Welcome!

Industrial IoT Authors: Yeshim Deniz, Liz McMillan, Pat Romanski, Ravi Rajamiyer, Stackify Blog

Related Topics: Industrial IoT

Industrial IoT: Article

Flexible Identity Federation XML Gateways to The Rescue

Imagine a fresh business relationship between ACME Corporation and Partner

Imagine a fresh business relationship between ACME Corporation and Partner. As a result of this relationship, ACME wants to grant Partner limited access to one of its core internal applications. They do this, naturally, by exposing a Web service.

Why Identity Federation?
Boris (an employee at Partner) sends a SOAP request to the ACME Web service along with some password or proof-of-possession type credentials. Because Boris's identity is managed outside of ACME, those credentials cannot be authenticated using ACME's authentication infrastructure.

To circumvent this issue, one could imagine a setup where the ACME Web service authenticates Boris's credentials by connecting to Partner's authentication services. Another alternative might involve some sort of directory replication. These strategies were attempted in the '90s when distributed LDAP references appeared in the protocol to try creating metadirectories.

Although most commercial LDAP directories have replication functionalities, these are not typically used to replicate authentication data across enterprises. For Partner to expose his authentication system to the outside world in any way is not an option: doing so would introduce major security and confidentiality issues.

Ideally, Boris's credentials must be authenticated in the confines of Partner's identity domain before the SOAP request is sent to the Web service. At the receiving end, the ACME Web service will not authenticate Boris's credentials directly; instead, it requires a satisfactory proof of authentication before letting Boris's SOAP request through (see Figure 1).

This mechanism where one entity delegates authentication and/or authorization to another entity is known as "identity federation."

SAML Holder-of-Key
SAML describes different scenarios that allow for identity federation. Let's first look at the holder-of-key approach (see Figure 2).

By now you may have heard of WS-Trust. WS-Trust defines the syntax that Boris uses to request a SAML Security Token. Simply put, Boris sends a RequestSecurityToken SOAP request to Partner's internal Security Token Service. The token service authenticates Boris's credentials according to its own policy and returns a RequestSecurityTokenResponse that includes the SAML Signed Security Token. So far, all of this is happening inside Partner's domain.

A SAML assertion can make different types of statements about a subject: Authentication Statements, Attribute Statements, and Authorization Decision Statements. In this case, Partner's Security Token Service will make an Authentication Statement regarding the subject of the SAML assertion: Boris.

The issuing authority digitally signs the SAML assertion, and this constitutes the basis on which trust is established. Boris binds this SAML assertion to his outgoing SOAP requests. He can reuse the same assertion for future SOAP requests as long as it remains valid (the validity of a SAML assertion is typically very short). The process of binding the SAML assertion to an outgoing SOAP message involves Boris's including the SAML assertion in the SOAP message's header and signing the message with his private key. The SAML assertion includes a SubjectConfirmation element that contains a client certificate for Boris's private key. In order for the receiving end to confirm that the message is sent by the owner of the SAML assertion, it will verify the digital signature of the message using the certificate that is part of the SAML assertion's SubjectConfirmation element.

This process prevents an attacker from sniffing the SAML assertion and using it to impersonate Boris. Similarly, an attacker would not be able to substitute his own certificate inside Boris's SAML assertion, because this would break the issuer's digital signature, and the assertion would become invalid.

Back at ACME, the Web service is configured to trust Partner's Token Service as an issuing authority. Practically, the digital signature that is part of the SAML assertion can be verified using the digital certificate of the issuing authority. The certificate of the issuing authority is what the Web service needs to be configured with to allow trust of the authentication claims and thus, identity federation with Partner.

At run time, the Web service verifies the signature of the SAML assertion, checks that it trusts this particular issuing authority, then checks that the message is received within the validity period of the SAML assertion, then verifies the signature of the message itself (Boris's signature), and finally, checks that the signature uses the same cert as the one specified by the holder-of-key SAML assertion.

SAML Sender-Vouches
The sender-vouches approach's main difference over holder-of-key is that the issuing authority also acts as the sender of the message to the Web service. Boris sends his message to an issuing authority, which also acts as a proxy by forwarding the message to the ACME Web service. In this case, the SOAP message is signed by the issuing authority directly and the receiving end only needs to validate one signer.

