1. Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015
Non Web access
Technical session
15th-16th June 2015
Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

2. Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015
Why?
Currently Umbrella can only be used for web browser based access.
That’s perfect for WUO type access!
We aim to extend it to:
Data access (webdav ?, S3 ? Need your imput)
Analyses workstation access (PaNDaS like project)
SSH
Remote display …
These new usages are often not inside web browser.
15th-16th June 2015
Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

3. Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015
Our needs
Simple to use at least for the users
Federation – SP should never get access to pwd.
15th-16th June 2015
Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

4. Many solutions exists …
Modifications
Readiness
Scope
Moonshot
Client
Server
IdP
Yes
SSH
NFSv4
Owncloud
SSH Keys SP
Prototype ?
Ldap facade
Any LDAP compatible service (where pwd field sufficiently long)
SASL-SAML
Client (?)
Prototype (2012)
IMAP
Oauth2
Prototypes
WebDav …
15th-16th June 2015
Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

5. Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015
SSH Keys
Basic Workflow:
Users register their public key on their account on umbrellaid.org
The IdPs distribute the Key as part of the SAML metadata (other mechanism possible).
The SPs collect the keys (like for EAAHash) and populate authorized_keys (user home dir, ldap, …)
Users could connect with their umbrella username and private key
15th-16th June 2015
Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

6. More details/constraints
Provisioning: need to have usernames (from umbrellaid.org) in SP ldap probably with the same uidNumber and homeDirectory than the local user account to benefit from local account authorization).
Need for uid uniqueness in the case we also accept local login – Need to identify that accounts belongs to Umbrella.
Attributes update - Deprovisioning: SP need to validate that the account is still valid (automated asynchronous check on the IdP, SAML AssertionQuery profile) ?
15th-16th June 2015
Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

7. Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015
Pros/Cons
Pros:
Very simple for the users
Pragmatic solution – Mostly ready
Development cost very small
Cons:
Need to check asynchronously that user is still valid.
Potential uid collision in case local and umbrella account could login – need differentiator
Only valid for SSH authentication
15th-16th June 2015
Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

8. Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015
LDAP facade
In production at the bwIDM - Föderatives Identity Management Baden-Württemberg (KIT is part of it)
Slides from Marcus Hardt (KIT)
15th-16th June 2015
Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

9. Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015
LDAP Facade
Basic Workflow (Enhanced client)
Users authenticates with their web browser (websso profile) to SP
Users download the SAML assertion.
They use this assertion as password in their ssh client
The SSH server send the usename/password (assertion) to the LDAP façade.
The LDAP façade checks/accepts the username + assertion as valid login credentials and allows the user to log in
15th-16th June 2015
Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

10. Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015
Pros/Cons
Pros:
Relatively simple for the users
Pragmatic solution – Mostly ready
Development cost relatively small (Availability of the code for the LDAP façade?)
Could work with all services based on LDAP
Cons:
Potential uid collision in case local and umbrella account could login – could need differentiator
15th-16th June 2015
Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015

11. Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015
Technical team
Possible task and actions :
Refine the needs (SSH, RDP ? which one, Data Access ? which one) – action All
Setup 3rd/ /4th IdP – Action DESY/STFC+
Geo DNS and IdP session sharing
Prototype Non Browser Access :
Moonshot – Proposal to the Steering Committee for voting
SSH Keys - Prototype
LDAP Facade – Doris to get in touch with Marcus Hardt
Attribute management and release / attribute authority
Check addresses validity
Level Of Assurance – prototyping
Indico
15th-16th June 2015
Jean-François Perrin (ILL) - Umbrella Annual Meeting 2015