Slides from a tech talk I gave about SAML 2.0 and Liferay

1. Introduction to SAML 2.0
Mika Koivisto
Senior Software Engineer

2. Agenda
Introduction
SAML Concepts
Liferay and SAML 2.0
Demo

3. What is SAML?
Security Assertion Markup Language
XML based protocol
OASIS approved standard
SAML 1.0 November 2002
SAML 1.1 September 2003
SAML 2.0 March 2005
Flexible and extensible protocol designed to be used
by other standards

4. SAML Roles
Identity Provider (IdP) / Asserting party
Service Provider (SP) / Relying party
User

5. Advantages of SAML
Platform neutral
Loose coupling of directories
Improved online experience for end users
Supported by many SaaS applications
Increased security
Strong commercial and open source support

6. Use cases
Web Single Sign-On
Attribute based authorization
Identity Federation
WS-Security

7. SAML Concepts

8. Protocols
Authentication Request Protocol
Assertion Query and Request Protocol
Artifact Resolution Protocol
Name Identifier Management Protocol
Name Identifier Mapping Protocol
Single Logout Protocol

9. Bindings
HTTP Redirect Binding
HTTP Post Binding
HTTP Artifact Binding
SAML SOAP Binding
Reverse SOAP (PAOS) Binding
SAML URI Binding

10. Profiles
Web Browser SSO Profile
Enhanced Client and Proxy (ECP) Profile
Identity Provider Discovery Profile
Single Logout Profile
Assertion Query/Request Profile
Artifact Resolution Profile
Name Identifier Management Profile
Name Identifier Mapping Profile

11. Liferay and SAML 2.0
Available as a EE plugin
Supports two operation modes
Identity Provider
Service Provider
Built on top of OpenSAML
Uses Java keystore for credentials
Configured using SAML metadata and portal(-
ext).properties

12. Features
IdP initiated Web SSO
SP initiated Web SSO
SP initiated Single Logout
IdP initiated Single Logout
Consumes and Produces SAML Metadata
Attribute statement generation (IdP)
JIT provisioning using attribute statements (SP)

13. IdP Supported Bindings
Web Single Sign-On Profile
HTTP Redirect Binding (AuthnRequest)
HTTP Post Binding (AuthnRequest and Response)
Single Logout Profile
HTTP Redirect Binding (SP initiated only)
SAML SOAP Binding (IdP to SP only)

14. SP Supported Bindings
Web Single Sign-On Profile
HTTP Redirect Binding (AuthnRequest)
HTTP Post Binding (Response)
Single Logout Profile
HTTP Redirect Binding (SP initiated only)
SAML SOAP Binding (IdP to SP only)

15. SP initiated Single Sign-On

16. IdP initiated Single Sign-On

17. SP Initiated Single Logout

18. IdP Initiated Single Logout

19. Configuration - IdP
Create keystore with signing key
keytool -genkey -keyalg RSA -alias liferaysamlidpdemo -keystore keystore.jks -storepass liferay
-keysize 2048
Create portal-ext.properties
saml.enabled=true
saml.role=idp
saml.entity.id=liferaysamlidpdemo
saml.metadata.paths=
${liferay.home}/saml/salesforce.xml,
http://beta.test.com:9080/c/portal/saml/metadata
saml.keystore.type=jks
saml.keystore.path=${liferay.home}/data/keystore.jks
saml.keystore.password=liferay
saml.keystore.credential.password[liferaysamlidpdemo]=liferay

20. Configuration - SP
Create keystore with signing key
keytool -genkey -keyalg RSA -alias liferaysamlspdemo -keystore keystore.jks -storepass liferay
-keysize 2048
Create portal-ext.properties
saml.enabled=true
saml.role=sp
saml.entity.id=liferaysamlspdemo
saml.metadata.paths=http://localhost:8080/c/portal/saml/metadata
saml.sp.default.idp.entity.id=liferaysamlidpdemo
saml.keystore.type=jks
saml.keystore.path=${liferay.home}/data/keystore.jks
saml.keystore.password=liferay
saml.keystore.credential.password[liferaysamlspdemo]=liferay

21. Extension points
com.liferay.saml.resolver.AttributeResolver
com.liferay.saml.resolver.NameIdResolver
saml-spring.xml
com.liferay.saml.profile.SingleLogoutProfile
com.liferay.saml.profile.WebSsoProfile

22. Demo
SalesForce.com
Google Apps
Liferay Service Provider

23. Resources
http://saml.xml.org/saml-specifications
Liferay SAML plugin config reference
http://bit.ly/lrsamlplugin
Difficulties of Single Logout
https://wiki.shibboleth.net/confluence/display/SHIB2/
SLOIssues
Seamless Single Sign-On with SAML (salesforce)
http://www.youtube.com/watch?v=Gztz6h0LgA8

24. Thank You!