WSO2Con USA 2014 - Identity Server Tutorial

1. An open source
Identity and Entitlement Management Server
Prabath Siriwardena, Director of Security Architecture
Johann Nallathamby, Product Lead – Identity Server

2. An open source Identity & Entitlement
management server

3. Authentication
An open source Identity & Entitlement
management server
LDAP AD JDBC

5. Authentication
Single Sign On
An open source Identity & Entitlement
management server
SAML2 Kerberos WS-Fed Passive

6.  Decentralized Single Sign On
 Single user profile
 Widely used for community &
collaboration aspects
 Multifactor Authentication
[Infocard, XMPP]
 OpenID relying party components

7.  Single Sign On / Single Logout
 Widely used *aaS providers
[Google Apps, Salesforce]
 SAML2 Web SSO Profile
 SAML2 Attribute Profile
 Distributed Federated SAML2 IdPs
 Used in WSO2 StratosLive

8. SharePoint

9. Authentication
Single Sign On
Provisioning
An open source Identity & Entitlement
management server
SPML SCIM

12. 2003 : SPML 1.0
2006 : SPML 2.0
2003 : WS-Provisioning
2001 : OASIS PS TC
2011 : SCIM 1.0
2012 : SCIM 1.1
2011 : RESTPML
2010 : SCIM community

14. SCIM Service
Provider
/Users
SCIM Consumer /Groups

15. add-user.json
{
"schemas":[],
"name":{"familyName":”siriwardena","givenName":”prabath"},
"userName":”prabath","password":”prabath123",
"emails":[{"primary":true,"value":”prabath@yahoo.com","type":"home"},
{"value":”prabath@wso2.com","type":"work"}]
}
curl command
curl -v -k --user admin:admin -d @add-user.json --header "Content-Type:application/json"
https://localhost:9443/wso2/scim/Users

16. add-group.json
{
"schemas": ["urn:scim:schemas:core:1.0"],
"id": "idnext",
"displayName": "IdentityNext",
}
curl command
curl -v -k --user admin:admin -d @add-group.json --header "Content-
Type:application/json" https://localhost:9443/wso2/scim/Groups

18. Domain A
Provisioning
Service Provider
Domain B
One way provisioning
Provisioning
Service Provider
Provisioning
Service Provider
Domain C
SCIM Consumer

19. Domain A
Provisioning
Service Provider
Domain B
One way provisioning with broker mode
Provisioning
Service Provider
Provisioning
Service Provider
Domain C
SCIM Consumer

20. Domain A
Provisioning
Service Provider
Domain B
Bi-directional provisioning
Provisioning
Service Provider
Provisioning
Service Provider
Domain C
SCIM Consumer
SCIM Consumer
SCIM Consumer

21. Domain A
Provisioning
Service Provider
Domain B
Multi-directional provisioning with a centralized PSP
Provisioning
Service Provider
Provisioning
Service Provider
Domain C
SCIM Consumer
SCIM Consumer
SCIM Consumer
Provisioning
Service Provider

22. Domain A
Provisioning
Service Provider
Domain B
3
Just-in-time provisioning with SAML2
SAML2 IdP
1
2
4

23. Domain A
Provisioning
Service Provider
Domain B
3
Just-in-time provisioning with SAML2
SAML2 IdP
1
2
5
4

24. Provisioning
Service Provider
SCIM Consumer (wso2.com)
SCIM Consumer (facilelogin.com)
wso2.com
facilelogin.com

26. Authentication
Single Sign On
Provisioning
An open source Identity & Entitlement
management server
Auditing Delegation
WS-TRUST

32.  Identity Delegation
 Securing RESTful services
 2-legged & 3-legged OAuth 1.01
 XACML integration with OAuth
 OAuth 2.0 support with
Authorization Code, Implicit,
Resource Owner Credentials,
Client Credentials

