1 / 34

Web Authentication at Iowa

Web Authentication at Iowa. Ed Hill Software Developer The University of Iowa. Who Am I. Ed Hill (ed-hill@uiowa.edu) Software Developer at The University of Iowa Manager of the WDS Group in AIS Projects: ISIS, Admissions, Osiris, Budget, Hawk IRB, Various Elections, etc…

aurora
Download Presentation

Web Authentication at Iowa

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Web Authentication at Iowa Ed Hill Software Developer The University of Iowa

  2. Who Am I • Ed Hill (ed-hill@uiowa.edu) • Software Developer at The University of Iowa • Manager of the WDS Group in AIS • Projects: ISIS, Admissions, Osiris, Budget, Hawk IRB, Various Elections, etc… • Background: Java, Unix Web Camp - June 7th, 2004

  3. Agenda • Authentication 101 • Hawk IDs • Active Directory • Security Policies • UI Login Tools (passport) • What • Why • How • Q&A and Feedback Web Camp - June 7th, 2004

  4. Authentication 101 • Authentication – the mechanism that verifies that an individual is who they claim to be. • Typically done based on something known (password) • Authorization – the mechanism to determine whether or not to allow access to a particular resource or service Web Camp - June 7th, 2004

  5. Hawk IDs • A standard login ID used to access many different services around campus • Before Hawk ID, My login was edhill, ehill, ed_hill, hille, 48006NNNN, etc… • User friendly, readable, public Web Camp - June 7th, 2004

  6. Hawk IDs - Gotchas • Hawk IDs are not immutable • Hawk IDs are not unique over time • Hawk IDs are not 8 characters long, they are 30 characters long • Thought about your “special” accounts? What if someone has a hawkid of “root”, “admin”, etc… • Don’t use Hawk IDs as primary keys in your application (University ID is a better choice) Web Camp - June 7th, 2004

  7. Active Directory (AD) • Active Directory (AD) is a directory that supports Windows services and it the directory where the Hawk ID passwords are kept • Before AD and Hawk ID – chaos/anarchy • Post Hawk ID, Before AD – one login id, different passwords for each system • Post Hawk ID / AD – one login id, one password Web Camp - June 7th, 2004

  8. Active Directory (AD) - Gotchas • Accessible via LDAP or Kerberos • Login failure messages don’t reveal much • Synchronization among DCs • Multiple GCs, DCs, realms, ohh my… • Which domain “owns” a hawkid • The UPN • IOWA\edhill vs edhill Web Camp - June 7th, 2004

  9. Directories • When someone says “The Directory”, they can mean one of the following • Active Directory (AD) – Authentication, Windows services • Enterprise Directory Service (EDS) – protected LDAP directory that contains business data about people • White Page / Phonebook – LDAP directory that contains public/published information about people Web Camp - June 7th, 2004

  10. Security Policies • If you remember just one thing from this presentation… Web Camp - June 7th, 2004

  11. Security Policies • If you remember just one thing from this presentation… • I had nothing to do with the password expiration policy Web Camp - June 7th, 2004

  12. Security Policies • Strong passwords are enforced (min 6 characters, 2 alpha, 2 numbers, no parts of your name/hawkid) • Passwords should not be stored or sent via clear-text • Passwords expire after 180 days, can’t reset to a previous password • Proof of identity rules before administrator can reset a person’s password Web Camp - June 7th, 2004

  13. UI Login Tools - What • UI Login Tools (formerly called UI passport) provides an authentication service to web applications that sits on top of Active Directory and the UI security policies while insulating the web developer from the details • Uses Web based protocols: browser redirects, HTTP requests • Works with any web development technology: Java, PHP, ASP, Cold Fusion, Perl CGI, etc… Web Camp - June 7th, 2004

  14. UI Login Tools - Features • Provides a login page via SSL • Validates a user’s Hawk ID / password, communicates any errors to the user • Tells your application the Hawk ID of the person that just logged in • Possibly provides your application with EDS information about the person • Possibly provides Single Sign On (SSO) capabilities to your application Web Camp - June 7th, 2004

  15. UI Login Tools - Features • Provides an administrative password reset and other utility tools • Can provide a custom login page with your own look and feel • Provides a complete audit trail of logins, password changes, etc… Web Camp - June 7th, 2004

