Diese Präsentation wurde erfolgreich gemeldet.
Wir verwenden Ihre LinkedIn Profilangaben und Informationen zu Ihren Aktivitäten, um Anzeigen zu personalisieren und Ihnen relevantere Inhalte anzuzeigen. Sie können Ihre Anzeigeneinstellungen jederzeit ändern.

SAML, Open ID et CAS dans un seul WebSSO : LemonLDAP::NG

5.474 Aufrufe

Veröffentlicht am

SAML, Open ID et CAS dans un seul WebSSO : LemonLDAP::NG
at Solutions Linux / Open Source

LemonLDAP::NG est un logiciel libre de WebSSO et de contrôle d'accès aux applications Web. C'est également un fournisseur d'identités SAML, CAS et OpenID.

Vous découvrirez lors de cette conférence comment il est possible de s'affranchir de la gestion du mot de passe de ses utilisateurs, en déléguant l'authentification et les contrôle d'accès à une application à un produit de WebSSO.

Cela permet d'intégrer l'application sans effort dans des systèmes d'informations hétérogènes, en reposant sur des méthodes aussi diverses que les annuaires LDAP, les bases de données, les certificats SSL, Kerberos, etc.

La fonctionnalité de fournisseur d'identité permet également d'établir un cercle de confiance, pour par exemple propager l'authentification des utilisateurs aux applications “cloud”, comme Google Apps ou SalesForce.

Veröffentlicht in: Technologie, Design
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download Full EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download Full doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book THIS can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer THIS is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story THIS Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money THIS the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths THIS Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Antworten 
    Sind Sie sicher, dass Sie …  Ja  Nein
    Ihre Nachricht erscheint hier
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download Full EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download Full doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book THIS can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer THIS is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story THIS Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money THIS the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths THIS Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Antworten 
    Sind Sie sicher, dass Sie …  Ja  Nein
    Ihre Nachricht erscheint hier
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download Full EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download Full doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book THIS can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer THIS is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story THIS Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money THIS the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths THIS Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Antworten 
    Sind Sie sicher, dass Sie …  Ja  Nein
    Ihre Nachricht erscheint hier
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://soo.gd/qURD } ......................................................................................................................... Download Full EPUB Ebook here { https://soo.gd/qURD } ......................................................................................................................... Download Full doc Ebook here { https://soo.gd/qURD } ......................................................................................................................... Download PDF EBOOK here { https://soo.gd/qURD } ......................................................................................................................... Download EPUB Ebook here { https://soo.gd/qURD } ......................................................................................................................... Download doc Ebook here { https://soo.gd/qURD } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book THIS can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer THIS is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story THIS Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money THIS the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths THIS Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Antworten 
    Sind Sie sicher, dass Sie …  Ja  Nein
    Ihre Nachricht erscheint hier
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://soo.gd/qURD } ......................................................................................................................... Download Full EPUB Ebook here { https://soo.gd/qURD } ......................................................................................................................... Download Full doc Ebook here { https://soo.gd/qURD } ......................................................................................................................... Download PDF EBOOK here { https://soo.gd/qURD } ......................................................................................................................... Download EPUB Ebook here { https://soo.gd/qURD } ......................................................................................................................... Download doc Ebook here { https://soo.gd/qURD } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book THIS can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer THIS is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story THIS Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money THIS the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths THIS Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Antworten 
    Sind Sie sicher, dass Sie …  Ja  Nein
    Ihre Nachricht erscheint hier

