1. A-Select: Hitchhiking in authentication space Ton Verschuren Innovation Management – SURFnet – NL Ton.Verschuren@SURFnet.nl TERENA TF-AACE workshop, Stockholm, 26 November 2002

2. 2 Rationale for A-Select A-Select is a weblogin system like pubcookie Separation between authN and authZ Better security thru stronger (local) authN New authN methods shouldn’t bother apps We’re looking for authN means that users already have: hitchhiking! Differentiate between various levels of assurance

3. 3 A-Select overview Local A-Select Server A-Select Agent Application User Remote Authentication Service Providers Local Authentication Service Providers Remote A-Select Server UDB Filter

4. 4 Supported AuthN Service Providers (ASPs) V 1.1 (now): –IP address –U/p thru RADIUS –Internet banking (banking card) –SMS (mobile phone) V 1.2 (Nov/Dec): –LDAP V 2.0 (?): –SAML V n.n (?): –PKI

5. 5 Implementation A-Select server: Java –Apache + Tomcat Crypto: Cryptix –SHA1 hashes + RSA signatures Filters for Apache and IIS Memory cookies: –Ticket granting ticket (for SSO) –Application ticket Redirection to ASP UDB: –JDBC –LDAP (v1.2) SSL recommended but not required

6. 6 License model A-Select server & agent: free ASPs IP address and RADIUS: free ASPs SMS (and banking card): free for academic community Other ASPs: –Do-it-yourself, or –Contract our developers

7. 7 The Future of A-Select Benchmarking of “similar” products –Functionality –With APIs for ASPs –Price Your input is welcome!

8. 8 What’s next: standardising on APIs? Authentication Systems ? Back Office Authorisation Systems Applications webISO

9. 9 More info More on a-select.surfnet.nla-select.surfnet.nl –Functional & technical design + API –Demo Portal And now…a demo!