1. Karyn Higa-Smith, DHS S&T Program Manager, Identity & Privacy Anil John, JHU/APL Technical Lead, DHS S&T IdM Testbed September 29, 2009 OASIS Identity Management 2009

2. Project Timeline Project Deliverables Project Guiding Principles Profile Information – Supported attribute exchange models – Metadata requirements COTS Vendor Support Next Steps Agenda 2

3. Meeting between DHS S&T and DoD DMDC to discuss IdM topics [Sept 2008] BAE PoC Project kick-off [Oct 2008] Project Team (DHS & DoD) tel-cons every two weeks Beta BAE reference implementations based on initial profile work [1Q09] Reference implementations & Profile v1.0 DRAFT [June 2009] Interoperability Testing Project Timeline 3

4. Profiles are not standards; they are built on top of existing standards Guidelines and tests for interoperability A set of named specifications at specific revision levels, together with a set of implementation and interoperability guidelines recommending how the specifications may be used to develop interoperable capabilities What is a “Profile”? 4

5. What is a BAE? - Backend Attribute Exchange (BAE) Agency A User w/ PIV Card Agency B Resource (Web Site / Application) Auth. Attribute Store 1 Auth. Attribute Store 2 Agency A Attribute Broker Agency B Attribute Broker 1.Agency A user needs access to or information from Agency B 3.Agency B needs “off-card” info to authorize User A to access resource. It “asks” its own Attribute Authority B 4.Agency B and Agency A communicate to exchange user information about User A The BAE codifies, at the Federal Level, the technical rules and protocols needed to exchange User Information between Agency A and Agency B 2.User A is Authenticated 5. 5

6. SAML V2.0 deployment profiles for BAE as well as informative information on lessons learned, implementation guidance and recommendations Proof-of-Concept BAE reference implementations, using synthetic data, stood up within the T&E environments of both DHS S&T and DoD DMDC to facilitate interoperability testing Test suites to verify BAE profile compliance Project Deliverables 6

7. Don’t reinvent the wheel! Leverage existing standards work (OASIS, W3C etc.) Keep the delta’s between existing standards and this work to the minimum & unclassified! Awareness of agency specific work (DOD JEDS, IC UAAS etc.) but focus on needs of the Inter-Agency Community (w/ future extensions to support the Non-Federal Community) Allow for future alternate subject identifiers w/o impacting protocol/security sections of profile Allow for ease of implementation/leverage via multiple approaches and technologies Support conformance testing Engage with COTS vendor community to encourage out of the box support for profile in products Project Guiding Principles 7

8. SAML Subject Profile - Federal Agency Smart Credential Number (FASC-N) 8 The value of the element MUST be the character representation of the FASC-N. The FASC-N character representation MUST be 32 characters in length and will not include character representations of the start sentinel, end sentinel, field separators and the LRC. The character representation MUST be in the order as shown in Fig 5 of the [PACS], excluding start and end sentinels, field separators and the LRC. Missing values MUST be filled with zero's if the value is unknown or not set.

9. BAE Profile Scope SAML Metadata (All BAEs) 1.Org EntityID 2.Encryption/Signing certificate 3.Supported Profiles/Attributes 4.Org BAE URL Supported BAE Model 1 – Direct Attribute Exchange Org A-1 Attribute Authority Org A-2 Attribute Authority Org B-1 Attribute Authority Org B-2 Attribute Authority Dept B BAE Broker Dept A BAE Broker SAML Metadata (All BAEs) 1.Org EntityID 2.Encryption/Signing certificate 3.Supported Profiles/Attributes 4.Org BAE URL SSL Communication secured per Org policy Attribute Requester System A Attribute Requester System B 9 BAE CA Issues X.509 Certs to BAEs Issues EntityIDs to BAEs CN of BAE Cert = EntityID Metadata Service

10. BAE Profile Scope SAML Metadata (All BAEs) 1.Org EntityID 2.Encryption/Signing certificate 3.Supported Profiles/Attributes 4.Org BAE URL Supported BAE Model 2 – Brokered Attribute Exchange Org A Attribute Authority Dept B BAE Broker Dept A BAE Broker SSL Communication secured per Org policy Attribute Requester System C Dept C BAE Svc Org C AA Org B Attribute Authority Communication secured per Org policy Attribute Requester System D Dept D BAE Svc Org D AA SAML Metadata (All BAEs) 1.Org EntityID 2.Encryption/Signing certificate 3.Supported Profiles/Attributes 4.Org BAE URL 10 BAE CA Issues X.509 Certs to BAEs Issues EntityIDs to BAEs CN of BAE Cert = EntityID Metadata Service

11. Metadata (SAML v2) – The Source of All Good Things! … Unique Identifier of BAE Broker (OC & OI) Signing & Encryption Certificates URL of BAE Broker Supported Subject Identifier Type(s) Digital Signature (AuthN & Integrity) 11

12. Metadata (SAML v2) – Cont’d … Supported Profile(s) Supported Attributes Contact Information 12

13. Web Services/SOA/XML Security – Layer 7 - http://www.layer7tech.com POC: Adam Vincent, Public Sector CTOhttp://www.layer7tech.com – Vordel - http://www.vordel.com POC: Mark O’Neill, CTOhttp://www.vordel.com Entitlement/Privilege Management (PDPs) – BiTKOO – http://www.bitkoo.com POC: Doron Grinstein, CEOhttp://www.bitkoo.com Federation – Covisint - http://www.covisint.com POC: Roger Lamberthttp://www.covisint.com Ongoing discussions with others… COTS Vendor Support - To Date 13

14. Federal CIO Council ICAMSC Federation Interoperability Working Group is currently working the following open issues: BAE CA & entityID assignment process – Recommendation: BAE certificate generation and entityID assignment managed by same entity – Recommendation: CN of Signing/Encryption Cert == entityID Metadata distribution and management – Centralized – Distributed Federation Agreement for BAE participants Next Steps 14

15. DHS Karyn Higa-Smith, DHS S&T Karyn.Higa-Smith@dhs.gov Deborah Gallagher, DHS OCIO Lauren Davis Anil John Christopher Obremski Thomas Smith Maria Vachino Chi Wu Points of Contact & Project Team DOD Lynne Prince, DOD DMDC Lynne.Prince@osd.pentagon.mil Darroll Love Larry Fobian Abhijit Jadeja Joseph Pini 15

16. 16