Liberty workshop, March 20th, Directorate of Public Roads office (Statens vegvesen vegdirektoratet) IT Architect Søren Peter Nielsen

Transkript

1 !" # $ Liberty workshop, March 20th, Directorate of Public Roads office (Statens vegvesen vegdirektoratet) IT Architect Søren Peter Nielsen

2 !

3 " # $ " % $ $

4 &''( ) *+' $, -. %) &+'$ #+/0 *+' 1 2* 1&''3 /+/0 4 +/0 %5! #+/0 &+'$ % 6*1&''7 8 &'*&

5

6 #+/0 *+' 9+('' 1 2:0&; :;7+((&< -&+:'&+&(7$.

7 #+/0 &+' Portal Layer Shared Services Authority Authority Self Service Solutions 0 = $$=

8 >$ 11? ><

9 ) Vision and Concept for borger.dk in 2012 What expects the citizen from the public sector in 2012? 12 hypothesises for 2012 Scenario workshops Research etc. Technical options Stakeholder dialogue IT Maturity at authorities Usability testing Personas Vision and Concept for borger.dk in 2008 What is possible in 2008? Define Core service Most utilized solutions Technology Time

10 *& Ahmad, 34, Nørrebro Anna, 27 Århus Birgit, 60, Korsør Bjørn, 64, Hjørring Christian, 19, Nakskov Helle, 42, Vejle Henrik, 25, Sønderborg Lars, 58, Svendborg Maria, 34, Østerlars Mehtap, 21, Albertslund Rikke, 18, Birkerød Peter, 33, Frederiksberg

11 # $ / $$ + Links and iframes WSRP-portlets JSR168-portlets

12 @$ A $ B

13 Authentication and SSO in the Portal - Bruger überportal Links and iframes Myndighedsportal A Myndighedsportal B

14 Authentication and SSO in the Portal - Bruger überportal og Vejviser Loginservice (IdP) Identity Provider (IdP) Service Provider (SP) SAML 2.0 for Links and iframes Myndighedsportal A Myndighedsportal B

15 > überportal WSRP Composition - Bruger Webservice Webservice Webservice is tougher WSRP Integration Model will describe tactical integration methods Identitty? Myndighedsportal A Service B Identity? Service C Identity?

16 A!# Serviceudbyder Projektleder Udvikler Etablér kontakt til portal-ejer Vælg integrationsform, tests mv. Udarbejd aftale med portalejer Udvikl service IdP IdP aftale Opmærk service Registrer service hos IdP Planlæg tests og staging Gennemfør tests og staging Godkend Go live for service Kontakt information Initiel rådgivning Test- og releaseplaner Tilslutningsaftale Integrationsrådgivning Testresultater Go live aftale Udviklingssupport Rådgiv om valg af integrationsfo rm mv. Rådgiv om integration Portal-ejer Account manager Etablér support til serviceudbyder Forbered QA- og produktionsmiljø Planlæg tests og staging Driftansvarlig Gennemfør tests og staging Go live for service Beslutningstager Godkend aftale med serviceudbyder Godkend Go live for service

17 0 % $ A%C A%9 C # C #!A %

18 Functionality in the first phase will basically be Web Single Sign On Loginservice Adgangspolitikker og evt. konti for eksterne brugere Adgangspolitikker Potential next phases: Delegation/Auth by Proxy ID based web services (Liberty concept) IdP in 2nd row Smarter Provisioning also an important issue Adgangspolitikker og evt. konti for eksterne brugere

19 % / $ 0 $ $ B

20 > /-. DD +/D /DE/D F D > &+' DD$$$++/D//D D D

21

22 ! #D #A, G E44EH /#+/ -. /" / + EBST Rødovre Kommune Sundhed.dk/IBM KMD Færdselsstyrelsen/IBM+CSC

23 I

24

25 @ /! /! / A!/1 J 0 K *+ LED /! J!/ &+,H DE/ / J :+ # A H K+,H / " J G HM! H// M / G///*&J!

26 @ J G =!!$= A /J %$&' InfoWorld - Portal aids development of identity-based apps OpenLiberty offers tools, libraries to build apps using Web services standards endorsed by Liberty Alliance

27 &!M% ID-WSF: The SP (acting as a WSC) uses IF-WSF to invoke services at the WSPs on Jane s behalf.. SAML2: The SP uses SAML2 to obtain the identity credential for Jane. SP/WSC WSP WSP ID-WSF SAML2 IdP DS WS-SX

28 !M%04$ M -M.1/D! M -M.1! -. 9 $/ $! /1$ ++!!L -.% <! -.$ M + -.!M% -!%%.+

29 L //J!! / A / J / //! / &+'< LG//// < G// / 1 H &+' A1#41AA1N

30 / /

31 Danish public sector shared service requirements for maintaining integrity of users identity in a gateway scenario Loginservice (IdP) Attribute Service SAML 2.0 Service Provider - Citizen - Private employee - Public employee Login Web or Local network SAML 2.0 Cert Auth Existing pin-codes uid/pw SAML 2.0 Gateway WS-FED token SAML 2.0 token - Public employee Login WS-federation w/ SAML 1.1.token Service Provider The desired gateway should allow service requesters to enter the federation using the WS-Federation specification and then convert the WS-Federation supplied token (presumably a SAML 1.1 token as user attributes also should be transferred) to a SAML 2.0 token Service Provider

32 Danish public sector shared service requirements for maintaining integrity of users identity in a gateway scenario requires High confidence in asserted identity's validity Loginservice (IdP) Attribute Service SAML 2.0 Service Provider - Citizen - Private employee - Public employee Login Web or Local network Cert Auth Existing pin-codes uid/pw SAML 2.0 SAML 2.0 requires Some confidence in asserted identity's validity Gateway - Public employee Login WS-federation w/ SAML 1.1.token Service Provider requires High confidence in asserted identity's validity The issue for the gateway scenario is when the service provider requires High confidence in asserted identity's validity. This requires the assertion to be signed at the point of origin. However, even if WS-Federation allows for signing the SAML 1.1 token this signature cannot be maintained when being converted to a SAML 2.0 token Service Provider

33 /

34 !M% M!O/// / SAML2: The SP uses SAML2 to obtain the identity credential for Jane. ID-WSF: The SP (acting as a WSC) uses IF-WSF to invoke services at the WSPs on Jane s behalf.. SP/WSC WSP WSP ID-WSF SAML2 IdP DS WS-SX

35 #!M% M!O/ / SAML2: The SP uses SAML2 to obtain the identity credential for Jane. ID-WSF: The SP (acting as a WSC) uses IF-WSF to invoke services at the WSPs on Jane s behalf.. SP/WSC WSP WSP ID-WSF SAML2 IdP DS WS-SX

36 4! Figur er lånt fra præsentation om Shibboleth-WS vs. WS-Shibboleth vs. SAML 2.0 SSO with Constrained Delegation by Francisco Pinto and Christian Fernau, 14 november 2005

37 4! 4G!G//&! Figur er lånt fra præsentation om Shibboleth-WS vs. WS-Shibboleth vs. SAML 2.0 SSO with Constrained Delegation by Francisco Pinto and Christian Fernau, 14 november 2005

38 4 / 4*! J J 4&! 4J J 4:!@HEJ J 4K! HEJ J P// / 1// E

39 / / 19 4*091/ J J 4&0 9#D/ 4J J 4:0 J 4K0 9%// 1# /H 1++ HEJ J )EG//// // /+ / /?L4 /D!G / H + / +