SAML, Open ID et CAS dans un seul WebSSO : LemonLDAP::NG

  1. 1. SAML, OpenID et CAS dans un seul WebSSO : LemonLDAP::NG Clément OUDOT Architecte LinID [email_address]
  2. 2. Sommaire <ul><li>Présentations
  3. 3. Le WebSSO
  4. 4. Les protocoles : </li><ul><li>CAS
  5. 5. OpenID
  6. 6. SAML </li></ul><li>LemonLDAP::NG </li></ul>
  7. 7. Présentations
  8. 8. LINAGORA : qui sommes nous ? Nos principaux clients Mission : Logiciels et services Open source pour réussir les grands projets du libre Fondée : Mai 2000 Capital: Capital privé (principalement détenu par les fondateurs) Nombre d'ingénieurs : 150
  9. 9. LINAGORA : nos métiers
  10. 10. Clément OUDOT <ul><li>Contributeur LemonLDAP::NG depuis 2007, Leader depuis 2011, en relai de Xavier GUIMARD
  11. 11. Leader du projet LDAP Tool Box
  12. 12. Actif dans les communautés OpenLDAP et LDAP Synchronization Connector
  13. 13. Membre de la cellule Identité / Sécurité du Groupe LINAGORA depuis 2003
  14. 14. Collabore au produit LINAGORA LinID </li></ul>
  15. 15. Le WebSSO
  16. 16. Définition du WebSSO <ul><li>SSO signifie « Single Sign On », qui peut se traduire en français par « authentification unique » </li></ul><ul><li>Le WebSSO se consacre à l'authentification unique pour les applications Web, c'est-à-dire des applications client-serveur dont le client est un navigateur Web (IE, Firefox, etc.) </li></ul><ul><li>Le principe de base est d'intercepter les requêtes entre le client et le serveur, et indiquer au serveur que le client est bien authentifié </li></ul>
  17. 17. Comment ça marche ?
  18. 18. Utilisateur Utilisateur Application Web Portail WebSSO 1 2 3
  19. 19. SSO par délégation
  20. 20. SSO par mandataire inverse (reverse proxy)
  21. 21. Les protocoles
  22. 22. CAS <ul><li>Central Authentication Service
  23. 23. Documentation du protocole pour 1.0 et 2.0
  24. 24. Utilisation de tickets de service dans l'URL, avec validation par un lien dorsal
  25. 25. Possibilité de tickets proxy
  26. 26. Pas de partage d'attributs </li></ul>
  27. 27. CAS
  28. 28. CAS <ul><li>Requête ticket de service CAS : </li></ul>https://auth.example.com/cas/login?service=http://auth.example.com/cas.pl <ul><li>Réponse ticket de service CAS : </li></ul>http://auth.example.com/cas.pl?ticket=ST-6096f5d3ddb33df6fd79529e2d626a6d <ul><li>Requête validation ticket CAS : </li></ul>https://auth.example.com/cas/serviceValidate?service=http://auth.example.com/cas.pl&ticket=ST-6096f5d3ddb33df6fd79529e2d626a6d <ul><li>Réponse validation ticket CAS : </li></ul><cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'> <cas:authenticationSuccess> <cas:user>coudot</cas:user> </cas:authenticationSuccess> </cas:serviceResponse>
  29. 29. OpenID <ul><li>L'identifiant de l'utilisateur contient l'adresse du service d'authentification
  30. 30. Aussi basé sur les redirections HTTP
  31. 31. Permet le partage d'attributs (mais plusieurs normes possibles...)
  32. 32. Pas de notion de cercle de confiance </li></ul>
  33. 33. OpenID
  34. 34. Requête OpenID https://auth.vm2.lemonsaml.linagora.com/openidserver/?openid.ns=http://specs.openid.net/auth/2.0&openid.return_to=http://auth.vm1.lemonsaml.linagora.com/%3Fopenid%3D1%26lmAuth%3D2OpenID%26oic.time%3D1304351669-dab6b201beda30620859&openid.claimed_id=http://auth.vm2.lemonsaml.linagora.com/openidserver/coudot&openid.identity=http://auth.vm2.lemonsaml.linagora.com/openidserver/coudot&openid.mode=checkid_setup&openid.realm=http://auth.vm1.lemonsaml.linagora.com/&openid.assoc_handle=1304351670:2TKNyP679ZL6J1S9i0TH:3e0d127809&openid.sreg.optional=nickname,fullname,email
