lunedì feb 15, 2010

Securing Web Service using Secure Token Service

A web service is an application that exposes some type of business or infrastructure functionality though a callable interface that is both language-neutral and platform-independent. The Web Services Security is widely available via two major specifications – WS-Security and Liberty ID-WSF Security. WS-Security specification is developed by the OASIS Security Committee and it is developed along with other WS-\* specifications such as WS-Trust, WS-Policy. Web Services Trust Language (WS-Trust) uses the secure messaging mechanisms of WS-Security to define additional primitives and extensions for security token exchange to enable the issuance and dissemination of credentials within different trust domains.

WS-Trust defines mechanisms for delegating authentication, authorization and user identity mapping/management to an authority called Security Token Service (STS) for a requestor to access a Web Service.

OpenSSO Enterprise implements security for web services as well as a Security Token Service to issue and validate security tokens to any third party clients.

This presentation gives an overview about Web Service Security and OpenSSO STS architecture.

venerdì ott 16, 2009

The Cube of Identity

Next week there will be the ICT Security Forum at Rome, and I'm preparing a speech for this event about "Identity in the Cloud: what's next trust level", where I'm going to talk about how the new paradigms as Web 2.0, Software as a Service (SaaS) and cloud computing have introduced new needs related the security and the privacy of the information and how digital identity is critical and success factor to manage authentication and authorization complexity in a distributed environment, and what kind of level of assurance can be reached.

With the prospective to give to the audience an harmonized unique graphic view of the most important open identity standard technologies, I've created a Cube.

The idea to use a Cube as representation of open Identity technologies was borne when I've studied the Venn of Identity with the goal to introduce OAuth protocol in the Venn graph. Discussing with Eve Maler about this opportunity, she suggested the need to separate the front-channel from back-channel, she also mentioned that she hadn't found a way to combine OAuth with the original Venn in a way she was happy, as you can see in the her recently publishing a Venn of Identity in web Service. I thought, this can be reachable with the front-face and back-face of a Cube!!  

As you can see in the above cube picture, each front-face have a corresponding back-face (i.e. OpenID->OAuth, SAML->Id-WSF, InfoCard->WS-\*) or if you rotate (imagine) the cube you can have different prospectives (inter-enterprise/SaaS, consumer, ect.).  There are also some other interesting aspects as adjacent property, related to create an hybrid system (See bootstrapping the Identity metasystem), that is, combining or chaining systems and enabling transaction between them (i.e SAML -> OpenID, InfoCard -> ID-WSF, SAML->OAuth). Is this a magic cube of Identity? Comment it ;)

These models/systems could open interesting opportunity for the Italian National Centre for IT in Public Administration (CNIPA) which is involved in defining a National Federated Identity Management system based on SAML2.0, implementing a user-centric mechanism used to authorize and control the access to application services over SPCoop (Public Cooperative System). 

mercoledì set 17, 2008

Fedlet: la federazione fatta semplice

La Fedlet semplifica il processo di federazione dell'identità digitale. Molto spesso accade che la fase d'inizializzazione di un processo l'identità federata ed in particolare la creazione del Circle-of-Trust (tra l'Identity Provider e il Service Provider) è reso complicato dalle operazioni di installazione delle componenti applicative di federazione, dalla configurazione degli stessi e dai test d'interoperabilità. Per facilitare questo aspetto fondamentale relativo alle operazioni di amministrazione, Sun Microsystems ha inventato la Fedlet che indirizza proprio l'esigenza di semplificazione delle attività di amministrazione in fase di startup e alla creazione del COT.

La Fedlet è un implementazione "lightweight" del protocollo di Single SignOn basato SAML2 (per i Service Provider), integrabile in un'applicazione web Java EE. La Fedlet è un nuova funzione di OpenSSO (Sun Federated Access Manager).

La Fedlet è estremamente leggera, è puo essere integrata all'interno dello strato applicativo del Service Provider, e fa in modo d'interagire con l'Identity provider attraverso la specifica SAML POST profile, con il quale è possibile propagare gli attributi degli utenti che fanno parte della SAML Response del IdP, che l'IdP invia alla Fedlet dopo l'operazione di autenticazione all'Identity Provider.

Per capire quanto è semplice e veloce il processo che realizza la Fedlet vi invito a guardare questo video.


Federated Identity Management, Security, Service Oriented Architecture


« giugno 2016