The main goal of this project is to define a unified authentication and authorisation system for federated services hosted in the eduroam network. Those federated services can range from network access control to distributed services like Grid computing. Most of the proposals rely upon a global SSO mechanism based on already-deployed mechanisms and architectures.
The general architecture of DAMe is shown in Figure 1, illustrating that eduroam and eduGAIN are the two central initiatives of this project. The former will provide an infrastructure for supporting roaming and eduGAIN will be used as the main AAI (Authentication and Authorisation Infrastructure) in order to exchange credentials during the SSO and other authorisation processes. As is shown in Figure 1, any user of DAMe will be first authenticated using eduroam, obtaining a SSO token that will be used later to gain access to protected resources contained in the federation. In this way, the SSO process is directly bootstrapped from the network access, avoiding a further re-authentication at the application level. Then an authorisation process is performed to determine which kind of network access should be provided according to the user’s attributes. Finally, when a protected resource is requested in any institution belonging to the federation, eduGAIN will be used to validate the SSO token and to obtain additional attributes if necessary. In order to achieve this general objective, the project is divided into the following four main activities.
Figure 1. Overview of the DAMe architecture
The first step in DAMe is the extension of the eduroam infrastructure using the NAS-SAML architecture, so that user mobility can be controlled by security assertions and policies expressed in standard and extensible languages, such as SAML and XACML. In this way, we provide a mechanism to enhance the interoperability among different organisations by establishing a common language for credentials and access control conditions. Moreover, this approach provides mechanisms to establish fine-grained access control. Depending on the attributes assigned to the users, based on existing schemas like SCHAC, they will obtain network connections with different capabilities, such as quality of service (QoS) and security options.
The second phase takes advantage of federation mechanisms such as those defined by eduGAIN. We are aware that some organisations have already deployed authentication and authorisation solutions based on different schemas for user attributes, or even based both on SAML and non-SAML assertions, and therefore the development of integration solutions might be involved allowing different authorisation domains to interoperate. In fact, the NAS-SAML architecture has been successfully merged with other proposals based on X.509 Attribute Certificates, specifically the PERMIS project. Following a similar approach, we plan to use the eduGAIN system as the authorisation back-end of the network access control system. That is, the SAML attribute assertions establishing the user’s credentials will be managed by the elements of an already existing eduGAIN-enabled network. Therefore, we will have to provide a new profile to include NAS-SAML as part of the eduGAIN-enabled back ends.
The third step is to provide a real Single Sign On, from a global point of view. That is, users will be authenticated once, during the network access control phase. Next, having authenticated to get onto the network using 802.1X, that authentication will automatically fetch the necessary eduGAIN-signed tokens so that there will be no need to repeat the login at the application layer. In this way, the eduGAIN authentication will be bootstrapped from the NAS-SAML one. This involves a generation of SAML-signed tokens that will be obtained by the users, using for example, a new PEAP (Protected Extensible Authentication Protocol) method able to deliver the appropriate authentication credentials. Then, users will contact the eduGAIN service providers and there will no need to re-authenticate the user.
Finally, we plan to use the AAA network and the related authorisation information to provide authorisation mechanisms to application-level services. Most of the existing distributed services, for example, Grid services, have a security component responsible for determining whether a particular user can perform the requested action. Therefore, we propose the development of a mechanism able to link that authorisation process to the architecture previously defined in order to obtain the user credentials from the existing federation. This integration will be accomplished, when possible, using standard extension points, for example the OGSA-Authz authorisation interface for OGSA Grid computing platforms, or other extension points.
