Web Access Management
Novell iChain® & Beyond

Lee Howarth

Product Manager

Novell

Agenda

Introduction to iChain

What is iChain

What are the business problems it solves

Architecture Overview

SAML Extension for iChain

Introduction to Liberty Alliance

Introduction to Novell Access Manager

Next generation Web Access Management from Novell

Architectural Overview

What is Novell iChain?

iChain is Novell technology for secure Web Applications

Reduces the complexities of implementing and managing secure web applications

Proxy based Architecture – single PDP and PEP (High Performance)

Supports more HTTP services than any of it’s competitors

Provide single sign-on to web based resources, even when the user has a different user name and password on each resource.

Delivers content securely over the web

Firewall

Employee

Intranet

Internet

Customer

Extranet

Partner

SECURITY

Solaris/

Netscape

NT IIS

Web Servers and Applications

SECURITY

Linux/

Apache

SECURITY

Issues when creating a Secure Web infrastructure:

Direct Access to Web Servers (increase possibility of hacking)

Multiple User Identities (no single sign on)

Need to install SSL services on each web server

Need to change links in HTML content from HTTP to HTTPS

Many different Web Server Technologies

What are the Customer Problems?

Employee

Intranet

Internet

Customer

Extranet

Partner

SECURITY

Solaris/

Netscape

NT IIS

Web Servers and Applications

SECURITY

Linux/

Apache

SECURITY

Agent Based Solutions

Provide Single Sing-On

Provides Access Control

Personalization

Previous Issues Still Exist

Direct Access to Web Servers (increase possibility of hacking)

Need to install SSL services on each web server

Often, need to change links in HTML content from HTTP to HTTPS

Often need to modify applications authentication process

Many different Web Server Technologies

Competitors Solution

Firewall

Firewall

SECURITY INFRASTRUCTURE

Web Servers and

Applications

Employee

One Net

Customer

Partner

The Novell Solution

NT IIS

Solaris/

Netscape

Linux/

Apache

eDirectory™

iChain

Benefits of iChain:

Single Authentication Point

Provides Web Single Sign On (headers and Form Fill)

Provides Identity Injection to back-end applications.

Rewrites HTML data (completely hide internal DNS infrastructure)

Dynamically encrypts content as it passes through proxy

Single SSL Certificate can be used for all internal web sites

No change to HTML content

No change to applications authentication process

Remove Direct Access to Web Servers

Provides additional security to Citrix Servers

Accelerate deployment of standards based authentication, SSO and identity exchange (SAML)

Citrix

2. Access Control- What do you have access to?

Novell iChain - How does it work?

Browser

Proxy Server

iChain Authorization Server

Web servers

Security

User=xx Password=xx

1. Authentication- Who are you?

3. Single Sign On

4. OLAC (Personalization)

5. Data Confidentiality

ACL

ACL

EmployeeID=43444

Form Fill Examples – Extend Director

<urlPolicy>

<name>form1</name>

<url>director.ichain.com/director/DirectorEdir/Portal/main/comp/*</url>

<formCriteria>

<title>Novell exteNd Director Login</title>

</formCriteria>

<actions>

<fill>

<input name="uid"	value="~cn">

<input name="pwd"	value="~password">

</fill>

<post/>

</actions>

</urlPolicy>

Form Fill Examples – BEA

<urlPolicy>

<name>BEA</name>

<url>bea.ichain.com/sampleportal/*</url>

<formCriteria>

<title>Portal Login</title>

</formCriteria>

<actions>

<fill>

<input name="j_username"	value="~">

<input name="j_password"	value="~">

</fill>

<post/>

</actions>

</urlPolicy>

SAML Extension for Novell iChain

SAML

SAML – Security Assertions Markup Language

XML-based security specification for exchanging authentication and authorization information

Developed by the OASIS standards organisation

Uses include Single Sign-On for B2B services

Designed to addresses the complexities of establishing Business-to-Business communication between differing systems.

