untitled

Transcription

1 WS-Federation Federation PKI Agenda WS-Federation Federation Active Directory ADFS) CWID2005 CWID2005-

2 Windows Windows Kerberos 5/LDAP X.509/Smartcard/PKI VPN/802.1x/RADIUS SSPI/SPNEGO Passport/ / (Web) Exchange Web Windows Windows Windows Server System 390/AS400 (Host Integration Server) ERP (BizTalk, SharePoint ESSO) Third-Party Windows IIS Web Unix/J2EE (Services for Unix, LDAP) Windows

3 , () M&A / / PKI PKI ID PKI PKI PKI PKI Factor Authentication PKI /

4 ID ID Internet ( ) 1 ID & Web ID ID ID

5 ID & Web ID Web WS-Federation Federation

6 WS-Federation Cross-organization, organization, multi-vendor interoperability BEA, IBM, Microsoft, RSA, VeriSign Web (Browser) Web - https (Smart) SOAP Web - SOAP ADFS v1 ADFS v2 HTTP SOAP HTTP SOAP ADFS ID A : () () () () B

7 ADFSv1 in W2K03 R2 (Passive) (Passive) WS-Federation Federation WS-Trust HTTP HTTP HTTPS HTTPS proof of possession () : Requesting Browser Requestor s STS GET to resource app Target Resource Target s STS 302 Redirect to target s STS Detect home realm 302 Redirect to requestor s STS Login POST to return identity token POST to return resource token 200 Response from resource app

8 ADFS ADFS SOAP/XML (Active) WS-Federation Federation WS-Trust SOAP SOAP proof of possession : WS-Policy Requesting Service Requestor s STS Target Service Target s STS Acquire policy Request token Return token Acquire policy Request token Return token Send secured request Return secured response

9 Active Directory Web PKI WS WS-Federation PKI) WS-Federation SSL) : Active Directory SAML Federation Trust : ( ) : ( ) SAML Web

10 Web Web WS-* * Web Web Active Directory ID Windows Communication Foundation (WCF Indigo ) Composable Web Web InfoCards Windows ID ID ID InfoCards WS-* WCF Active Directory IT Active Directory (ADFS) (Windows Server 2003 R2 ) ( Beta 2 )

11 Active Directory / / / Web (WS-*) Web ADFS Active Directory (2K 2K3 2K3 ADAM) (FS) STS (security token service) FS (FS-P) UI Web SSO HTTPS LPC/Web NT & ACL ASP.NET IsInRole() RBAC ASP.NET API Windows /LDAP

12 ADFS Windows 2000 Server or Windows Server 2003 Active Directory or ADAM ( ) ( ) DMZ DMZ SSL Web ADFS Web (FS) ASP.NET v2 Windows Server 2003 R2 IIS v6 FS / () (STS) Kerberos LDAP Active Directory or ADAM LDAP AD/ADAM Security Assertion Markup Language (SAML) SAML FS FS-P SSO FS FS-P ID/ ID/ LDAP

13 (FS-P) ASP.NET v2 Windows Server 2003 R2 IIS v6 FS 1 FS Web POST SSO UI Windows SSL SSO FS ADFS Web SSO Windows Server 2003 R2 IIS v6 IIS 2 ADFS Web Agent ISAPI Extensions ADFS Web Agent Authentication Service ISAPI (Windows Server 2003 R2 IISv6 ) URL GET Web SSO Windows NT (AD ) Web ASP.NET GenericPrincipal IsInRole() () ADFS Web SSO

14 ADFS SIDs Active Directory STS STS A-Corp B-Corp 1. A-Corp B-Corp 2. A-Corp Corp STS Active Directory A-Corp Corp STS Windows 3. A-Corp STS SAML B-Corp STS 4. B-Corp STS SAML B-Corp Corp ADFS API () System.Web.Security.SingleSignOn.Identity.Identity System.Web.Security.SingleSignOn.Authorization ASP.NET GenericPrincipal IsInRole IsInRole() (AzMan) AzMan AzMan API

15 ADFS ID Web AD ADAM ADAM IIS = Web ASP.NET (NT ) Windows (VPN ) ADFS / (HTTP 443) SSL/TLS / WS-Federation

16 (1) ~ B2B ~ ( ) ASP,, Active Directory ( ) B DMZ Web A (2) ~ B2E SSO ~ VPN Active Directory Active Directory A Web DMZ

17 (3) ~ B2C & E + BU2BU ~ ( ) Active Directory Active Directory DMZ Web A AD AD (4) ~ ~ SSO Active Directory UPN:hiroshi@act.com UPN UPN hiroshi@act.com WSS on R2 Active Directory A act.com B reso.net WSS: Windows SharePoint Services

18 (5) ~ ~ A B Active Directory Active Directory A B ADFS (Certificate) (SSL) (SSL) FS-P (SSL) FS (FS ) [Active Directory ] ()

19 AD (& ) URL UI ADFS Web IIS (Claims s aware application) (Windows NT token application)

20 SSO Centrify ADFS ADFS Web Web Apache, WebSphere, WebLogic, JBoss, Tomcat. Tomcat. ADFS ADFS : Web SSO ID Web SSO, // // ADFS ADFS: ; ; Active Directory ; : Web SSO Web IIS Web SSO CWID2005 The Coalition Warrior Interoperability Demonstration (CWID )is a US programme with participation by Australia, Canada, NATO (SHAPE), New Zealand, and a the United Kingdom. Additional participants in 2005 included South Korea and some of the 'partners for peace' nations.

21 : :

22 IED 4 ID : SIPRNET CWID C41SR command, control, communications, computers, intelligence, surveillance, and reconnaissance

23 ISR E ACP133 P772 P772 Microsoft Office SharePoint Portal Server 2003

24 Active Directory IT C2 C2JWID Microsoft Office Live Communications Server 2003 LCS LCS Windows SharePoint Services. 2 CWID 2005 Active Directory Federated Services ADFS ADFS

25 JWID NATO NATO FBI HLS HLS FEMA PSEPC / / MACA Active Directory Federation Services VoIP VoIP & Office 2003 Sharepoint SharepointMeridio K2.NET Windows Microsoft Exchange Server DMS ACP133 & P772 - ACP145 Gateway

26 CWID Active Directory PKI : Trans Atlantic Secure Gateway Initiative

27 Canada UK Collaboration Active Directory Data ca Federation Server Federation Server ca Collaboration Active Directory Data US ca CA PKI AUS Collaboration Active Directory Federation Server Federation Server Collaboration Active Directory Data ca Data : Canada UK 2. Collaboration AD US Active Directory Federation Server 3. Data 6. SAML Federation Server Collaboration 7. doc Data AUS Active Directory Collaboration Active Directory Data 4. Active Directory Federation Server 5. SAML () Federation Server Collaboration Active Directory Data 1.

28 Canada Collaboration Active Directory Data Federation Server ca UK Federation Server Collaboration ca NZ Active Directory Data US Collaboration Active Directory Data ca Federation Server Federation Server Collaboration ca AUS Federation Server Collaboration ca Active Directory Data Active Directory Data Microsoft Live Communications Server k 100k Microsoft SQL Server Active Directory / VoIP CNN

29 Parlano SharePoint OODA Observe, Orient, Decide & Act : Web Web DCTS Defense Collaboration Tool Set:

30 Key Takeaways Active Directory ID Windows ID Web Web

31