Identy Federation - Trends and Technologies
AFSecurity 2008-12-11
UNIK, Kjeller
http://wiki.unik.no/index.php/Infosec/AFSecurity
Certificate traffic hub (Samtrafikknav for sertifikater): Subproject#2-2009. FEIDE.
E-ID support organisation: Subproject#4.
From SSN to self chosen User ID - improvement.
Level3: No personal oppmøte.
Level4: Personal oppmøte.
Service providers:
AFSecurity 2008-12-11
UNIK, Kjeller
http://wiki.unik.no/index.php/Infosec/AFSecurity
1. Solutions and plans for ID management in the Norwegian public sector - Steinar Skagemo, DIFI
ID solutions:-
BuyPass card: Level 3-4
-
MinID: Level 3. Subproject#1-2008 (SMS OTP).
- BankID (OTP, server stored): Level 3-4
-
National ID card: Level 4. Subproject#3-2010. Tenders: Buypass, BankID (have frameworks corresponding to L4).
Certificate traffic hub (Samtrafikknav for sertifikater): Subproject#2-2009. FEIDE.
E-ID support organisation: Subproject#4.
From SSN to self chosen User ID - improvement.
Level3: No personal oppmøte.
Level4: Personal oppmøte.
Service providers:
- FIN, SKD
- Helse
- Kart, Tinglysing
- Brreg, Altinn
- Lånekassen
Sharing of attributes is included in SAML2.
NN: Can I choose preferred authentication method and whether to require re-authentiction instead of SSO?
SS: Thanks for question, will take note. (AR: Implement with attributes UserPreferredAuthenticationMethod and UserPrefersReauthentication.)
If session hijacking is a problem, then require re-authentication.
If session hijacking is not a problem, then prefer SSO.
ZI: Provisioning? (How to get devices out to users)
SS: PIN -> mail. Self registration.
PT: Use national E-ID for private sector?
SS: Not decided yet. (AR: Could be done for same or higher security levels)
T.Gulbrandsen, IBM: Responsibility? (lack of that killed PKI around 2000).
Identity Federation = SSO / Web / shared attributes / trust+info accross organizations / standards-based. Examples: MinID, Altinn, FEIDE.
1-2-3 SAML2 is the preferred flow:
1. User request to Service Provider (SP). SP checks if user has local session, if not, user is redirected to ID Provider (IDP). IDP returns login page.
2. User enters credentials, sends to IDP. IDP authenticates user and returns redirect page (containing no secrets) to SP through User.
3. SP calls IDP web service to verify that user is authenticated and to get additional attributes, and return Service Provider's service page.
ZI: How does user authenticate Service Provider and ID Provider?
AJ: Not included in SAML2. Does SAML help against Phishing? (e.g. a fake IDP or IDP MITM). No,it's done on the transport layer (SSL). Phishing can be solved by Pet name system. Other options: Use Firefox Trust Bar.
Phishing: paypa1.com looks almost like paypal.com, certificate looks OK. (AR: DNBN0R.com)
NN: Can I choose preferred authentication method and whether to require re-authentiction instead of SSO?
SS: Thanks for question, will take note. (AR: Implement with attributes UserPreferredAuthenticationMethod and UserPrefersReauthentication.)
If session hijacking is a problem, then require re-authentication.
If session hijacking is not a problem, then prefer SSO.
ZI: Provisioning? (How to get devices out to users)
SS: PIN -> mail. Self registration.
PT: Use national E-ID for private sector?
SS: Not decided yet. (AR: Could be done for same or higher security levels)
T.Gulbrandsen, IBM: Responsibility? (lack of that killed PKI around 2000).
2. ID federation and user control - Jonathan Scudder, Sun / UNIK / Uni Oslo
2.1 Intro
Federation = union of states united by a central (federal) government. Examples: USA, Schengen.Identity Federation = SSO / Web / shared attributes / trust+info accross organizations / standards-based. Examples: MinID, Altinn, FEIDE.
1-2-3 SAML2 is the preferred flow:
1. User request to Service Provider (SP). SP checks if user has local session, if not, user is redirected to ID Provider (IDP). IDP returns login page.
2. User enters credentials, sends to IDP. IDP authenticates user and returns redirect page (containing no secrets) to SP through User.
3. SP calls IDP web service to verify that user is authenticated and to get additional attributes, and return Service Provider's service page.
ZI: How does user authenticate Service Provider and ID Provider?
AJ: Not included in SAML2. Does SAML help against Phishing? (e.g. a fake IDP or IDP MITM). No,it's done on the transport layer (SSL). Phishing can be solved by Pet name system. Other options: Use Firefox Trust Bar.
Phishing: paypa1.com looks almost like paypal.com, certificate looks OK. (AR: DNBN0R.com)
Demo:
1. User selects Federation (Bighotels, Government Norway, FlyMe), then
2. User selects ervice (Defense, Tax office, Pension Fund)
3. User enters SSN and authenticates according to service level
4. User get access.
UNIK is an OASIS member.
SAML or other standards e.g. ISO (WS-FED, Shiboleth, ID-FF)? SAML2.
2.2 Federated ID's:
MinID:- protetcts MyPage (Min Side)
- PIN
- Government-to-cititzen
Altinn:
- various authentication methods
- government-to-business (primarily)
FEIDE:
- educational federation
- distributed authentication
Sikkerhetsportalen (BBS): Test system using BankID/Buypass worked. Payment agreements (who pays - user, SP?) Risk agreements? Failed.
AJ: Altinn lacks registration framework.
2.3 Who knows what?
IDP: Holds most info. business motivation.SP: Holds local details and important attributes
2.4 ID Dashboard
User's access to manage Federated ID's- Federations
- IDP's
- SP's
- Legal stuff
- Auto create account enabled?
- Attributes
- Permanently linked?
- Do you trust entity?
- Opt-out?
OpenID: Auth for social networks. Not for L4.
Next meeting: 2009-01-21. Speakers: IBM.