  35. 35. Réponse OpenID http://auth.vm1.lemonsaml.linagora.com/?openid=1&lmAuth=2OpenID&oic.time=1304351669-dab6b201beda30620859&openid.mode=id_res&openid.claimed_id=http://auth.vm2.lemonsaml.linagora.com/openidserver/coudot&openid.identity=http://auth.vm2.lemonsaml.linagora.com/openidserver/coudot&openid.op_endpoint=https://auth.vm2.lemonsaml.linagora.com/openidserver/&openid.return_to=http://auth.vm1.lemonsaml.linagora.com/%3Fopenid%3D1%26lmAuth%3D2OpenID%26oic.time%3D1304351669-dab6b201beda30620859&openid.response_nonce=2011-05-02T15:56:03ZW3EeYE&openid.assoc_handle=1304351670:2TKNyP679ZL6J1S9i0TH:3e0d127809&openid.ns=http://specs.openid.net/auth/2.0&openid.signed=mode,claimed_id,identity,op_endpoint,return_to,response_nonce,assoc_handle&openid.sig=tOO9kHJgQKajdnb6qTLMCSREdO0%3D
  36. 36. SAML <ul><li>Security Assertion Markup Language
  37. 37. Sécurité
  38. 38. XML, XML Security
  39. 39. Sécurité
  40. 40. Cercle de confiance : enregistrement préalable des fournisseurs de services et des fournisseurs d'identités
  41. 41. Sécurité
  42. 42. Plusieurs méthodes : GET / POST / Artefact GET / Artefact POST
  43. 43. Sécurité </li></ul>
  44. 44. SAML
  45. 45. Requête SAML <samlp:AuthnRequest xmlns:samlp=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot; xmlns:saml=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot; ID=&quot;_d7607d551380ac97853a6ff4907c4ef01219be97dd&quot; Version=&quot;2.0&quot; IssueInstant=&quot;2008-05-27T07:46:06Z&quot; ForceAuthn=&quot;true&quot; IsPassive=&quot;false&quot; Destination=&quot;https://openidp.feide.no/simplesaml/saml2/idp/SSOService.php&quot; ProtocolBinding=&quot;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST&quot; AssertionConsumerServiceURL=&quot;http://dev.andreas.feide.no/simplesaml/saml2/sp/AssertionConsumerService.php&quot;> <saml:Issuer>http://dev.andreas.feide.no/simplesaml/saml2/sp/metadata.php</saml:Issuer> <samlp:NameIDPolicy Format=&quot;urn:oasis:names:tc:SAML:2.0:nameid-format:transient&quot; AllowCreate=&quot;true&quot;/> </samlp:AuthnRequest>
  46. 46. Réponse SAML <?xml version=&quot;1.0&quot;?> <samlp:Response xmlns:samlp=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot; xmlns:saml=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot; xmlns:xs=&quot;http://www.w3.org/2001/XMLSchema&quot; xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; ID=&quot;_162f441d28cff78e3bb1d3c2bf3e48b5ed532605fd&quot; InResponseTo=&quot;_ae0216740b5baa4b13c79ffdb2baa82572788fd9a3&quot; Version=&quot;2.0&quot; IssueInstant=&quot;2008-05-27T07:49:23Z&quot; Destination=&quot;https://foodle.feide.no/simplesaml/saml2/sp/AssertionConsumerService.php&quot;> <saml:Issuer xmlns:saml=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot;>https://openidp.feide.no</saml:Issuer> <samlp:Status xmlns:samlp=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot;> <samlp:StatusCode xmlns:samlp=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot; Value=&quot;urn:oasis:names:tc:SAML:2.0: status:Success &quot;/> </samlp:Status> <saml:Assertion