May 9, 2002 -.. Vacation time is near, so you go online to make your travel arrangements, typing in your user name and password to log onto your Internet service provider Done You enter another user name and password to book a plane flight YOUR FAVORITE THATE. DONE. Remembering That You NEED A Car When You Arrive, You Sign On Yet Again To a Rental Agency's System. Your Hotel Reservation Requires Another Fresh Authentication.
It's not just a matter of dealing with multiple vendors: Back from your vacation, you log in to your employer's virtual private network (VPN) with yet another user name and password Then there's the HR system login to record your vacation time And the.. Finance System to Approve An Employee's Travel Expense Report. and the payroll system to check your return.
Fortunately, Multiple Signation IS Quickly Becoming A Thing of the Past For Service Providers Who Adopt The Security Assertions Markup Language (SAML) Specification.
In Short, Saml Enables Open and Interoperable Designs for Web-based Single Sign-On Service Functionality.
Rima Patel, a Sun Technology Evangelist, provided an overview of SAML applied to single sign-on capabilities at the 2002 JavaOneSM Conference and in a follow-up interview. "Using SAML for single sign-on functionality allows users to authenticate themselves in one domain And use the resources in another domain welch re-automating themselves, "She SAID.
The User's Authentication, Authorization, Profiles, And Preferences Are Transmitted from an Original Source Service Provider To Subsequent Destination Service Provider Subsequent Destination Service Provider Subsequent Destination Service Provider.
Patel explained, "In many cases, the source and destination service providers will belong to the same 'federation.' For example, if you have signed on and been authenticated at the American Airlines domain and wish to rent a car, American Airlines will only share your sign-on information (and the associated password, profile, and preferences) with its contracted partners - companies who enter agreements to protect secure shared information among themselves "SAML: Headed for Standardization.
"The idea of single sign-on services is not new, and versions have existed for several years," said Patel. "However, they are typically 'closed' solutions that do not offer broad interoperability. SAML, on the other hand, IS A Fully Interoperable 'Open' Solution. There Simply Hasn't Been A Secure, Interoperable Standard for Exchanging Secure Sign-on Information, and Saml Looks Like It Will Be The First.
"In addition," says Patel, "SAML is targeted as a security services implementation to support Internet2 and has already been approved or adopted in principle by a host of security and service providers." A sample of those providers includes:
Sun Microsystems (SunTM ONE Platform for Network Identity and iPlanetTM Directory Server, Access Management Edition (DSAME)) Entrust (GetAccess portal) Systinet (WASP Secure Identity) Securant (RSA Cleartrust) Entegrity (AssureAccess) Netegrity (AffiliateMinder)
The new SAML 1.0 specification is based on the merger of two formerly competing security efforts -. S2ML and AuthML The SAML 1.0 specification set was released in February 2002, and the specification submission was provided to the Organization for the Advancement of Structured Information Standards ( OASIS) http://www.oasis-open.org/ in March 2002 for standardization by the OASIS Security Services Technical Committee. (OASIS is a not-for-profit, global consortium that drives the development, convergence and adoption of e- Business Standards.) The Related Javatm Technology API Standard for Saml IS in Review At The Java Community ProcessSM (JCPSM) Program http://www.jcp.org/ AS A Java Specification Request - JSR-155.
What it is IS
SAML is an XML framework for exchanging security information over the internet. SAML enables disparate security services systems to interoperate. It resides within a system's security mechanisms to enable exchange of identity and entitlement with other services.
"SAML does not define any new mechanisms or approaches to authentication or authorization," says Patel. "It does not, for instance, include requirements or specifications for the act of authentication or authorization." It does, however, define the structure of the Documents That Transport Security Information Among Services.
BY Visiting http://www.oasis-open.org/committees/security/
Assertions and request / response protocols Bindings (the SOAP-over-HTTP method of transporting SAML requests and responses) Profiles (for embedding and extracting SAML assertions in a framework or protocol) Security considerations while using SAML (highly recommended reading) Conformance guidelines and a test suite use cases and requirementsA Code Example Because the SAML standard is designed only for the exchange of secure sign-on information between a user, or "relying party," and multiple issuing parties, it allows issuing parties to use their own chosen methods of Authentication for Example, PKI, Hash, OR Password. Here, A Sample Saml-Compliant Request is Sent from a releating party requesting password authentication by the questsuing party.
In response, The Issuing Authority Asserts That The Subject (s) WAS Authenticated By Means (M) AT Time (T).
Assertions and authorities
"Assertions are at the very core of the SAML specification," says Patel. "An assertion is a declaration of a 'certain fact' about a subject, for example, a user or code." For example, that an individual was authenticated by A Particular Method At a Specific Time, or That An Application Has Been Grand A Certain Class of Access To a Resource Under Conditions.
A SAML-compliant service, called a Relying Party, sends SAML Requests to an Issuing Authority, which returns SAML Assertion Responses. All of the requests and responses are transmitted within a SOAP via HTTP envelope, though Patel notes, "Your own applications can define And Exchange Assertions Using A Variety of Request / Response Protocols, But Those Extensions May Limit Interoperability.
For example, when a user signs into a SAML-compliant service, the service sends a "request for authentication assertion" to the issuing authority, stating that the user was authenticated by a particular method at a specific time. The issuing authority returns a " authentication assertion reference "that the service can pass to other sites so they can check the user's credentials.Later, when the user visits another SAML-compliant site that requires authentication, the site uses the reference to request authentication assertion from the issuing authority, which .
Within the capital specification, There Are Four Types of assertions:
Attribute Assertions Authentication Assertions Authorization Assertions Subject Assertions
"Assertions do not create a secure authentication," explains Patel. That is the responsibility of the security service. Rather, "assertions are coded statements generated about events, such as authentication, that have already occurred," as, when the user provided a Correct User Name and Password, or When The Security Mechanism Grand Specific Permissions.
PATEL EXPLAINED THATESERTIONS CAN ONLY BE Generated and Issued By A Saml "Issuing Authority." At present, There is............
The First Type Includes Third-Party Security Service Providers, Such as:
Microsoft (THROUGH ITS Passport Initiative) xnsorg http://www.xns.org/ (THROUGH ITS Web Identity Platform) dotgnu http://www.dotgnu.org/ (THROUGH ITS VIRTUAL Identity Platform)
The second type consists of individual businesses, such as AOL, American Express, and VISA, which can serve as issuing authorities within private federations by leveraging the Liberty Alliance technologies http://www.projectliberty.org/."Using Liberty Alliance technologies, ......................
Independent of the Type Of Authority, WHEN A User Creates A SAML Request Through a Service Sign-on, Assertions Are Generated by The Issuing Authority and Transmitted Withnin A SOAP Envelope VIA HTTP.
SAML Architecture
