Authentication Authorization Infrastructure

Authentication Authorization

Infrastructure

Jan Du Caju

AAI update

• ldap

• kerberos

• Shibboleth

LDAP

end user ldap servers

(in fail-over without password hashes): ldap.kuleuven.be (point to ldap1 and ldap2.kuleuven.be) search base: ou=people, dc=kuleuven, dc=be

authentication ldap servers

(in fail-over):

ldap-auth1.kuleuven.be (central services excluding samba) ldap-auth2.kuleuven.be (samba)

LDAP anonymous access

# organigram info http://organigram.kuleuven.be

dn: KULouNumber=50000052,ou=unit,dc=kuleuven,dc=be objectClass: organizationalUnit

objectClass: KULou ou: Secretariaat rector parentOu: 50000051 diensthoofd: u0026006 KULouNumber: 50000052

LDAP anonymous access

(continued)

# diploma informatie

dn: dipl=50045325,ou=diploma,dc=kuleuven,dc=be objectClass: KULdiploma

dipl: 50045325

diplnaam: Licentiaat in de Archeologie

# opleidingsinformatie

dn: oplnr=50046282,ou=opleiding,dc=kuleuven,dc=be objectClass: opleiding

oplnr: 50046282

LDAP anonymous access

(continued) # personnel info http://cwis.cc.kuleuven.be

dn: uid=u0001439,ou=people,dc=kuleuven,dc=be objectClass: person objectClass: eduPerson objectClass: KULPerson objectClass: posixAccount objectClass: sambaSamAccount objectClass: krb5Principal objectClass: krb5KDCEntry uid: u0001439 ou: people

ou: Leuvens Universitair Dienstencentrum voor Informatica en Telematica (LUDIT) cn: Jan Du Caju

LUDITserver: mail.cc.kuleuven.ac.be homeDirectory: /home/u0001439 loginShell: /bin/bash

LDAP anonymous access

(personnel continued) eduPersonOrgUnitDN: o=people,dc=kuleuven,dc=be uidNumber: 15677 gidNumber: 50000954 KULprimouNumber: 50000954 KULouNumber: 50000954,50014501,50000953,50000854 sn: Du Caju givenName: Jan

postalAddress: LUDIT, de Croylaan 52A, B-3001 Heverlee, Belgium telephoneNumber: +32 16 322785 KULvpnGroup: ou=Admins mail: [email protected],,[email protected] KULtap: ATP KULtypePers: ATP eduPersonAffiliation: staff,employee,member

LDAP anonymous access

(continued) # student info dn: uid=s0112264,ou=people,dc=kuleuven,dc=be objectClass: person objectClass: eduPerson objectClass: KULPerson objectClass: posixAccount objectClass: sambaSamAccount objectClass: krb5Principal objectClass: krb5KDCEntry ou: people uid: s0112264 cn: s0112264 LUDITserver: urc1.cc.kuleuven.ac.be gidNumber: 1000 stamnr: 990433020 KULid: 0112264

LDAP anonymous access

(students continued) eduPersonOrgDN: dc=kuleuven,dc=be eduPersonOrgUnitDN: o=people,dc=kuleuven,dc=be eduPersonAffiliation: student eduPersonAffiliation: member uidNumber: 229885 homeDirectory: /home/s0112264 loginShell: /bin/bash

LDAP attributes to specific apps

# not query-able, only ldap bind from KULeuvenNet authentication servers and LUDIT central servers (mail,Toledo)

userPassword: {SHA1}PASSWORD # to none

eduPersonPrincipalName: {SHA1}[email protected] KULCryptPassword: {CRYPT}PASSWORD

# towards central KULeuvenNet kerberos servers krb5PrincipalName: [email protected] krb5KeyVersionNumber: 3 krb5Key: {KERBEROS}PASSWORD krb5MaxLife: 86400 krb5MaxRenew: 604800 krb5KDCFlags: 126

LDAP attributes to specific apps

(continued)