Version=&quot;2.0&quot; ID=&quot;pfxb27555d8-8c06-a339-c7ae-f544b2fd1507&quot; IssueInstant=&quot;2008-05-27T07:49:23Z&quot;> <saml:Issuer>https://openidp.feide.no</saml:Issuer> <ds:Signature xmlns:ds=&quot;http://www.w3.org/2000/09/xmldsig#&quot;> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm=&quot;http://www.w3.org/2001/10/xml-exc-c14n#&quot;/> <ds:SignatureMethod Algorithm=&quot;http://www.w3.org/2000/09/xmldsig#rsa-sha1&quot;/> <ds:Reference URI=&quot;#pfxb27555d8-8c06-a339-c7ae-f544b2fd1507&quot;> <ds:Transforms> <ds:Transform Algorithm=&quot;http://www.w3.org/2000/09/xmldsig#enveloped-signature&quot;/> <ds:Transform Algorithm=&quot;http://www.w3.org/2001/10/xml-exc-c14n#&quot;/> </ds:Transforms> <ds:DigestMethod Algorithm=&quot;http://www.w3.org/2000/09/xmldsig#sha1&quot;/> <ds:DigestValue>WUaqPW4nZ8uPyv+sf8qXsaKhHmk=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue>CRq1VvptjNHenZ5aWkyD6GqQX+XLgNiqElJnyLbMUgiwrFZ5J8IEGtC8h2YiwID15ScxVt6tjQc8R3gXkP967PIlemmhYQ4US7V3oPczu4MECamj+07wAg7BCp05UVU3RI3pvi/2dQGRRX4tlXgkzUMzx8+cBeyZaI/BXKjhKEY=</ds:SignatureValue> <ds:KeyInfo> <ds:X509Data> <ds:X509Certificate>MIICizCCAfQCCQCY8tKaMc0BMjANBgkqhkiG9w0BAQUFADCBiTELMAkGA1UEBhMCTk8xEjAQBgNVBAgTCVRyb25kaGVpbTEQMA4GA1UEChMHVU5JTkVUVDEOMAwGA1UECxMFRmVpZGUxGTAXBgNVBAMTEG9wZW5pZHAuZmVpZGUubm8xKTAnBgkqhkiG9w0BCQEWGmFuZHJlYXMuc29sYmVyZ0B1bmluZXR0Lm5vMB4XDTA4MDUwODA5MjI0OFoXDTM1MDkyMzA5MjI0OFowgYkxCzAJBgNVBAYTAk5PMRIwEAYDVQQIEwlUcm9uZGhlaW0xEDAOBgNVBAoTB1VOSU5FVFQxDjAMBgNVBAsTBUZlaWRlMRkwFwYDVQQDExBvcGVuaWRwLmZlaWRlLm5vMSkwJwYJKoZIhvcNAQkBFhphbmRyZWFzLnNvbGJlcmdAdW5pbmV0dC5ubzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAt8jLoqI1VTlxAZ2axiDIThWcAOXdu8KkVUWaN/SooO9O0QQ7KRUjSGKN9JK65AFRDXQkWPAu4HlnO4noYlFSLnYyDxI66LCr71x4lgFJjqLeAvB/GqBqFfIZ3YK/NrhnUqFwZu63nLrZjcUZxNaPjOOSRSDaXpv1kb5k3jOiSGECAwEAATANBgkqhkiG9w0BAQUFAAOBgQBQYj4cAafWaYfjBU2zi1ElwStIaJ5nyp/s/8B8SAPK2T79McMyccP3wSW13LHkmM1jwKe3ACFXBvqGQN0IbcH49hu0FKhYFM/GPDJcIHFBsiyMBXChpye9vBaTNEBCtU3KjjyG0hRT2mAQ9h+bkPmOvlEo/aH0xR68Z9hw4PF13w==</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </ds:Signature> <saml:Subject> <saml:NameID Format=&quot;urn:oasis:names:tc:SAML:2.0:nameid-format:transient&quot; SPNameQualifier=&quot;urn:mace:feide.no:services:no.feide.foodle&quot; >_242f88493449e639aab95dd9b92b1d04234ab84fd8</saml:NameID> <saml:SubjectConfirmation Method=&quot;urn:oasis:names:tc:SAML:2.0:cm:bearer&quot;> <saml:SubjectConfirmationData NotOnOrAfter=&quot;2008-05-27T07:54:23Z&quot; InResponseTo=&quot;_ae0216740b5baa4b13c79ffdb2baa82572788fd9a3&quot; Recipient=&quot;https://foodle.feide.no/simplesaml/saml2/sp/AssertionConsumerService.php&quot; /> </saml:SubjectConfirmation> </saml:Subject> <saml:Conditions NotBefore=&quot;2008-05-27T07:48:53Z&quot; NotOnOrAfter=&quot;2008-05-27T07:54:23Z&quot;> <saml:AudienceRestriction> <saml:Audience>urn:mace:feide.no:services:no.feide.foodle</saml:Audience> </saml:AudienceRestriction> </saml:Conditions> <saml:AuthnStatement AuthnInstant=&quot;2008-05-27T07:49:23Z&quot; SessionIndex=&quot;_4f39c931b35a8dd4540b0a6929a361fa134ec8f7b5&quot;> <saml:AuthnContext> <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef> </saml:AuthnContext> </saml:AuthnStatement> </saml:Assertion> </samlp:Response>
  47. 48. Historique <ul><li>LemonLDAP a été créé en 2003 par Eric GERMAN (Ministère des Finances, France) pour remplace Novell iChain (Novell -> llevon -> Lemon)