Flexible, Centralized Trust
In practical terms, the trust of an issuing authority will require the Web service to be configured with the digital certificate used to sign those SAML assertions. The Web service may also want to keep a list of remote subjects as opposed to blindly letting through any identity authenticated by the issuing authority. You may want to allow Boris through, but nobody else from Partner for now. Alternatively, you may want to federate authorization as you did with authentication so far (refer to SAML Authorization Decision Statements for more details). In any case, these implementation details of the Web service reflect the particularities of a real business relationship.

Back at ACME, a new business relationship may require establishing trust with a different issuing authority, which in turns necessitates a change to the Web service. Suppose there is a new partner (let's call him "Partner B") who uses a proxy-like approach and does not support SAML holder-of-key (only sender-vouches), and our Web service was expecting holder-of-key up until now. Boris may have left Partner for greener pastures, and his responsibilities have shifted to Maurice.

Such events necessitate maintenance on the Web service. Perhaps this means an unfortunate interruption of service. If ACME now exposes multiple Web services, each implementing its own trust and authorization management, any change to business relationships could require maintenance in each of these Web services. In addition to the interruption of service and the potential risk associated with any Web service changes, there is the issue of cost for each cycle of development, quality assurance, and deployment.

Still, just as business relationships are expected to change over time, so too will the implementation details of the Web service that pertains to trust and authorization - or will they? If trust and authorization are not closely linked to the Web service's application logic (as would typically be expected), then they should be abstracted out and handled by a centralized policy enforcement point.

By letting an XML gateway enforce the authentication and authorization rules, changes to these policies become an administrative task that does not require changes to the Web service, nor service interruption. Adding or removing trust of an issuing authority is but a mouse click away. XML gateways that support SAML-based identity federation transform software maintenance nightmares into security manager dreams (see Figure 3).

More Stories By Francois Lascelles

As Layer 7’s Chief Architect, Francois Lascelles guides the solutions architecture team and aligns product evolution with field trends. Francois joined Layer 7 in the company’s infancy – contributing as the first developer and designing the foundation of Layer 7’s Gateway technology. Now in a field-facing role, Francois helps enterprise architects apply the latest standards and patterns. Francois is a regular blogger and speaker and is also co-author of Service-Oriented Infrastructure: On-Premise and in the Cloud, published by Prentice Hall. Francois holds a Bachelor of Engineering degree from Ecole Polytechnique de Montreal and a black belt in OAuth. Follow Francois on Twitter: @flascelles

Comments (3) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Most Recent Comments
XML News Desk 12/16/05 09:01:53 PM EST

XML Journal: Flexible Identity Federation XML Gateways to The Rescue. Imagine a fresh business relationship between ACME Corporation and Partner. As a result of this relationship, ACME wants to grant Partner limited access to one of its core internal applications. They do this, naturally, by exposing a Web service.

SYS-CON Brazil News Desk 12/16/05 08:31:37 PM EST

Flexible Identity Federation XML Gateways to The Rescue. Imagine a fresh business relationship between ACME Corporation and Partner. As a result of this relationship, ACME wants to grant Partner limited access to one of its core internal applications. They do this, naturally, by exposing a Web service.

SYS-CON Belgium News Desk 12/16/05 07:41:32 PM EST

Flexible Identity Federation XML Gateways to The Rescue. Imagine a fresh business relationship between ACME Corporation and Partner. As a result of this relationship, ACME wants to grant Partner limited access to one of its core internal applications. They do this, naturally, by exposing a Web service.

