Authentication and Authorization in Web Systems

1. Authentication and Authorization in Web Systems Zhenhua Guo Jun-30-2009

2. Outline • Background • Terminology • Cryptography • REST, Web 2.0, Social Network • Authentication • Authorization • Conclusion

3. Terminology • Authentication • Authorization • Confidentiality • Integrity • Non-repudiation • Single Sign-On • Delegation

4. Cryptography encrypt decrypt clear text encrypted text clear text • Shared-key cryptography • DES, 3DES, AES • Public-key cryptography • RSA, DSA • Digital Certificate • Bind an entity’s identity with a public key • Certificate Authority • Public Key Infrastructure

5. REST - REpresentational State Transfer • Each resource is identified by a unique ID. • Stateless communication • Link resources together • Resources have multiple representations • Based on HTTP

6. Web 2.0 • Read-write collaborative web • Participatory nature • Cooperate, not control • … Cooperate, Participate, Collaborate  Social Network

7. Social Network • Science collaboration • OpenSocial • APIs for web-based social network apps • MySpace, Orkut, Ning…

8. Security Challenges in WWW • Loosely coupled components • Separation of security policies and security mechanisms. • No single, isolated trusted base • Domain-specific policies • …

9. Outline • Background • Authentication • Identity Federation • HTTP Auth, SSL • Central Authentication Service • OpenID • Authorization • Conclusion

10. HTTP Basic Auth • Allow browser to provide credential when making a request. WWW-Authenticate: Basic realm="Secure Area“ Username: Aladdin Password: open sesame Aladdin:open sesame Base64 Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ== Drawback: Clear text HTTP Digest Access Auth

11. SSL/TLS End-to-End message protection protocol Features • Use both shared-key cryptography and public-key cryptography. • Authentication • Key exchange • Confidentiality • Integrity • Non-repudiation • Prevention of replay attack

12. Identity Federation • Data across multiple identity management systems can be joined.

13. Central Authentication Service https://cas.iu.edu/cas/login?cassvc=ANY&casurl=https://onestart.iu.edu/my2-prd/Login.do?__p_dispatch__=login https://onestart.iu.edu/my2-prd/Login.do?__p_dispatch__=login&casticket=ST-26434-krE7MK7qkv1CcXrfBPLT-wsa453.uits.indiana.edu

14. CAS • Use HTTPS to guarantee confidentiality and integrity. • Advantages • Simplicity • Single Sign-On (ticket-granting cookie) • Drawbacks • Single point of failure • ID federation

15. discovery OpenID relying party Association

16. OpenID • How to discover Identity Providers? • The Relying Party uses the Identifier to look up the necessary information for initiating requests • Solution • XRI • Yadis • HTTP-Based discovery • How to share user attributes beyond authentication? • Solution • Simple Registration Extension • Attribute Exchange

17. OpenID – Drawbacks • If username and password of a user are stolen or phished, then all of the registered sites then become targets. • Quality of OpenID providers varies.

18. Kerberos vs. CAS vs. OpenID

19. Outline • Background • Authentication • Authorization • Access Control • Grid Security Infrastructure • Shibboleth • OAuth • Conclusion

20. Access Control • Access Control List • A list of permissions are attached to an object. • Role-Based Access Control • permissions → roles • roles → users • Access Control Matrix • characterizes the rights of each subject with respect to every object in the system • …

21. Architecture (local site) VS: validation servicePEP: policy enforcement pointPDP: policy decision pointAR: attribute repository

22. Architecture - Push mode (in distributed systems) VS: validation servicePEP: policy enforcement pointPDP: policy decision pointAR: attribute repository AA: attribute authority

23. Architecture - Pull mode(in distributed systems) VS: validation servicePEP: policy enforcement pointPDP: policy decision pointAR: attribute repository AA: attribute authority

24. GSI (Grid Security Infrastructure)

25. GSI • Based on X.509 PKI • Every entity involved in the Grid has an X.509 certificate • Each site trusts the CAs it wants • Each Grid transaction is mutually authenticated • Authorization is enforced using local policies. • Global ID (certificate DN) is mapped to local ID

26. GSI Features • Proxy Certificate (rfc3820) and Delegation • A temporary credential is generated for the user proxy • Delegation is indicated by user signing the temporary certificate with a secret. • Single Sign-On • Identity Mapping and Authorization • Global identity is mapped to a local identity before local identity is used to enforce policies "/C=US/O=Globus/O=ANL/OU=MCS/CN=Ben Clifford” benc "/C=US/O=Globus/O=ANL/OU=MCS/CN=MikeWilde” wilde

27. GSI - Drawbacks • Granularity of delegation • All or none • Infrastructure cost

28. Shibboleth - Flow Assertions Attribute Query

29. the user is an IU student Shibboleth - Example • InCommon “more than 3 million end-users” Authentication

30. OAuth - Features • A third party app can access user’s data stored at service provider without requiring username and password. • Delegated authorization protocol • Explicit user consent is mandatory. • Light-weight

31. Third-party application OAuth - Flow

32. Your google calendar data is: Would you like the third party app to access your Google Calender data??? Google Calendar Third-party application

33. OAuth - Drawbacks • Delegation granularity • Error handling • Token expiration and revocation

34. GSI vs. CAS* vs. Shibboleth vs. OAuth CAS: Community Authorization Service

35. Research Opportunities • Authorization granularity • Trust management

36. Questions?