  48. 49. Comme Novell ou SiteMinder, LemonLDAP utilise des en-têtes HTTP pour propager l'identité de l'utilisateur
  49. 50. LemonLDAP::NG est une réécriture complète de LemonLDAP par Xavier GUIMARD (Gendarmerie Nationale, France) en 2005
  50. 51. Thomas CHEMINEAU et Clément OUDOT complètent l'équipe de développement </li></ul>
  51. 52. Parlons technique <ul><li>LemonLDAP::NG repose sur trois composants : </li><ul><li>Le portail (Portal) : interface d'authentification, menu des applications, changement de mot de passe
  52. 53. Le handler (Handler) : agent réalisant le contrôle des accès aux applications Web
  53. 54. Le manager (Manager) : interface de configuration, explorateur de sessions </li></ul><li>Tous les composants sont écrits en Perl
  54. 55. Nécessite Apache et mod_perl </li></ul>
  55. 56. Vue macroscopique
  56. 57. Cinématique principale
  57. 58. Les phases d'authentification <ul><li>LemonLDAP::NG découpe l'authentification en plusieurs phases : </li><ul><li>Vérification des sessions existantes
  58. 59. Récupération des données d'authentification
  59. 60. Recherche de l'utilisateur
  60. 61. Authentification
  61. 62. Stockage des données dans la session
  62. 63. Écriture du cookie
  63. 64. Redirection (menu ou application demandée) </li></ul></ul>
  64. 65. Les différentes bases <ul><li>Plusieurs « bases » sont utilisées : </li><ul><li>Authentification : comment vérifier les données d'authentification
  65. 66. Utilisateurs : où trouver les données de l'utilisateur
  66. 67. Mots de passe : où changer le mot de passe de l'utilisateur </li></ul><li>Exemple d'utilisation : authentification par Kerberos, données de l'utilisateur dans un annuaire LDAP </li></ul>
  67. 68. Méthodes d'authentification <ul><li>LemonLDAP::NG supporte de nombreuses méthodes d'authentification : </li><ul><li>LDAP
  68. 69. Database
  69. 70. SSL X509
  70. 71. Apache built-in modules (Kerberos, OTP, ...)
  71. 72. SAML 2.0
  72. 73. OpenID
  73. 74. Twitter
  74. 75. CAS </li></ul></ul>
  75. 76. Rendre mon application compatible <ul><li>LemonLDAP::NG est très peu intrusif : </li><ul><li>Pas de module à importer dans le code
  76. 77. Pas de WebService à appeler
  77. 78. Simplement lire une en-tête HTTP ! </li></ul><li>Une application qui utilise l'authentification Apache (REMOTE_USER) est compatible !
  78. 79. Adaptations possibles de l'application : </li><ul><li>Auto-création du compte local de l'utilisateur
  79. 80. Suppression du formulaire d'authentification </li></ul></ul>
  80. 81. Support CAS, OpenID et SAML <ul><li>LemonLDAP::NG peut déléguer son authentification à CAS, OpenID et SAML (avec récupération d'attributs en OpenID et SAML)
  81. 82. LemonLDAP::NG peut fournir l'identité par CAS, OpenID et SAML (avec fourniture d'attributs pour OpenID et SAML)
  82. 83. LemonLDAP::NG peut agir comme un pont entre tous ces protocoles </li></ul>
  83. 84. Exemple d'intégration avec Google Apps
  84. 85. Questions ?
  85. 86. Merci de votre attention Contact : LINAGORA – Siège social 80, rue Roque de Fillol 92800 PUTEAUX FRANCE Tél. : 0 810 251 251 (tarif local) Fax : +33 (0)1 46 96 63 64 Mail : [email_address] Web : www.linagora.com Photos de la présentation tirées de Flickr (Creative Commons)

×