State of Nebraska uses Identity-Driven Federation to Eliminate Boundaries for Citizens

Steven Hartman

Director, Nebraska Directory Services

State of Nebraska

Mission Statement

To serve the citizens of Nebraska by providing premier information technology leadership, policy and operations which facilitate an effective, responsive and efficient government.

Vision Statement

That the right people have access to the right data from anywhere, at anytime, from any device.

Business Drivers
Why use Federated Identities?

Business Rational

A number of the entities we wish to join with are ‘outside’ of our control.

E.g. Insurance companies, hospitals, banks, etc…

The amount of data scrubbing to synchronize users is extremely slow and costly.

Privacy concerns over sharing user data

Speed to implement external applications

The design concept of a ‘Über’ directory has many flaws.

Federated Identity
Terminology

Goals

Provide open standard and business guidelines for federation identity management spanning all network devices.

Provide open and secure standard for SSO with decentralized authentication and open authorization.

Allow consumers/businesses to maintain personal information more securely, and on their terms.

Key Concepts

Federation

The act of establishing a relationship between two entities, and association comprising any number of Service Providers and Identity Providers.

Principal

a person or ‘user, a system entity whose identity can be authenticated.

IdP (Identity Provider)

a service which authenticates and asserts a Principal’s Identity.

Single Sign-On (SSO)

the Principal’s ability to authenticate with one system entity (Identity Provider) and have that authentication honored by other system entities, often Service Providers.

Key Concepts

Circle of Trust

a group of service providers and identity providers that have business relationships and operational agreements with whom users can transact business in a secure and apparently seamless environment. Circles of Trust represent the second wave of identity federation, after SSO and federated account linking.

DS (Discovery Service)

a service which provides Identity based upon discovery of Web Service Providers.

Key Concepts

IS (Identity Service)

a service invoked through or with a user’s identity

Pseudonyms

are arbitrary names assigned by the identity or service provider to identify a Principal to a given relying party so that the name has meaning only in the context of the relationship between the relying parties.

Anonymity

enables a service to request certain attributes without needing to know the user’s identity. For example, in order to provide personalized weather information based upon a user’s zip code.

Key Concepts

Assertion

is a piece of data produced by a SAML authority regarding an act of authentication performed on a Principal, attribute information about the Principal, or authorization permissions applying to the Principal with respect to a specified resource.

SAML

is an XML standard for exchanging authentication and authorization data newteen security systems.

User Benefits

Convenience

Single Sign-On: seamlessly move between services with less data entry

Any device & access method

Personalized experience via permission-based attribute sharing

More Services

Privacy & Confidence

Lower Costs

Standardized interface accelerates time-to-market

Improved authentication reduces identity fraud and allows more services

Users set privacy controls

Users control service federation

Users decide what data is shared

Pseudonyms prevent collusions between providers

One-time identifiers allow anonymous access

Lower cost-of-business translates to lower prices

Economy of scale: worldwide market increases competition... improving price

Key Points

Consumers will:

Trust companies with whom they do business

Control their own personal information

Have one identity that is device agnostic

Organizations will:

Work closely and more efficiently with business partners

Deploy compelling services quickly, easily, and at a lower cost

Generate more revenue

Comply with privacy and security regulations

Federated Identity Architecture
Who, what, when, where and how?

User connects to IDP and authenticates

User

IDP

Enter URL,

Connect to IdP

Authentication

Request

User

authentication

(e.g. ID and

password

Web page is

displayed

Authentication

Check

Identity

Provider

User goes to IdP of

his/her choosing and

authenticates him/herself.

For example, using

UserID and password

Other

Authentication

methods are

possible

SP

Resource used: http://www.projectliberty.org/resources/tutorial_draft.pdf

User chooses an SP

User

IDP

Authentication

Request

Authentication

Request

(redirect)

Identity

Provider

SP can specify

the authentication

level it requires

User

authentication

requests results in

redirect to IdP

HTTP Redirect

Service

Provider

SP

Resource used: http://www.projectliberty.org/resources/tutorial_draft.pdf

SP

User redirected to IDP based on authentication request from SP

User

IDP

Authentication

Request

(redirect)

Identity

Provider

Service

Provider

Assertion is

generated if user

is authenticated

and identity at the

SP is federated

Authentication

Assertion

Issued

If user is

not already

authenticated at

IdP then initial

authentication

is performed

Issuance of

Authentication

assertion

Resource used: http://www.projectliberty.org/resources/tutorial_draft.pdf

IDP issues an authentication assertion

User

SP

IDP

Identity

Provider

HTTP Redirect

Service

Provider

Authentication

Assertion

Issued

Authentication

Assertion Sent

Authentication

Assertion sent

Authentication

Assertion sent

(SOAP)

Authentication Assertion sent

(redirect)

Secure

communication

channel (SSL) is

required

Resource used: http://www.projectliberty.org/resources/tutorial_draft.pdf

Authentication assertion sent from IDP to SP

User

SP

IDP

Authentication Assertion sent

(redirect)

Identity

Provider

HTTP Redirect

Service

Provider

Authentication

Assertion

Issued

Authentication

Assertion sent

Authentication

Assertion sent

(SOAP)

Secure

communication

channel (SSL) is

required

Authentication

Assertion Sent

Resource used: http://www.projectliberty.org/resources/tutorial_draft.pdf

Single Sign-on

Service

Provider

Identity

Provider

(3) Authentication

Assertion Issued

(2) User Authentication

request (from SP)

HTTP Redirect

(1) Initial Authentication

(4) Authentication

Assertion sent

Resource used: http://www.projectliberty.org/resources/tutorial_draft.pdf

Account Linking and Identity Federation

User handles (name identifers)

Eliminates need for global ID

Prevents collusion between SP1 and SP2

Federate Account

Alias: swh3Tj4

Domain: SP_1.com

Name: dTvlir57

Alias: ace335Rt

Domain: SP_2.com

Name: frw78ks

Federate Account

Alias: frw78ks

Domain: SP_1.com

Name: ace335Rt

Federate Account

Alias: dTvlir57

Domain: IDP_A.com

Name: swh3Tj4

SP2 Account

Shart9875@sp2

SP2 Account

Steve123@idp

IDP Account

SP1 Account

Steve_H@SP1

Resource used: http://www.projectliberty.org/resources/tutorial_draft.pdf

2003-12-08T12:43:39