The FederID project The First Identity Management and Federation Free Software

Page  2 Table of contents  A question of Identity  Liberty Alliance  The FederID architecture  Demo (hope it works)

Page  3 A question of Identity  A digital entity is a set of attributes describing an entity  A subset named credentials are used for authentication  An entity (a user) can own many identities  Each identity has roles and rights within an application (service provider)

Page  4 A question of Identity  Services provider manage the identities : -For a service provider : 1 user = 1 identity -For an user : 1 service = 1 identity

Page  5 A question of Identity  We need Identity Management ! -Referential of identities (LDAP Directory) -Provisioning services -Access control on data (LDAP ACLs) -Access control on applications (SSO rules)  We need Identity Federation ! -Keep different identities for private life purpose -Federate accounts to benefits from other services

Page  6 Federation standards  Parallel standards: -Liberty Alliance : ID-FF, ID-WSF, ID-SIS -Shibboleth (Internet2) -WS-* (Microsoft) -SAML (OASIS) -OpenID (the newcomer)  Standards convergence: -Shibboleth and Liberty Alliance will share a common standard: SAML 2.0

Page  7 Liberty Alliance  Grounded in 2001 by SUN and 13 others partners  More than 150 members  Goals: -Open Federation Standard -Respect of private life in numeric space  3 frameworks: -ID-FF (Federation Framework) [now SAML 2.0]: SSO, SLO,... -ID-WSF (Web Services Framework): attributes sharing,... -ID-SIS (Service Interface Specifications): services interactions,...

Page  8 Liberty Alliance consortium members

Page  9 A simple Liberty Alliance Circle of Trust (CoT) Service Provider Identity Provider Service Provider Attributes Provider

Page  10 Identity federation workflow

Page  11 More than one circle of trust

Page  12 FederID components  The developments done for FederID are all under free software licenses and published on projects forges, mainly hosted by OW2 consortium.  FederID, it is also the integration of existing free software, known for their functional wealth and improved security: -Lasso: library for Liberty Alliance, SAML2 and ID-WSF2 protocols. -Authentic: identity provider based on Lasso, complying with SAML2 and Liberty Alliance ID-WSF LemonLDAP::NG: web application firewall with graphical management console and LDAP based authorization, using SAML2 authentication. -InterLDAP: identity management, provisioning, web service attributes sharing. = +++

Page  13 Sample architecture LDAP Director y Circl e ofTrust Authenti c Identity Provider Content Management [WUI] Attribut e Provider [LAAP] SSO & Authorization s Service Provider Standard Web application Standard Web application

Page  14 FederID Identity Provider  Authentic : -Liberty Alliance identity provider -Authentication of users against an LDAP server, a database or simple flat text files -Forcing LDAP authentication within FederID -Capable of forwarding LDAP attributes into SAML responses

Page  15 FederID WebSSO  LemonLDAP::NG: -WebSSO product based on Apache Perl Handler technology. -Offering three modules : -Handler: protect the application -Portal: where the user is redirected when not authenticated -Manager: graphical interface enabling the configuration of LemonLDAP::NG.

Page  16 Standard SSO infrastructure

Page  17 SSO in the federation world Agent (Handler) Session s LDAP Login Password Assertion Consumer Identity Provider SSO & Authorizations Standard Web Application

Page  18 Attributes Sharing over Web Services LAAP Attributes Provider LDAP Directory Service Provider (Attributes Consumer) Identity Provider

Page  19 FederID Directory Content Management  InterLDAP-WUI: -Content Management System for an LDAP directory -Enriched schema designing the interface “on the fly” -Authorization back-end -Delegation is enabled by setting trees and groups properties for each part of the Directory Information Tree

Page  20 LDAP content management system

Join us! freenode