SAML 1.1 and its uses in eduGAIN Stefan Winter - PowerPoint PPT Presentation

Fondation RESTENA euroCAMP 04 April 2006 SAML 1.1 and its uses in eduGAIN Stefan Winter <stefan.winter@restena.lu> 1

Outline  SAML 1.1 overview  Abstract operations vs. SAML profile  Abstract operations: changes since Architecture document  SAML 1.1 + eduGAIN profiles  general parts (common in all Request / Response)  Authentication  Home Location Service  Attribute Exchange  Authorisation 2

SAML 1.1 Overview  XML Schemas for  SAML Protocol (exchange of SAML messages)  SAML Assertions (information about entities)  Rules to use Schemas semantically correct  thorough definition of  Authentication assertions (NOT the authentication process itself!)  Attribute statements  Authorisation statements  SAML-the-language by itself doesn't do anything for you – you need to fill it with life 3

Abstract Operations vs. SAML profile  eduGAIN Architecture Document (GEANT2 DJ5.2.2) defined a set of abstract operations  four services:  Authentication assertions  Home Location Service  Attribute assertion exchange  Authorisation assertions  generic enough to be mappable to a variety of underlying protocols  mapping to SAML 1.1 profile only one “instantiation” of the abstract operations 4

Abstract Operations Changes since DJ5.2.2  Authentication  optional credential transport: defined, but is not going to be used  to implement, major changes in SAML 1.1 would be necessary → not implemented  Attribute Exchange  defined Shibboleth-compatible and extended mode  extended mode weakens trust model → only Shib mode used  Authorisation Service  still questionable: support “Recipient” abstract op? 5

SAML 1.1 Profiles general parts (Request) AO: RequestID required by SAML 1.1 <Request RequestID MajorVersion MinorVersion IssueInstant > 0..n <RespondWith> <S ignature> <Query> - XOR - <S ubjectQuery> - XOR - <AuthenticationQuery> type of service - XOR - <AttributeQuery> - XOR - <AuthorizationDecisionQuery> - XOR - <AssertionIDReference> - XOR - <AssertionArtifact> 6

SAML 1.1 Profiles general parts (Response) <Response ResponseID MajorVersion MinorVersion IssueInstant InResponseTo Recipient > <S ignature> AO:ResponseID AO:InResponseTo <S tatus> SAML: Success, Requester, Responder <S tatusMessage> <S tatusDetail> <S tatusCode Value=” ...” > <S tatusCode Value =” ...” > <Assertion MajorVersion MinorVersion AssertionID Issuer IssueInstant> AO: <Conditions> Success: AO Interfaces additional <Advice> Req | Resp: AO errorMessage Data <S ignature> 1..n <S tatement> - XOR - Success: AO Result <S ubjectS tatement> - XOR - Req | Resp: AO errorReason <AuthenticationS tatement> - XOR - <AuthorizationS tatement> Content of response - XOR - <AttributeS tatement> 7

SAML 1.1 Profiles Authentication Request <AuthenticationQuery AuthenticationMethod=” ...” > <S ubject> AO: AuthenticationMethod <NameIdentifier> - OR - AO: AuthenticatingPrincipal <S ubjectConfirmation> <ConfirmationMethod> <S ubjectConfirmationData> AO: AuthenticationType <KeyInfo> 8

SAML 1.1 Profiles Authentication Response <Assertion MajorVersion MinorVersion AssertionID Issuer IssueInstant> <Conditions> <Advice> <S ignature> 1..n <S tatement> AO: SubjectHandle - XOR - <S ubjectS tatement> <S ubject> - XOR - <AuthenticationS tatement> <NameIdentifier> - XOR - - OR - <AuthorizationS tatement> <S ubjectConfirmation> - XOR - <S ubjectLocality> <AttributeS tatement> ... <AuthorityBinding> AO: AttributeValueList 9

SAML 1.1 Profiles Home Location Service (this page intentionally left blank ;-) )  SAML 1.1 assumes that you know whom to ask for assertions  No such thing as a lookup service for authoritative assertion sources  SAML 2.0 allows this via metadata  eduGAIN had two choices  extend SAML 1.1 to do this  not use SAML 1.1 at all, out-of-band 10

SAML 1.1 Profiles Attribute Exchange Request: <AttributeQuery Resource=” ...” > AO: Resource <S ubject> AO: SubjectHandle <NameIdentifier> - OR - <S ubjectConfirmation> AO: HomeSite <ConfirmationMethod> <S ubjectConfirmationData> <KeyInfo> <AttributeDesignator> AO: AttributeNameList Response: Very similar to the assertion seen in the Authentication Response 11

SAML 1.1 Profiles Authorisation Requests <AuthorizationDecisionQuery Resource=” ...” > <Action Namespace=” ...” > 1..n AO: Resource <S ubject> AO: Action <NameIdentifier> - OR - <S ubjectConfirmation> <ConfirmationMethod> <S ubjectConfirmationData> <KeyInfo> AO: CacheReference <Evidence> 1..n <AssertionIDReference> - XOR - <Assertion MajorVersion MinorVersion AssertionID Issuer IssueInstant> ... AO: AttributeValueList, PolicyReference 12

SAML 1.1 Profiles Authorisation Responses <AuthorizationDecisionS tatement Resource Decision> <Action Namespace> 1..n <S ubject> AO: Resource AO: Result (*) <NameIdentifier> - XOR - <S ubjectConfirmation> <ConfirmationMethod> <S ubjectConfirmationData> <KeyInfo> <Evidence> 1..n <AssertionIDReference> - XOR - <Assertion MajorVersion MinorVersion AssertionID Issuer IssueInstant> 13

That's it  SAML is nothing more (and nothing less) than a thoroughly designed XML Schema with usage guidelines for semantics  flexible enough to handle complex scenarios  If you need to extend it, major changes are necessary Questions? 14