1. MAREK STĘPNIOWSKI
@mstepniowski

5. SINGLE SIGN-ON

9. Platforma Redakcyjna
redakcja.wolnelektury.pl
Redmine - zarządzanie projektami
redmine.nowoczesnapolska.org.pl

10. Platforma Redakcyjna
redakcja.wolnelektury.pl
Redmine - zarządzanie projektami
redmine.nowoczesnapolska.org.pl
Wolne Lektury
wolnelektury.pl
Wolne Podręczniki
wiki.wolnepodreczniki.pl
Blog
nowoczesnapolska.org.pl

11. • Kerberos
• LDAP
• Active Directory

12. “ We don’t need no
stinkin’ protocols!

13. • CAS
• OpenID
• OAuth

14. CAS
Jasig

16. redirect

17. Login: ________
Pass: ________

18. Login: marek
Pass: ********

19. redirect
(with token)

20. check token

21. yes no
marek

23. FEATURES
• Centralized - all passwords are stored in one place
• Subsequent logins can happen without user interaction
• Easy to implement

25. GATEWAY AUTH
(accessing public webpage)

26. GATEWAY AUTH
redirect

27. GATEWAY AUTH
redirect
(with token)
Note
We don’t show the login form,
even if the user is not logged in

28. GATEWAY AUTH
check token

29. GATEWAY AUTH
yes no
marek

30. GATEWAY AUTH
If authentication was succesful
serve the modified page

32. JAVASCRIPT AUTH

33. SINGLE SIGN-OFF

34. SINGLE SIGN-OFF
Sign off

35. SINGLE SIGN-OFF
But... It doesn’t scale!
Facebook uses delayed single sign-off:
• First cookie is long lived and keeps the user session
• Second cookie required to perform API calls is short lived and
needs to be refreshed using the first cookie
• Signing off from Facebook deletes both cookies

36. CAS 2.0

37. <cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
<cas:authenticationSuccess>
<cas:user>marek</cas:user>
</cas:authenticationSuccess>
</cas:serviceResponse>
Oh hai, XML!
<cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
<cas:authenticationFailure code="INVALID_TICKET">
Ticket ST-1856339-aA5Yuvrxzpv8Tau1cYQ7 not recognized
</cas:authenticationFailure>
</cas:serviceResponse>

38. <cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
<cas:authenticationSuccess>
<cas:user>marek</cas:user>
<cas:proxyGrantingTicket>
PGTIOU-84678-8a9d...
</cas:proxyGrantingTicket>
</cas:authenticationSuccess>
</cas:serviceResponse>
Oh hai, XML!
<cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
<cas:authenticationFailure code="INVALID_TICKET">
Ticket ST-1856339-aA5Yuvrxzpv8Tau1cYQ7 not recognized
</cas:authenticationFailure>
</cas:serviceResponse>

39. <cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
<cas:authenticationSuccess>
<cas:user>marek</cas:user>
<cas:proxyGrantingTicket>
PGTIOU-84678-8a9d...
</cas:proxyGrantingTicket>
<fullName>Marek Stępniowski</fullName>
<isAdmin>yes<isAdmin>
</cas:authenticationSuccess>
</cas:serviceResponse>
Oh hai, XML!
<cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
<cas:authenticationFailure code="INVALID_TICKET">
Ticket ST-1856339-aA5Yuvrxzpv8Tau1cYQ7 not recognized
</cas:authenticationFailure>
</cas:serviceResponse>

40. CAS 3.0

41. STUCK IN A LIMBO
Adds attribute exchange
(most clients implement it as an extension of 2.0)

42. • Django
https://github.com/zuber/django-cas-provider
https://github.com/zuber/django-cas-consumer
• Python
https://wiki.jasig.org/display/CASC/Pycas
• Ruby
http://code.google.com/p/rubycas-server/
http://code.google.com/p/rubycas-client/
+many more

43. The simplest single sign-on solution available
• Django
https://github.com/zuber/django-cas-provider
https://github.com/zuber/django-cas-consumer
• Python
https://wiki.jasig.org/display/CASC/Pycas

46. OpenID: ________

47. OpenID: stepniowski.com

48. stepniowski.com
redirect

49. stepniowski.com
Login: ________
Pass: ________

50. stepniowski.com
Login: marek
Pass: ********

51. stepniowski.com
redirect
(with token)

52. stepniowski.com
check token

53. stepniowski.com
yes|no

54. stepniowski.com

55. FEATURES
Strangely similar to CAS

56. FEATURES
• Decentralized - you don’t need to store passwords at all
• Single sign-on but not single sign-in
• Hard to implement - delegation requires an HTML parser

57. openid.sreg
openid.ax

58. 2.0

59. • Django
https://github.com/omab/django-social-auth
• Python
https://github.com/openid/python-openid
• Ruby
https://github.com/openid/ruby-openid
+many more

60. COMPARISON
CAS OpenID
• Centralized • Decentralized
• Single sign-on and sign-in • Only single sign-on
• Easy to implement • Hard to implement
• Attribute exchange (CAS 3.0) • openid.sreg and openid.ax
• Single sign-off • Single sign-off
• Gateway authentication • Browser extensions

62. ASK FOR IT
And I will create a separate presentation

63. MAREK STĘPNIOWSKI
@mstepniowski

64. WE’RE HIRING!
http://www.setjam.com/jobs/

65. DJANGOPIWO
Warsaw SetJam HQ
Wednesday
August 24th
@mstepniowski
@marcink
^marcinkaszynski