1. June 9, 2009 SURFfederatie: implementing a multi- protocol federation Hans Zandbelt & Joost van Dijk, SURFnet

2. SURFnet. We make innovation work1 Overview -Identity Federation Models -SURFfederatie gateway -Implementation/Deployment -Features/Experiences -SURFnet Service Provider -Conclusion

3. SURFnet. We make innovation work2 Federation Models -1-1 -Business: SAML 1.x -de-facto -NxN -Shared trust, pt2pt -Education VS/Europe -Shibboleth -2xN -Central gateway (CFC) -Protocol translation -SURFfederation SURFnet = CFC, IDP, SP IDPSP IDPSP IDPSP IDPSP IDPSP IDPSP IDPSP CFC

4. SURFnet. We make innovation work3 Functional View Central Federation Components A-Select Cross Shibboleth SAML 2.0 WS-Fed / ADFS SAML 2.0 WS-Fed / ADFS Identity ProvidersService ProvidersSURFfederatie CORE Applications Credentials

5. SURFnet. We make innovation work4 Authentication Redirect Flow SPSFSIDP web service authentication backend browser request auth request SSO 1 request 2 SSO 2 request LDAP/Radius/.. access & attributes SSO 1 response 2 SSO 2 response auth response

6. SURFnet. We make innovation work5 Deployment View server1server2server3 phpFederate PingFederate management failover PingFed/Mgmt wayf.surfnet.nl sfs.surfnet.nl round-robin DNS phpFederate PingFederate PingFed/Mgmt

7. SURFnet. We make innovation work6 Server Node apache2 mod_fcgid php5_cgi phpFederate memcached (state sharing) mysql (logging) sendmail (error reporting) heartbeat2 (failover) pingFederate

8. SURFnet. We make innovation work7 Connections -Federation Protocols -IDP: -SAML 2.0 (5), ADFS (15), A-Select (10) -SP: -SAML 2.0 (5), Shibboleth 1.3 (5), A-Select (3) -Federation Products -Microsoft ADFS, Shibboleth (1/2), A-Select, Novell Access Manager, simpleSAMLphp, Oracle IdM, PingFederate

9. SURFnet. We make innovation work8 Implementation -PHP: -implementation programming language -metadata/configuration store -configuration and processing language -provisioning tool -Provision connections to PingFederate -Federate connections transparency across protocols (!= simpleSAMLphp); caveat: identifiers -IDPs “see” 1 SP; SPs “see” 1 or all IDPs -IDP ARPs: (configured) filter by SURFfederatie gateway

10. SURFnet. We make innovation work9 Features -Pure stateless switch vs. stateful processing gateway -Transparent vs. single-point-of-entry -Detailed and accurate logging/statistics -ARP and ACLs implemented in PHP -TBD: attribute processing/enrichment… -SP “personalized” IDP discovery and authorisation -Limited SP access for IDPs -EduGAIN, OpenID, InfoCard -Optional: management APIs for members (IaaS) -Metadata/configuration -ARP, IDP/SP authorisation

11. SURFnet. We make innovation work10 Experiences -Multi-protocol abilities speed up institutional deployment: fits in their home ICT environment (!= JAVA, = Microsoft) -Identity-As-A-Service: service provider issues (metadata updates, attribute release policies) are handled for IDPs -SAML 2.0 implementations are hard (specs/products/knowledge) -> slow SP take-up -Scalability is ok: up to national level -Trust model of centralized federation is functionally equivalent to distributed federations: federation- operator is TTP (signed responses vs. signed metadata)

12. SURFnet. We make innovation work11 Future Developments -Web-services (gateway as WS-Trust STS!) -Cross-layer identity (unified SSO) -Identity-as-a-Service extensions -User Centric privacy extensions: user consent -Geneva -SURFnet services: OpenID -Confederations: Kennisnet, EduGAIN

13. SURFnet. We make innovation work12 SURFnet Service Provider -SURFnet plays three roles in the SURFfederatie: -Federation operator, gateway -IDP, for SURFnet employees -SP, for services offered by SURFnet to federation members -Services are connected via a proxy -Proxy is running phpFederate

14. SURFnet. We make innovation work13 SURFnet Service Provider SURFnet Service Provider SURFfederatie gateway IDP SURFmedia SURFmailfilter SURFdomeinen SP IDP

15. Proxy benefits -Protocol translation: -Hook up any service using A- Select/Shibboleth/SAML/WS-Federation -Centralize features needed for all services: -Access Control -Attribute enrichment -Guest access to selected services -Migrating user data when users switch identity SURFnet. We make innovation work14

16. SURFnet. We make innovation work15 Guest access SURFnet Service Provider Guest IDP SURFfederatie IDP SURFmedia SURFmailfilter SURFdomeinen

17. SURFnet. We make innovation work16 Attribute enrichment SURFnet Service Provider SURFmedia SURFmailfilter SURFdomeinen SURFfederatie IDP attribute database attribute database Attributes

18. Current developments -OpenID Gateway: -SURFnet SP as OpenID RP (guest access) -SURFfederatie as OpenID Provider (requires user consent) -Federated Groups -Join people from multiple IDPs into groups -Centrally managed -Across multiple services -Federated directory -Step-up authentication (introduce second factor) -OTP per SMS -Mobile PKI (authN using private key on SIM) SURFnet. We make innovation work17

19. SURFnet. We make innovation work18 OpenID protocol handler SURFnet Service Provider OpenID Provider SURFfederatie IDP SURFmedia SURFmailfilter SURFdomeinen OpenID RP

20. SURFnet. We make innovation work19 Mobile PKI

21. SURFnet. We make innovation work20 Conclusions -Rapid deployment: 500.000 users -From gateway towards Identity-as-a-Service -Outlook: from use-once-a-month content towards every-day use hosted web applications