NativeSP - exporting full SAML assertion to protected application?

[Cantor, Scott]

On 2/22/12 6:10 PM, "Stephen Chan" <sychan at lbl.gov> wrote:

>On Wed, Feb 22, 2012 at 1:38 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>> I don't know anything about myproxy.
>
>   Myproxy is a service that Jim Basney at NCSA has been developing for a
>while now. You authenticate to it, and it provides you with a short
>lived end entity certificate that is recognized for authentication by
>Grid services as well as modified versions of SSH. The myproxy server
>supports PAM for authentication.

And I guess there's PAM support for SASL or GSS?

>   Using the SAML assertions directly for authentication actually came
>out of a conversation I had with Jim Basney when I was talking to him
>about this problem. What we want to do is have our "Science Gateway"
>plugged into our Shib infrastructure, and have the gateway be able to
>acquire MyProxy certificates on behalf of the user based on the Shib
>SSO.

That is delegation. It cannot be done properly without extending the SAML
Browser SSO assertion to support round tripping to the IdP to acquire
additional tokens, and then one has to apply the whole sequence of steps
to the application protocol. When we worked on the problem, we attempted
to address the delegation flow itself, and then the use of HTTP as an
application protocol by way of ECP.

This is all outlined in detail in the wiki space that describes the work
on delegation.

https://spaces.internet2.edu/display/ShibuPortal/

It cannot simply drop into an arbitrary application protocol because the
protocol has to support SAML tokens as authentication. It does compose
with the SAML-EC SASL mechanism I defined, in the same manner that we
composed it with the base ECP work for HTTP. The delegation exchange is
the "back-half" of the ECP flow that runs between the client and IdP
(where the client in a delegated flow is the middle tier).

> The ECP profile looks like it would allow MyProxy to authenticate
>against an IdP, but we want to have the benefit of SSO.

If you have a middle tier, then by definition that tier has to be able to
do its thing without extra authentication from the user, since the user's
not there. If by SSO you mean "without the Myproxy being root and trusted
to impersonate anybody", that's what we call delegation. The SSO token
between browser and MyProxy authenticates MyProxy to the IdP to acquire
additional tokens for other services.

> Is there a way
>to pass some token from the Web SSO through ECP? On the face of it,
>using the SAML assertion directly would seem to be roughly equivalent,
>but skipping a connection via ECP from the myproxy server back to the
>IdP.

You cannot skip that step without violating the SAML standard or extending
the initial assertion with foreknowledge that it's to be used as a
delegation token to access a particular service.

Or you can hack something up and ignore the standards like most people do
of course. For some reason, people will pass around SAML assertions
without regard for their content or the required security proofs, but
presumably would not do the same thing with Kerberos tickets. Or maybe I'm
naïve and they pass those around freely too.

-- Scott