1. Web Application Authentication with PKI & Other Functions Bill Weems & Mark B. Jones Academic Technology University of Texas Health Science Center at Houston

2. Ideally, individuals would each like a single digital credential that can be securely used to authenticate his or her identity anytime authentication of identity is required to secure any transaction.

3. How do you prove you are who you say you are? How do you know that someone is legitimate in his or her dealings with you, and how do you get redress if things go wrong? If your identity is stolen and used fraudulently, or personal records are altered without your knowledge or permission, how do you prove that it was not you? It is difficult enough to verify someone's identity in the tangible world where forgery, impersonation and credit card fraud are everyday problems related to authentication. Such problems take on a new dimension with the movement from face-to-face interaction, to the faceless interaction of cyberspace. Identity and Authentication by Simon Rogerson

4. UTHSC-H Strategic Authentication Goals Two authentication mechanisms. –Single university ID (UID) and password –Public Key Digital ID on Token (two-factor authentication) Digital Signatures –Authenticates senders –Guarantees messages are unaltered, i.e. message integrity –Provides for non-repudiation –Legal signature Encryption of email and other documents Highly Secure Access Control Potential for inherent global trust

5. Plug n Play Authentication Programmatic Signed and Encrypted mail Plug n Play authentication with JSP

6. Mass Mailing of Signed & Encrypted E-mail Automated Mailer Mailing List jdoe@uth.tmc.edu jsmith@bcm.edu gmarks@mhhs.org jdoe@uth.tmc.edu Signed & Encrypted LDAP Directory Service Request Recipient's Digital Cert. User Specific Messages jsmith@bcm.edu gmarks@mhhs.org

7. Plug n Play Authentication Application or Page level authX Authentication Method (optional) –Password (default) –Certificate Authorization Group (optional) –LDAP Group (with distributed group administration)

8. Plug n Play Authentication Client requests a resource (URL) –Resource redirects to AuthX.jsp in cert. protected directory Web Server – requests client certificate –Validates client certificate –Parses email address from certificate and looks up the user in the directory –Compares the client certificate to the ‘userCertificate’ stored in the directory based on the email address –Sets ‘Remote User’ to the ‘UID’ value from the directory –Allows client to access AuthX.jsp AuthX.jsp –Retrieves the ‘Remote User’ variable and assumes successful authentication –Verifies that the user is in the authorization group if specified –Redirects back to the originally requested resource

9. Client Browser Web Server Certificate Protected directory HTTP Request Directory Resource (UserAdmin.jsp) Request User Certificate AuthX.jsp Certificate Validation Plug n Play Authentication