Connect. Communicate. Collaborate Deploying Authorization Mechanisms for Federated Services in the eduroam architecture (DAMe)* Antonio F. Gómez-Skarmeta University of Murcia (Spain) TNC2007, Copenhagen, 2007/05/21 * Funded by EC project Geant2-JRA5, Terena, RedIRIS and DFN.

Connect. Communicate. Collaborate Overview Introduction Starting points Main goals of the DAMe project

Connect. Communicate. Collaborate Introduction DAMe is a research project based on previous works from TERENA, Internet 2 and the University of Murcia. –eduroam, as a result of the TERENA Mobility Task Force, which defines a roaming architecture between NRENs based on AAA servers (RADIUS) and the 802.1X standard. –Shibboleth, a widely deployed federation mechanism. –eduGAIN, the AAI (Authentication and Authorization Infrastructure) from GEANT 2 (GN2). –NAS-SAML, a network access control system for AAA architectures developed by the University of Murcia and based on SAML (Security Assertion Markup Language) and XACML (eXtensible Access Control Markup Language)

Connect. Communicate. Collaborate Authentication, but also authorization are needed in order to provide an appropriate network access: –User’s identity is not enough –Institutions can offer different QoS parameters depending on the user. –Decisions should be taken considering the user attributes –User mobility is becoming more and more frequent –Several institutions must cooperate at several levels. Preliminary works on this subject: –DAIDALOS project –RADIUS/SAML (Internet 2) Application-level services can take advantage of the network acccess mechanism in order to bootstrap a seamless global SSO DAMe project. Main Goals

Connect. Communicate. Collaborate Intradomain: Campus Teachers Students Adm. Staff Reserachers ¿? Users DB Web Services LDAP Directory Internet Wireless Services Authentication Authority Authorization Authority Stable relationship among users, institution and services

Connect. Communicate. Collaborate Interdomain: Different universities Alice might make use of the computer network at University B Alice will be authenticated by University A Alice will be authorized by University B, but making use of the attributes defined by University A Relationships are stable and long term Authorization information is represented using a common format University A University B Service Level Agreement

Connect. Communicate. Collaborate Interdomain: Heterogeneous systems Charles is authorized by University B upon the attributes defined by University C –Credentials are based on different formats –There are different criteria about syntax and semantics Therefore, it is necessary: –To define a credential conversion system, identifying its main entities and policies. University B Service Level Agreement University C

Connect. Communicate. Collaborate Overview Introduction Starting points Main goals of the DAMe project

Connect. Communicate. Collaborate Goal: –“open your laptop and be online” –To build an interoperable, scalable and secure authentication infrastructure that will be used all over the world enabling seamless sharing of network resources Concepts: –Based on reciprocal (free) access –NREN community –Authentication at home –Authorization at visited institution Starting point: eduroam

Connect. Communicate. Collaborate RADIUS server University B RADIUS server University A RedIris Central RADIUS Proxy server Authenticator (AP or switch) User DB Supplicant Alicia Student VLAN Commercial VLAN Employee VLAN data signalling Trust based on RADIUS plus policy documents 802.1X (VLAN assignment) Starting point: eduroam

Connect. Communicate. Collaborate Motivation: –Current authorization solutions do not address most of the issues related to the provision of different types of services based on attributes credentials –NAS-SAML was defined to provide a network access system based on existing standards (802.1X, AAA, SAML, XACML) –It requires the extension of the current AAA protocols in order to exchange authorization credentials –Different profiles are defined in order to provide several design alternatives (push and pull) Starting point: NAS-SAML

Connect. Communicate. Collaborate Starting point: NAS-SAML

Connect. Communicate. Collaborate NAS-SAML: Pull profile

Connect. Communicate. Collaborate Overview Introduction Starting points Main goals of the DAMe project

Connect. Communicate. Collaborate DAMe project. Overview Definition of a unified authentication and authorization system for federated services hosted in the eduroam network and a global SSO mechanism based on already deployed mechanisms and architectures.

Connect. Communicate. Collaborate Main goals of the DAMe project Extension of eduroam using NAS-SAML –User mobility is controlled by assertions and policies expressed in SAML and XACML Alicia RADIUS server University B RADIUS server University A RedIris Central RADIUS Proxy server Authenticator (AP or switch) User DB Supplicant data XACML Policy Decision Point SAML Attribute Authority Signaling XACML

Connect. Communicate. Collaborate Main goals of the DAMe project Extension of eduroam using NAS-SAML

Connect. Communicate. Collaborate Main goals of the DAMe project

Connect. Communicate. Collaborate Global Single Sign On (SSO) –Users will be authenticated only once, during the access to the network –A SSO token (eduGAIN compliant) must be distributed, validated, and managed by an appropriate middleware. –Possibly, new EAP methods (PEAP-based) will be needed to obtain the token Main goals of the DAMe project

Connect. Communicate. Collaborate Resource Access –The user authenticates in his home domain and gets a SSO token. –The token is delivered to the user through a secure tunnel. –The token contains a handle instead of the real user's identity to maintain privacy. –Later, when the user tries to access to a protected resource, he includes the token in the request. –The resource uses the handle included in the token to request the user's attributes through eduGAIN. –When received, the attributes are used to take the authorization decision. Main goals of the DAMe project

Connect. Communicate. Collaborate Resource Access

Connect. Communicate. Collaborate DAMe look forward in the integration of authentication and authorization process. The extension must be compatible with the current status of the eduroam network and eduGAIN Provide a SSO scenario based on bootstrapping credential at the authentication phase Additional will development a user-friendly interface for managing authorization policies. Conclusion

Connect. Communicate. Collaborate Additional information Project Web: – Thanks for attention