5:13 a.m.
Hello all,
Just looking at how I could make use of PicketLink withing AS7 and have
a couple of questions.
For Digest based authentication mechanisms I see there is some initial
support but I have a couple more requirements I will raise separately.
The next area I am looking into is SSL and Client Cert style
authentication - a couple of things I am interested in here is - is
there a capability to take a certificate, validate it and then return
the identity of the user from that certificate? i.e. I am not looking
to load the user first and then validate the certificate.
Secondly in this area could it be conceivable to implement a
X509TrustStore that is backed by PicketLink? If we could obtain all
validate certificates or the certificate of a CA we could create
somethign in advance but I am interested in if we could have something
more dynamic.
Following on from this I have one more case that I am not sure if it
would fit within an IDM or if we would handle it outside first and only
access the IDM once we have verified the user and that is GSSAPI/SPNEGO
style authentication. In this case we receive one or more tokens from a
user and send one or more challenges back to the user - at the end of
this authentication process we know the identity of the user.
Also interested in knowing if anyone else has other authentication
scenarios identified where all we may have is the 'Credential' and the
user is not identified until after this has been verified.
Regards,
Darran Lofthouse.
9:35 a.m.
On 11/29/2012 6:13 AM, Darran Lofthouse wrote:
Hello all,
Just looking at how I could make use of PicketLink withing AS7 and have
a couple of questions.
For Digest based authentication mechanisms I see there is some initial
support but I have a couple more requirements I will raise separately.
The next area I am looking into is SSL and Client Cert style
authentication - a couple of things I am interested in here is - is
there a capability to take a certificate, validate it and then return
the identity of the user from that certificate? i.e. I am not looking
to load the user first and then validate the certificate.
Its pretty simple to write. I'll be writing LoginModule to support this
very soon (HTTPS only). You just want cert validation right? Do you
need access to the cert? Or can you just get the principal String name?
Secondly in this area could it be conceivable to implement a
X509TrustStore that is backed by PicketLink? If we could obtain all
validate certificates or the certificate of a CA we could create
somethign in advance but I am interested in if we could have something
more dynamic.
At least for HTTPS, I've found that JBossWeb does the validation of the
client-cert if you provide it a truststore.
Following on from this I have one more case that I am not sure if it
would fit within an IDM or if we would handle it outside first and only
access the IDM once we have verified the user and that is GSSAPI/SPNEGO
style authentication. In this case we receive one or more tokens from a
user and send one or more challenges back to the user - at the end of
this authentication process we know the identity of the user.
I'm doing a bunch of work with OAuth and bearer tokens with the ability
to throw in client-certs as an extra auth mechanism.
http://bill.burkecentral.com/2012/11/21/scoping-out-resteasy-skeleton-key...
I should have a prototype up by christmas.
Also interested in knowing if anyone else has other authentication
scenarios identified where all we may have is the 'Credential' and the
user is not identified until after this has been verified.
Yes, I have this problem as well. I want a bearer token that can travel
and be forwarded to multiple endpoints, be verified through PKI, have
all the role grants within the token, and have the identity of the
caller verfied through client-cert validation. This allows services to
be totally stateless with regards to security metadata/identity and to
receive permissions per-request. All they need is a truststore.
Granted this is HTTP only, but I've prototyped it already:
https://github.com/patriot1burke/Resteasy/tree/master/jaxrs/security/skel...
Bill
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
10:01 a.m.
Hello Bill,
On 11/29/2012 03:35 PM, Bill Burke wrote:
On 11/29/2012 6:13 AM, Darran Lofthouse wrote:
> Hello all,
>
> Just looking at how I could make use of PicketLink withing AS7 and have
> a couple of questions.
>
> For Digest based authentication mechanisms I see there is some initial
> support but I have a couple more requirements I will raise separately.
>
> The next area I am looking into is SSL and Client Cert style
> authentication - a couple of things I am interested in here is - is
> there a capability to take a certificate, validate it and then return
> the identity of the user from that certificate? i.e. I am not looking
> to load the user first and then validate the certificate.
Its pretty simple to write. I'll be writing LoginModule to support this
very soon (HTTPS only). You just want cert validation right? Do you
need access to the cert? Or can you just get the principal String name?
Whilst it is possible in most situations to identify a name from the
certificate what I would like is to eliminate this if it is not strictly
necessary.
So at the connection level trust would have already been established on
the connection as that negotiation process would have included
verification with a X509TrustStore but then to identify the User I just
want to pass in the Certificate and have the user returned - or
something along those lines.
