Web Application Authentication with PKI & Other Functions

1. Web Application Authenticationwith PKI & Other Functions Bill Weems & Mark B. Jones Academic Technology University of Texas Health Science Center at Houston

2. Ideally,  individuals would each like a single digital credential that can be securely used to authenticate his or her identity anytime authentication of identity is required to secure any transaction.

3. How do you prove you are who you say you are? • How do you know that someone is legitimate in his or her dealings with you, and how do you get redress if things go wrong? • If your identity is stolen and used fraudulently, or personal records are altered without your knowledge or permission, how do you prove that it was not you? • It is difficult enough to verify someone's identity in the tangible world where forgery, impersonation and credit card fraud are everyday problems related to authentication. • Such problems take on a new dimension with the movement from face-to-face interaction, to the faceless interaction of cyberspace. Identity and Authentication by Simon Rogerson

4. UTHSC-H Strategic Authentication Goals • Two authentication mechanisms. • Single university ID (UID) and password • Public Key Digital ID on Token (two-factor authentication) • Digital Signatures • Authenticates senders • Guarantees messages are unaltered, i.e. message integrity • Provides for non-repudiation • Legal signature • Encryption of email and other documents • Highly Secure Access Control • Potential for inherent global trust

5. Plug n Play Authentication • Programmatic Signed and Encrypted mail • Plug n Play authentication with JSP

6. Mailing List jdoe@uth.tmc.edujsmith@bcm.edugmarks@mhhs.org jdoe@uth.tmc.edu Signed&Encrypted User Specific Messages Automated Mailer jsmith@bcm.edu Request Recipient'sDigital Cert. LDAP Directory Service gmarks@mhhs.org Mass Mailing of Signed & Encrypted E-mail

7. Plug n Play Authentication <% request.setAttribute("authenticationMethod","certificate"); %> <% request.setAttribute(“authorizationGroup",“ADMIN_Staff"); %> <%@ include file="/jsp/auth/AuthX.jsp" %> • Application or Page level authX • Authentication Method (optional) • Password (default) • Certificate • Authorization Group (optional) • LDAP Group (with distributed group administration)

8. Plug n Play Authentication • Client requests a resource (URL) • Resource redirects to AuthX.jsp in cert. protected directory • Web Server • requests client certificate • Validates client certificate • Parses email address from certificate and looks up the user in the directory • Compares the client certificate to the ‘userCertificate’ stored in the directory based on the email address • Sets ‘Remote User’ to the ‘UID’ value from the directory • Allows client to access AuthX.jsp • AuthX.jsp • Retrieves the ‘Remote User’ variable and assumes successful authentication • Verifies that the user is in the authorization group if specified • Redirects back to the originally requested resource

9. Plug n Play Authentication Client Browser Request User Certificate HTTP Request Web Server Certificate Protected directory Resource (UserAdmin.jsp) AuthX.jsp Certificate Validation Directory