Over 100 Members, including:

Novell

IBM

Microsoft

Sun

Netegrity

RSA Security

Browser Post

Destination Site

Source Site

User authenticates

to source site and

selects a link for a

secured resource at

the destination site

1

Source Site

Generates

HTML form data

containing the SAML

response that

contains

an SSO assertion

2

Browser submits the

form containing the

SAML response

to the destination

site

3

Destination site

either responds by allowing or denying access to the resource

4

1

2

3

4

Source Site

Assertion

Consumer

Browser Artifact

Destination Site

Source Site

User authenticates

to source site and

selects a link for a

secured resource at

the destination site

1

Source Site responds

and redirects the

user's browser to the

assertion consumer

service at the

destination site,

sending an Artifact

that represents the

user's authentication

information

2

Destination site

requests assertions

from the source site, by presenting

valid Artifacts, (if the Artufact is invalid an appropriate error code is generated

3

Based on the assertions the destination site

responds by allowing or denying access to the resource

4

1

2

4

3

SAML Extension for Novell iChain

Adds SAML processing and generation capabilities to iChain

Provides support for SAML Authentication and Attribute assertions (SSO between business partners)

Supports Browser Post and Artifact Methods

Proxy-based architecture

Transparently enables none SAML aware applications

Leverage's iChain's OLAC and SSO capabilities

Maps SAML assertions to users (one-to-one and one-to-many)

Released July 2003

Free Web download for any iChain 2.2 SP1 / 2.3 customer

SAML – Pros and Cons

Pros

SAML provides a good foundation for exchanging authentication and authorization information

Highly flexible

Cons

Highly flexible also introduces it's own complexities

Requires negotiation between each business partner to agree on the format of data

User has very little control over the information the business partners exchanges

The Liberty Alliance Specifications

Liberty Alliance

An industry consortium of more than 150 members with the goal of developing a practical and interoperable approach to identity federation.

The Liberty Alliance specifications describe a standard methodology for deploying SAML-based services

Structured framework removes much of the complexity in using SAML for identity federation

Standard is spearheaded by a variety of industry leaders (mostly non-technology organizations)

Liberty Alliance Membership

Federate Identity

Yes/No

3

Liberty Alliance Basic Federation

Users decide who they want to federate their identity with

Federation is actually the linking of two accounts using a unique pseudonym. The user account must already exist in both locations.

Service Provider

Identity Provider

User authenticates to

Identity Provider

1

1

2

User is asked if he

wants to Federate his

Identity

3

User authenticates to

a Service Provider,

which recognizes he

has a trusted Liberty

authentication

2

A unique pseudonym is

created and associated

with the identity at

both the Liberty and

Service Provider

4

2

4

Novell Liberty Identity Provider v1.0

Released at BrainShare® 2003

Provided early access to Liberty enabled technology

Requires eDirectory

Defined a foundation to build future Liberty enabled services

Provided the feature set of Liberty Alliance 1.1.

Liberty Alliance in 2004 +
- An Evolving Specification

Specification has evolved into a secure method of exchanging identity information

The ID-FF (Identity Federation Framework) has been enhanced to facilitate Affiliation groups, making it easier for a user to manage their identity between associated organizations

Developed the ID-WSF (Web Services Framework) a pluggable architecture, acting as both Web Service Provider and Consumer

Developed ID-SIS (Service Instance Specification) for Discovery (DISCO), Employee and Person Profiles

Liberty ID-SIS Profiles

Person and Employee Profiles

Provides a defined set of keywords expressing either availability of data or the ability to update data relating to personal (person) or Employee information

Keyword examples:

Service

Instance

Specifications

ID-WSF Data Services

Template 1.0

Web Service

Framework

Extension to

original

specification

www.projectliberty.org

ID-Personal Profile

Implementation

Guidelines 1.0

ID-SIS

ID-WSF

ID-FF

ID-Employee Profile

Implementation

Guidelines 1.0

ID-Employee

Profile 1.0

ID-Personal

Profile 1.0

ID-WSF Security and

Privacy

Overview 1.0

ID-WSF Architecture

Overview 1.0

ID-WSF Implemantation

Guidelines 1.0

ID-WSF Static

Conformance Req 1.0

ID-WSF Interaction

Services 1.0

ID-WSF Discovery

Services 1.0

ID-WSF Security

Mechanisms 1.0

Liberty Reverse HTTP

Binding 1.0

Liberty SASL-based

SOAP AuthN 1.0

ID-WSF SOAP

Binding 1.0

ID-WSF Client

Profiles 1.0

Liberty Glossary

ID-FF Implementation

guidelines 1.2

Liberty Trust Model

Guidelines

ID-FF Static

Conformance Req 1.2

Liberty Authentication

Context 1.2

Liberty Meta Data 1.0

ID-FF Bindings

and Profiles 1.2

Web Services Bindings and

Profiles

ID-FF Protocols and

Schemas 1.2

Core Identity Services Protocols

Identity Services

Templates

ID-FF Architectural

Overview

Liberty Alliance Project Phase 2 Specifications

NORMATIVE

NON-NORMATIVE

Novell Access Manager

Novell Access Manager

Next Generation Web Access and Federated Identity Management

Liberty Alliance / SAML 2 enabled authentication and Identity Exchange

Liberty-enabled Access Gateway (updated iChain proxy)

