Extending the Oracle Single Sign On (SSO) Server Kurt Van Meerbeeck AXI NV/BV [email_address] www.axi.be www.axi.nl session 389

Yeah well ... and I WANT A PORSCHE

SSO workflow – not yet authenticated INFRA.axi.be MID.axi.be apache Mod_osso Mod_oc4j Mod_plsql J2ee apache Mod_osso Mod_oc4j Mod_plsql J2ee Oc4j_security oca OID LDAP IASDB http://my.company.com NameVirtualHost *:80 <VirtualHost *:80> ServerName my.company.com Port 80 # Include the configuration files # needed for mod_osso OssoConfigFile /OH/my_comp_osso.conf </VirtualHost> infra.axi.be/pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=<y> Partner cookie available ? SSO cookie ? -> Generate Redirect to logon page http://infra.axi.be/sso/jsp/login.jsp $OH/sso/policy.properties

SSO workflow – not yet authenticated INFRA.axi.be MID.axi.be apache Mod_osso Mod_oc4j Mod_plsql J2ee apache Mod_osso Mod_oc4j Mod_plsql J2ee Oc4j_security oca OID LDAP IASDB http://my.company.com

SSO custom logon screen INFRA.axi.be MID.axi.be apache J2ee SSO PLUGIN OID LDAP IASDB http://my.company.com apache J2ee OID LDAP PLSQL using OWA_UTIL $OH/sso/policy.properties http://infra.axi.be/pls/login_page Plsql Login_page What site do you want to enter ? ORASSO.WWSSO_UTL.unbake_site2pstore_token -> my.company.com Generate a different logon screen

Public Key Infrastructure Chain of trust Valid ? (CRL) Example of authenticatie United Nations US Belgium Me and my passport The nice officer at JFK And his passport

Public Key Infrastructure Chain of trust Valid ? (CRL) Example of authenticatie United Nations US Belgium Flanders region Walloon region If Belgium splits in the Flanders region and Walloon Region I will be screwed if the United Nations do not recognize them

Public Key Infrastructure - eID

Public Key Infrastructure - eID

SSO integration with PKI apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page Client certificate (OCA, eID) (private/public key in keystore) Root certificate Government CA Oracle CA Server Certificate Server Certificate Root Certificate Root Certificate SSL SSL

SSO integration with PKI – SSL terminator apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA

SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA OCA Digital certificate My.company.com Login.company.com ProxyPass /forms/ http://MID.axi.be:7782/forms/ ProxyPass /osso_login_success http://MID.axi.be:7782/osso_login_success ProxyPass /login/ http://INFRA.axi.be:7780/ ProxyPassReverse /forms/ http://MID.axi.be:7782/ ProxyPassReverse /sso/ http://INFRA.axi.be:7780/ ProxyHTMLURLMap http://INFRA.axi.be:7780 /login <Location /sso/> SSLVerifyClient require RequestHeader set SUBJECT &quot;%{SSL_CLIENT_S_DN}e&quot; </location>

SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA My.company.com Login.company.com Only need to enter SSO password Map certificate subject to SSO username

SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA OCA Digital certificate

SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA eID Digital certificate My.company.com Login.company.com ProxyPass /forms/ http://MID.axi.be:7782/forms/ ProxyPass /osso_login_success http://MID.axi.be:7782/osso_login_success ProxyPass /login/ http://INFRA.axi.be:7780/ ProxyPassReverse /forms/ http://MID.axi.be:7782/ ProxyPassReverse /sso/ http://INFRA.axi.be:7780/ ProxyHTMLURLMap http://INFRA.axi.be:7780 /login <Location /sso/> SSLVerifyClient require RequestHeader set SUBJECT &quot;%{SSL_CLIENT_S_DN}e&quot; </location>

SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA eID Digital certificate My.company.com Login.company.com <Location /sso/> SSLVerifyClient require RequestHeader set SUBJECT &quot;%{SSL_CLIENT_S_DN}e&quot; </location>

DIY federated authentication - workflow Plsql Login_page apache Apache 2.x RP Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO PLUGIN OID LDAP IASDB J2ee OID LDAP Portima Authentication server My.private-company.com Login.private-company.com Officeid/suboffice password

DIY federated authentication - workflow Plsql Login_page apache Apache 2.x RP Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO PLUGIN OID LDAP IASDB J2ee OID LDAP Portima Authentication server My.private-company.com Login.private-company.com Officeid/suboffice password Replaced with SAML v2 Federated Authentication In 2008 (integrated with Oracle SSO)

Architecture HTTP/S HTTP CA LB (linux vips ldirector) INFRA MID CRL HTTP HTTP SSL/RP (apache2) RP (apache2)

Questions [email_address]