  16. UI Login Tools - Applications • ISIS, Prof Asst, HR Portal, Mars, Osiris, PCard, PReqs, Skillsoft, Infobank, etc… Web Camp - June 7th, 2004

  17. UI Login Tools - Why • 15 mid-large applications requiring logins • Inter-application trust (ISIS and HR portal) • No two departments use the same web development technology • Microsoft passport – marketing baggage, doesn’t scale down • Sun’s passport killer – Liberty something… • Yale’s Central Authentication Service (CAS) Web Camp - June 7th, 2004

  18. UI Login Tools – How • Key Concepts – 3 actors • The user/browser • Your web application • The login tools application • Browser redirects • Authentication ticket • Cashing in the authentication ticket • HTTP request from your app to the login tools Web Camp - June 7th, 2004

  19. UI Login Tools – The Picture • Prepare to be stunned by my incredible artistic skills Web Camp - June 7th, 2004

  20. Login Tools Your Site AD UI Login Tools – The Picture Bob Web Camp - June 7th, 2004

  21. Login Tools Your Site AD UI Login Tools – The Picture 1 Bob Step 1: Bob comes to your site for the first time to start a session Web Camp - June 7th, 2004

  22. Login Tools Your Site AD UI Login Tools – The Picture 1 2 Bob Step 2: You detect the person doesn’t have a session established and you redirect them to the login tools login page, passing along your service URL Web Camp - June 7th, 2004

  23. Login Tools Your Site AD UI Login Tools – The Picture 1 2 Bob Step 3: The user’s browser takes the redirect request from your site and sends them to the login tools web server 3 Web Camp - June 7th, 2004

  24. Login Tools Your Site AD UI Login Tools – The Picture 1 2 Bob Step 4: The login page is returned to Bob’s browser (either the generic one, or your custom login page) 3 4 Web Camp - June 7th, 2004

  25. Login Tools Your Site AD UI Login Tools – The Picture 1 2 Bob Step 5: Bob type in his correct Hawk ID and Hawk ID password in the fields on the login page and presses the Sign In button 5 3 4 Web Camp - June 7th, 2004

  26. Login Tools Your Site AD UI Login Tools – The Picture 1 2 Bob Step 6: Bob’s password is verified via AD, a redirect is sent back to Bob to the service url provided along with a uip_ticket param 6 5 3 4 uip_ticket Web Camp - June 7th, 2004

  27. Login Tools Your Site AD UI Login Tools – The Picture 7 uip_ticket 1 2 Bob Step 7: Bob’s browser takes the redirect and sends the uip_ticket back to your web site to the service url you provided 6 5 3 4 Web Camp - June 7th, 2004

  28. Login Tools Your Site AD UI Login Tools – The Picture 7 8 1 2 Bob Step 8: Your site takes the uip_ticket and connects to the Login Tools to cash it in to find out who the ticket belongs to 6 5 3 4 Web Camp - June 7th, 2004

  29. Login Tools Your Site AD UI Login Tools – The Picture 7 8 hawkid=bob 1 2 9 Bob Step 9: The login tools take the ticket you Provide and return you a simple text web Page that contains Bob’s Hawk ID 6 5 3 4 Web Camp - June 7th, 2004

  30. Login Tools Your Site AD UI Login Tools – The Picture Bob’s session cookie 7 Bob’s session 10 8 1 2 9 Bob Step 10: Your site creates a session for Bob and sends back your home page along with any persistence cookies you need 6 5 3 4 Web Camp - June 7th, 2004

  31. Your Site UI Login Tools – The Picture Bob’s session Bob Step 10+N: Any further requests are just Processed from your site, checking Bob’s Session information. No further interaction With the login tools are needed Web Camp - June 7th, 2004

  32. UI Login Tools • You can leave now and plug into the login tools without any involvement from me • To create a custom login page, You will need to send me your service url and point me at a login page template Web Camp - June 7th, 2004

  33. Next Steps • Improve Create some documentation • Figure out SSO better (how best to handle and communicate logouts) • Better service provider management tools – make it so you can more easily update your own login pages, service URLs, etc… • SAML interface, other XML standards. • Your suggestions? Web Camp - June 7th, 2004

  34. Questions? • http://login.uiowa.edu/ • http://hawkid.uiowa.edu/ • http://cio.uiowa.edu/policy/ • Email address: ed-hill@uiowa.edu Web Camp - June 7th, 2004

More Related