Entities 5

6. Certificate Entity: Authentication and Access Control Authentication Credential Credential Type: Transport Certificate Credential Value:  Server looks up Entity based on TLS certificate information Server policy: may be dynamic mapping or exact match  For access control, server checks authenticated Entity UUID against request object Owner attribute 6

7. Username/Password User: Registration Register Object Type=Entity Template-Attribute Attribute Attribute Name: “Credential” Attribute Value: Credential Type: Username and Password Credential Value: Username: “user1” Password: “password”  Resulting Object: Entity UUID: ABCD-1234 Attribute Attribute Name: “Credential” Attribute Value: Credential Type: Username and Password Credential Value: Username: “user1” Password: “password” 7

8. Username/Password User: Authentication and Access Control  Same as v1.0 Authentication Credential Credential Type: Username and Password Credential Value: Username: “user1” Password: “password”  Server looks up Entity based on Credential (username)  For access control, server checks authenticated Entity UUID against request object Owner attribute 8

9. Multi-factor Entity: Registration Register Object Type=Entity Template-Attribute Attribute Attribute Name: “Credential” Attribute Value: Credential Type: Transport Certificate Credential Value: Certificate Certificate Type: X.509 Certificate Value: Attribute Attribute Name: “Credential” Attribute Value: Credential Type: Username and Password Credential Value: Username: “user1” Password: “password” 9

10. Multi-factor Entity: Authentication Authentication Credential Credential Type: Transport Certificate Credential Value: Credential Credential Type: Username and Password Credential Value: Username: “user1” Password: “password”  Server looks up Entity based on each Credential – all must resolve to the same Entity  For access control, server checks authenticated Entity UUID against request object Owner attribute 10

11. Locate Entity and Objects by Entity  Find all Entities with Transport Certificate Credentials: Locate Credential Credential Type: Transport Certificate  Find an Entity by its transport certificate: Locate Credential Credential Type: Transport Certificate Credential Value: Certificate:  Find yourself: Locate Entity Identifier = Self  Find all objects owned by : Locate Owner = 11

12. Credential Refresh Modify Attribute Attribute: “Credential” Attribute Index: N Attribute Value: Credential Type: Transport Certificate Credential Value: Certificate: Modify Attribute Attribute: “Credential” Attribute Index: N Attribute Value: Credential Type: Username and Password Credential Value: Username: “user1” Password: “new-password” 12

13. Other operations  Get Entity Info Locate Entity Identifier = Self Get Attributes Attribute Name: “Credential”  Server is not allowed to return Password values in Username and Password structure  Destroy Entity Destroy UUID: “ABCD-1234” 13

14. Future work  Define error handling behavior and update respective chapter in the specification  Update Usage Guide and Use-Case documents  Define another Credential Type for explicit two-factor authentication (if needed and if the proof of possession issue is resolved) 14