@ThingsExpo Stories
Mobile device usage has increased exponentially during the past several years, as consumers rely on handhelds for everything from news and weather to banking and purchases. What can we expect in the next few years? The way in which we interact with our devices will fundamentally change, as businesses leverage Artificial Intelligence. We already see this taking shape as businesses leverage AI for cost savings and customer responsiveness. This trend will continue, as AI is used for more sophistica...
SYS-CON Events announced today that SourceForge has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. SourceForge is the largest, most trusted destination for Open Source Software development, collaboration, discovery and download on the web serving over 32 million viewers, 150 million downloads and over 460,000 active development projects each and every month.
SYS-CON Events announced today that Interface Corporation will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Interface Corporation is a company developing, manufacturing and marketing high quality and wide variety of industrial computers and interface modules such as PCIs and PCI express. For more information, visit http://www.i...
SYS-CON Events announced today that mruby Forum will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. mruby is the lightweight implementation of the Ruby language. We introduce mruby and the mruby IoT framework that enhances development productivity. For more information, visit http://forum.mruby.org/.
In his session at @ThingsExpo, Greg Gorman is the Director, IoT Developer Ecosystem, Watson IoT, will provide a short tutorial on Node-RED, a Node.js-based programming tool for wiring together hardware devices, APIs and online services in new and interesting ways. It provides a browser-based editor that makes it easy to wire together flows using a wide range of nodes in the palette that can be deployed to its runtime in a single-click. There is a large library of contributed nodes that help so...
What is the best strategy for selecting the right offshore company for your business? In his session at 21st Cloud Expo, Alan Winters, U.S. Head of Business Development at MobiDev, will discuss the things to look for - positive and negative - in evaluating your options. He will also discuss how to maximize productivity with your offshore developers. Before you start your search, clearly understand your business needs and how that impacts software choices.
SYS-CON Events announced today that Mobile Create USA will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Mobile Create USA Inc. is an MVNO-based business model that uses portable communication devices and cellular-based infrastructure in the development, sales, operation and mobile communications systems incorporating GPS capabi...
While some developers care passionately about how data centers and clouds are architected, for most, it is only the end result that matters. To the majority of companies, technology exists to solve a business problem, and only delivers value when it is solving that problem. 2017 brings the mainstream adoption of containers for production workloads. In his session at 21st Cloud Expo, Ben McCormack, VP of Operations at Evernote, will discuss how data centers of the future will be managed, how th...
There is huge complexity in implementing a successful digital business that requires efficient on-premise and cloud back-end infrastructure, IT and Internet of Things (IoT) data, analytics, Machine Learning, Artificial Intelligence (AI) and Digital Applications. In the data center alone, there are physical and virtual infrastructures, multiple operating systems, multiple applications and new and emerging business and technological paradigms such as cloud computing and XaaS. And then there are pe...
SYS-CON Events announced today that MIRAI Inc. will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. MIRAI Inc. are IT consultants from the public sector whose mission is to solve social issues by technology and innovation and to create a meaningful future for people.
SYS-CON Events announced today that Keisoku Research Consultant Co. will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Keisoku Research Consultant, Co. offers research and consulting in a wide range of civil engineering-related fields from information construction to preservation of cultural properties. For more information, vi...
SYS-CON Events announced today that Massive Networks, that helps your business operate seamlessly with fast, reliable, and secure internet and network solutions, has been named "Exhibitor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. As a premier telecommunications provider, Massive Networks is headquartered out of Louisville, Colorado. With years of experience under their belt, their team of...
SYS-CON Events announced today that Enroute Lab will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Enroute Lab is an industrial design, research and development company of unmanned robotic vehicle system. For more information, please visit http://elab.co.jp/.
SYS-CON Events announced today that Ryobi Systems will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Ryobi Systems Co., Ltd., as an information service company, specialized in business support for local governments and medical industry. We are challenging to achive the precision farming with AI. For more information, visit http:...
Real IoT production deployments running at scale are collecting sensor data from hundreds / thousands / millions of devices. The goal is to take business-critical actions on the real-time data and find insights from stored datasets. In his session at @ThingsExpo, John Walicki, Watson IoT Developer Advocate at IBM Cloud, will provide a fast-paced developer journey that follows the IoT sensor data from generation, to edge gateway, to edge analytics, to encryption, to the IBM Bluemix cloud, to Wa...
SYS-CON Events announced today that Fusic will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Fusic Co. provides mocks as virtual IoT devices. You can customize mocks, and get any amount of data at any time in your test. For more information, visit https://fusic.co.jp/english/.
SYS-CON Events announced today that B2Cloud will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. B2Cloud specializes in IoT devices for preventive and predictive maintenance in any kind of equipment retrieving data like Energy consumption, working time, temperature, humidity, pressure, etc.
SYS-CON Events announced today that NetApp has been named “Bronze Sponsor” of SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. NetApp is the data authority for hybrid cloud. NetApp provides a full range of hybrid cloud data services that simplify management of applications and data across cloud and on-premises environments to accelerate digital transformation. Together with their partners, NetApp em...
Elon Musk is among the notable industry figures who worries about the power of AI to destroy rather than help society. Mark Zuckerberg, on the other hand, embraces all that is going on. AI is most powerful when deployed across the vast networks being built for Internets of Things in the manufacturing, transportation and logistics, retail, healthcare, government and other sectors. Is AI transforming IoT for the good or the bad? Do we need to worry about its potential destructive power? Or will we...
SYS-CON Events announced today that SIGMA Corporation will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. uLaser flow inspection device from the Japanese top share to Global Standard! Then, make the best use of data to flip to next page. For more information, visit http://www.sigma-k.co.jp/en/.