33. Authentication
Single Sign On
Provisioning
An open source Identity & Entitlement
management server
Federation
Auditing Delegation
SAML2 WS-TRUST

34. Federation

35.  Supports WS-Trust 1.3/1.4
 SAML 1.0/1.1/2.0 token profiles
 Claim management

36. Security Token
Service
Consumer App
Resource
Domain A Domain B
Cross Domain Authentication with WS-Trust

37. Cross Domain Authentication with Kerberos and WS-Trust

38. Decentralized Federated SAML2 IdPs

39. Decentralized Federated SAML2 IdPs

40. Decentralized Federated SAML2 IdPs

42. Operators
Service Providers

43. Operators
Service Providers
SAML 2.0
OpenID Connect / SAML 2.0
OpenID Connect OpenID Connect

44. SAML 2.0
OpenID Connect / SAML 2.0

45. SAML 2.0
SAML 2.0
SAML 2.0
SAML 2.0

46. Operators
Service Providers

47. 1 Scenario - 1
http://ebuy.federationdemo.com:9766/ebuy/

48. 2
OpenID Connect
Request
Scenario - 1
1502808989

49. 3
OpenID Connect
Request
Scenario - 1

50. 4
< credentials >
Scenario - 1
User : tom_imobile
Password: tom_imobile

51. 4 Scenario - 1

52. 5
OpenID Connect
Response
Scenario - 1

53. 6
OpenID Connect
Response
Scenario - 1

54. 7 Scenario - 1

55. 1 Scenario - 2
http://azone.federationdemo.com:9766/azone/
9477808989

56. 2
OpenID Connect
Request
Scenario - 2

57. 3
SAML2.0 Request
Scenario - 2

58. 3
OAuth 2.0
Scenario - 2

59. 4
< credentials >
Scenario - 2

60. 4
OAuth 2.0 response
Scenario - 2

61. 5
SAML2 Response
Scenario - 2

62. 6
OpenID Connect
Response
Scenario - 2

63. 7 Scenario - 2

67. • Introducing a new service provider is extremely easy.
• Removing an existing service provider is extremely easy.
• Introducing an new identity provider is extremely easy.
• Removing an existing identity provider is extremely easy. You only need to remove
the identity provider from the identity bus.
• Enforcing new authentication protocols is extremely easy.
• Claim transformations.
• Role mapping.
• Just-in-time provisioning.
• Centralized monitoring and auditing.
• Introducing a new federation protocol needs minimal changes.

68. Role Based Access Control
An open source Identity & Entitlement
management server

69. Role Based Access Control
An open source Identity & Entitlement
management server
Attribute Based Access Control

70. Role Based Access Control
An open source Identity & Entitlement
management server
Attribute Based Access Control
Policy Based Access Control
XACML

71. Role Based Access Control
An open source Identity & Entitlement
management server
Attribute Based Access Control
Policy Based Access Control
SOAP
XACML / WS-XACML

72. Role Based Access Control
An open source Identity & Entitlement
management server
Attribute Based Access Control
Policy Based Access Control
SOAP
REST
XACML

73.  The de-facto standard for authorization
 XACML 3.0
 Support for multiple PIPs
 Policy distribution
 Decision / Attribute caching
 UI wizard for defining policies
 Notifications on policy updates
 TryIt tool

74. EntitlementService EntitlementPolicyAdminService
Policy Decision Point
Policy Cache
Decision
Cache
XACML
Engine
Extensions
Policy
Administration
Point
Attribute Finder
Extensions
Attribute Cache
Default Finder
LDAP
SOAP/Thrift/WS-XACML
SOAP

87.  User stores with LDAP/AD/JDBC
 Multiple user stores
 OpenID
 SAML2
 Kerberos
 Integrated Windows Authentication
 Information Cards
 XACML 2.0/3.0
 OAuth 1.0a/2.0
 Security Token Service with WS-Trust
 SCIM 1.1
 WS-XACML
 WS-Fed Passive