CIT’s Web Single Sign-on Service SRM Report CUWebAuth Investigation Identity Management Team OIT/CIT Security April 16, 2007

Topics Products in question Review how we arrived at this juncture Present results of our research in terms of service goals Make recommendation Obtain your support

Components: Web Single Sign-on CUWebAuth Software installed on individual web servers Enables the application’s use of CIT’s authentication service via SideCar OR CUWebLogin CUWebLogin Infrastructure component (two servers) Handles authentication on behalf of the web-based service

FebMarAprMayJun Kerberos 5 Upgrade: Where Are We Now? DecJanFebMarAprMayJunJulAugSepOctNovDecJan Campus Rollout Complete K4 Shutdown PS Student Launch You Are Here Discretionary migration window 6/14 Identity Management Rollout

FebMarAprMayJun Where Are We Now? DecJanFebMarAprMayJunJulAugSepOctNovDecJan Campus Rollout Complete K4 Shutdown PS Student Launch You Are Here Code review (4 code bases) Discretionary migration window 6/14 Identity Management Rollout

FebMarAprMayJun Where Are We Now? DecJanFebMarAprMayJunJulAugSepOctNovDecJan 6/14 Identity Management Rollout Campus Rollout Complete K4 Shutdown PS Student Launch You Are Here Code review (4 code bases) Security audit (new vulnerabilities) Discretionary migration window

FebMarAprMayJun Where Are We Now? DecJanFebMarAprMayJunJulAugSepOctNovDecJan 6/14 Identity Management Rollout Campus Rollout Complete K4 Shutdown PS Student Launch You Are Here Code review (4 code bases) Security audit (new vulnerabilities) Rollout requirements (PS launch) Discretionary migration window

FebMarAprMayJun Where Are We Now? DecJanFebMarAprMayJunJulAugSepOctNovDecJan PS Student Launch Campus Rollout Complete You Are Here K4 Shutdown Discretionary migration window 6/14 Identity Management Rollout Code review (4 code bases) Security audit (new vulnerabilities) Rollout requirements (PS launch)

FebMarAprMayJun Where Are We Now? DecJanFebMarAprMayJunJulAugSepOctNovDecJan PS Student Launch K4 Shutdown You Are Here Discretionary migration window 6/14 Identity Management Rollout Code review (4 code bases) Security audit (new vulnerabilities) Rollout requirements (PS launch) Campus Rollout Complete

FebMarAprMayJun Where Are We Now? DecJanFebMarAprMayJunJulAugSepOctNovDecJan PS Student Launch K4 Shutdown You Are Here Discretionary migration window 6/14 Identity Management Rollout Code review (4 code bases) Security audit (new vulnerabilities) Rollout requirements (PS launch) Campus Rollout Complete

FebMarAprMayJun Where Are We Now? DecJanFebMarAprMayJunJulAugSepOctNovDecJan PS Student Launch K4 Shutdown You Are Here window of opportunity Discretionary migration window 6/14 Identity Management Rollout Code review (4 code bases) Security audit (new vulnerabilities) Rollout requirements (PS launch) Campus Rollout Complete

The Reasonable Options CUWA/CUWL 1.5 – Attempt to fix what we have CUWA/CUWL 2.0 – Re-build it the way it should be Move to an outside solution -Yale CAS -Stanford WebAuth -CoSign

Service goals considered Impact of change on campus developer community Minimal work required to migrate to new versions Support for required functionality Predictability of user experience Long-term viability of CIT’s authentication solution for web- based services Performance and scalability as use of CUWA and CUWL increase Support for new server operating systems and web servers (Apache, IIS) Support for future enhancements to authentication and authorization Security of central authentication services Efficient use of scarce CIT resources

FebMarAprMayJun Recommendation DecJanFebMarAprMayJunJulAugSepOctNovDecJan 9/1 Identity Management Rollout PS Student Launch Develop CUWebAuth 2.0 CUWebAuth 2.0 Implementation Fall 2007 deployment Increase migration window Discretionary migration window K4 Shutdown Campus Rollout Complete Early Adopters

1. Why not go with CUWA 1.5? Condition of 8-year-old code has become a support burden Significant work required for even minor changes Impact of change on other portions of code difficult to test prior to release, results in more problems for campus service providers More bugs and security vulnerabilities as a result Currently requires 2 FTE’s Increasing campus dependency on CUWebLogin = scalability and performance issues SideCar limitations and scheduled retirement Preference for web-based applications

2. What do we get by writing CUWA 2.0? Product that is easier to maintain Simpler protocol Legacy dependencies eliminated Less code duplication (one code base instead of four) More extensible code (and all within local control) More secure protocol More scalable web single sign-on solution No loss of required functions and features Relatively minimal impact on campus developers

3. Will we have to give up other work? Overall development effort not much different -CUWA 1.5 estimated 23.8 FTE weeks -CUWA 2.0 estimated 25.6 FTE weeks CUWA 1.5 work requires the skill-set of four members of current IdM team CUWA 2.0 work will require skill-set of only two members of current IdM team CUWA 2.0 choice frees up skill set required for key projects like Active Directory, PS/STARS, Automated Provisioning, Grouper/Signet

4. Would an outside solution be smarter? Assessment is “no” based on more than 100 hrs of research Alternatives may offer short-term wins for IdM development team But would have significantly higher impact on user community Using these solutions off-the-shelf, without mods: -we give up features we currently have (ex: POST data support) -or we accept the same vulnerabilities we have with CUWA 1.5 Making mods to these outside solutions -may take as much or more time as re-writing CUWA 2.0 -requires unknown level of cooperation with other institutions -may cause entanglements and dependencies beyond our control

5. What are the longer-term implications? Lower maintenance cost, from 2 FTE’s to 1 Better security More predictable user experience Positions us better for future enhancements to authentication and authorization services Opportunity for open-source release

Summary Pros and Cons Webauth 1.5 Lowest short-term risk Limited benefit Webauth 2.0 Best long term solution Slightly more short- term work CAS Great java integration. Most expensive for the rest of campus. Security not great. Stanford Lowest deployment cost for Identity Management Complex infrastructure and missing features

Questions?

Identity Management