New Policy Engine

Java Agents

SSL-VPN

iManager Administration

Support for Active Directory

Expected Release Date

Q4 2005

Novell Access Manager

Administration Preview

Administration Preview

Administration Preview

Administration Preview

Administration Preview

Novell Access Manager Use Cases

Authentication and Federation

Liberty Alliance Identity Provider (IDP) and Service Provider (SP) – B2C and B2E

Liberty Alliance Web Services Framework – B2C and B2E

Liberty Alliance-enabled provisioning

Access Manager Gateway

Liberty Alliance IDP and SP
Value Proposition

Identity federation enables user-controlled single sign-on between consumer-based or enterprise-based resources.

For enterprise deployments, federation allows an organization to deliver the benefits of single sign-on, without compromising privacy regulations.

In business-to-consumer deployments, users control what information can be shared with service providers, maintaining privacy while realizing the benefits of single sign-on.

Liberty Alliance
B2C Use Case

Liberty Alliance
B2E Use Case

Human Resources

IS&T controlled

Services

Human Resources

Novell could setup

it's own IDP and

departments that

contain highly

confidential data

can still provide

users single sign-on,

but maintain control

of users identities

Liberty Alliance Web Services Framework
B2C Use Case for Sharing Attributes

3rd Party

E-Profile

Disco

P-Profile

Liberty Alliance Web Services Framework
B2E Use Case for Sharing Attributes

E-Profile

Disco

P-Profile

Novell Innerweb

Liberty-Enabled Provisioning
Value Proposition

Liberty-enabled provisioning is additional value that Novell brings to identity federation solutions.

Standard Liberty-based federation requires a user already exist at the Identity Provider and Service Provider before the user can federate his identity.

Novell’s solution will allow policy-based automated creation and federation of a user’s identity.

Liberty-Enabled Provisioning
Star Alliance Use Case – Example Only

SSO

SSO

Novell Access Manager Gateway
Value Proposition

Dynamically Liberty-enable non-Liberty applications

Standard Web applications require no modification to work with a Liberty identity

Access Manager Gateway can transform a Liberty identity into standard methods of single sign-on (header- and form-based) or SAML assertions, and inject the Liberty identity as a standard header, query string or SAML variable

The Access Manager Gateway removes direct access to Web applications, enforces access control policy and ensures data confidentiality, encrypting all content on its public interfaces.

Access Manager Gateway
Access Control

Novell IDP/SP

Access Gateway

User Authenticates to the access gateway using the Liberty Alliance Identity Provider

Policy Decisions and Enforcements are made

Access is granted and web SSO is performed with back-end web applications

Identity Injection can leverage Liberty Web Service Framework

Data is encrypted between gateway and browser

To address these complexities the Industry has provided two new standards.

The first one, SAML, which stands for Security Assertions Markup Language, is an XML-based security specification for exchanging authentication and authorization information. It was developed and is managed by the OASIS standards body, and it’s primary use (initially) will be for B2B services. SAML as over 100 members including Novell, Sun, IBM, Netegrity and Microsoft.

The second standard is Liberty Alliance, with was spearheaded by business leaders from mostly none technical organizations.

The Liberty Alliance specification is actually a structured version of SAML, in that the specification does not permit any passing of identity information, rather pseudonyms are created that link the users various Internet identities.

We are focusing in the presentation on iChain and the SAML Extension for iChain, but I just wanted to make sure that you were aware that Novell has released Liberty enabled technology in the form of the Liberty Identity for eDirectory.

To address these complexities the Industry has provided two new standards.

The first one, SAML, which stands for Security Assertions Markup Language, is an XML-based security specification for exchanging authentication and authorization information. It was developed and is managed by the OASIS standards body, and it’s primary use (initially) will be for B2B services. SAML as over 100 members including Novell, Sun, IBM, Netegrity and Microsoft.

The second standard is Liberty Alliance, with was spearheaded by business leaders from mostly none technical organizations.

The Liberty Alliance specification is actually a structured version of SAML, in that the specification does not permit any passing of identity information, rather pseudonyms are created that link the users various Internet identities.

We are focusing in the presentation on iChain and the SAML Extension for iChain, but I just wanted to make sure that you were aware that Novell has released Liberty enabled technology in the form of the Liberty Identity for eDirectory.

IO 152

2003-12-08T12:43:39