# towards central LUDIT samba domain controller and decentral fysica samba domain controller sambaSID: S-1-5-21-1909459663-1903662737-1494088821-32354 sambaNTPassword: {NTLMv2}PASSWORD sambaPwdLastSet: 1 sambaPwdMustChange: 2147483647 sambaPwdCanChange: 0 sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaAcctFlags: [U ] sambaPrimaryGroupSID: S-1-5-21-1909459663-1903662737-1494088821-50000954

LDAP student attributes to specific apps

sn: Achternaam givenName: Voornaam dipl: 50000000 opl: 2004 50000000 02 mail: [email protected] KULlibisnr: 0000002 KULouNumber: 50000707

Kerberos

servers: kdc1.kuleuven.be and kdc2.kuleuven.be

principle: <intranetUid>@KULEUVEN.BE

Windows clients authenticating to central kdc's:

• users created in AD with random password

• mapped user to principal

• changed kdc of user from AD to central kdc's (name mappings)

WAYF where are you from K U L who are you jan handle handle+attributes? attributes pageX pageX 1 3 4 5 7 10 2 AAI-enabled resource W E B s e r v e r SP Service Provider shibboleth 9 6 AAI-enabled Home organization authentication system user directory shibboleth IdP Identity Provider

Shibboleth

Home organization:

cas.kuleuven.be idp.kuleuven.be

Service provider

(and documentation): http://shib.kuleuven.be

IdP ldap-auth1

Shibboleth Federation

Common set of policies, practices and guidelines

IdP|SP: no end user workstation, properly patched , ... a registry to process applications to the federation

distribution of membership information (IdP's en SP's)

Attributes needed for Shibboleth

classification of users for basic authorizations (access to app) exchange of attributes within federation

Federations

• K.U.Leuven

Classification of users for basic authorizations

eduPersonAffiliation:

• value

[student|faculty|staff|employee|alum|member|affiliate] affiliate = external, not member

Affiliate is intended to apply to people with whom the university has dealings, but to whom no general set of "community membership" privileges are

extended

if [student|faculty|staff] then also member if [faculty|staff] then also employee

• use

(federations)

Classification of users for basic authorizations

eduPersonScopedAffiliation:

• value

eduPersonAffiliation@<domain>.be e.g. [email protected]

• use

(federations) Associatie

• ARP

(Attribute Release Policy) general usability

Classification of users for basic authorizations

KULouPrimaryNumber:

• value

organigram code of unit(s) an employee is assigned to

• use

(federations) K.U.Leuven

• ARP

(Attribute Release Policy) general usability

Classification of users for basic authorizations

KULouNumber:

• value

– personnel (or employee)

KULouPrimaryNumber + all organigram codes of units above in organigram tree an employee is assigned to – student : organigram code of faculty

• use

(federations) K.U.Leuven

• ARP

(Attribute Release Policy) – personnel: general usability – student: specific apps

Classification of users for basic authorizations

dipl:

• value

code of a diploma e.g. 50045349 for

Kandidaat in de Taal- en Letterkunde: Germaanse Talen

• use

(federations) K.U.Leuven

• ARP

(Attribute Release Policy) specific apps

Classification of users for basic authorizations

opl:

• value

<year> <opleidingsnummer> <year_within_opleiding>

e.g. 2005 50046649 00 for opleidingsnummer 50046649 with name Kandidaat in de Taal- en Letterkunde: Germaanse Talen

• use

(federations) K.U.Leuven

• ARP

(Attribute Release Policy) specific apps

exchange of attributes within federations

K.U.Leuven federation

general

• KULouPrimaryNumber • KULouNumber

specific applications

• uid, cn, surName, givenName, mail (students) • opl, dipl

Associatie K.U.Leuven

general

• eduPersonAffiliation:

Release of attributes to Specific apps

Toledo & Kotnet

• uid@<domain>.be (eduPersonPrincipalName)

• surname

• givenName

• commonName