> Secondly in this area could it be conceivable to implement a
> X509TrustStore that is backed by PicketLink? If we could obtain all
> validate certificates or the certificate of a CA we could create
> somethign in advance but I am interested in if we could have something
> more dynamic.
>
At least for HTTPS, I've found that JBossWeb does the validation of the
client-cert if you provide it a truststore.
Yes that is the scenario I am looking into but rather than providing a
file based truststore I want to be creating a SSLContext instance that
is initialised using a X509TrustStore that is in turn backed by PicketLink.
> Following on from this I have one more case that I am not sure if
it
> would fit within an IDM or if we would handle it outside first and only
> access the IDM once we have verified the user and that is GSSAPI/SPNEGO
> style authentication. In this case we receive one or more tokens from a
> user and send one or more challenges back to the user - at the end of
> this authentication process we know the identity of the user.
>
I'm doing a bunch of work with OAuth and bearer tokens with the ability
to throw in client-certs as an extra auth mechanism.
http://bill.burkecentral.com/2012/11/21/scoping-out-resteasy-skeleton-key...
I should have a prototype up by christmas.
> Also interested in knowing if anyone else has other authentication
> scenarios identified where all we may have is the 'Credential' and the
> user is not identified until after this has been verified.
>
Yes, I have this problem as well. I want a bearer token that can travel
and be forwarded to multiple endpoints, be verified through PKI, have
all the role grants within the token, and have the identity of the
caller verfied through client-cert validation. This allows services to
be totally stateless with regards to security metadata/identity and to
receive permissions per-request. All they need is a truststore.
Granted this is HTTP only, but I've prototyped it already:
That does sound similar, also similar to something else we are working
on within AS so thanks for the link I will take a closer look.
10:18 a.m.
On 11/29/2012 11:01 AM, Darran Lofthouse wrote:
Hello Bill,
On 11/29/2012 03:35 PM, Bill Burke wrote:
>
>
> On 11/29/2012 6:13 AM, Darran Lofthouse wrote:
>> Hello all,
>>
>> Just looking at how I could make use of PicketLink withing AS7 and have
>> a couple of questions.
>>
>> For Digest based authentication mechanisms I see there is some initial
>> support but I have a couple more requirements I will raise separately.
>>
>> The next area I am looking into is SSL and Client Cert style
>> authentication - a couple of things I am interested in here is - is
>> there a capability to take a certificate, validate it and then return
>> the identity of the user from that certificate? i.e. I am not looking
>> to load the user first and then validate the certificate.
>
> Its pretty simple to write. I'll be writing LoginModule to support this
> very soon (HTTPS only). You just want cert validation right? Do you
> need access to the cert? Or can you just get the principal String name?
Whilst it is possible in most situations to identify a name from the
certificate what I would like is to eliminate this if it is not strictly
necessary.
So at the connection level trust would have already been established on
the connection as that negotiation process would have included
verification with a X509TrustStore but then to identify the User I just
want to pass in the Certificate and have the user returned - or
something along those lines.
Ah, ok, I thought you were talking about something different. I just
had a need for a LoginModule that just pulled a verified cert and
created a Principal using the X500Name of the verified client-cert. No
user lookup with any identity-manager (local or remote), just
verification of the cert.
>> Secondly in this area could it be conceivable to implement a
>> X509TrustStore that is backed by PicketLink? If we could obtain all
>> validate certificates or the certificate of a CA we could create
>> somethign in advance but I am interested in if we could have something
>> more dynamic.
>>
>
> At least for HTTPS, I've found that JBossWeb does the validation of the
> client-cert if you provide it a truststore.
Yes that is the scenario I am looking into but rather than providing a
file based truststore I want to be creating a SSLContext instance that
is initialised using a X509TrustStore that is in turn backed by PicketLink.
That would be cool. Then you could match up specific security domains
to specific certificates. In other words, create a mapping between
security domains and various certificate attributes. Then cert
verification could be delegated to a security domain.
Good luck getting this ability in JBoss Web though :) Personally I'm
working around what's there.
Bill
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
10:03 a.m.
----- Original Message -----
From: "Darran Lofthouse"
<darran.lofthouse(a)jboss.com>
To: security-dev(a)lists.jboss.org
Sent: Thursday, November 29, 2012 9:13:04 AM
Subject: [security-dev] PicketLink Capabilities - Authentication
Hello all,
Just looking at how I could make use of PicketLink withing AS7 and
have
a couple of questions.
For Digest based authentication mechanisms I see there is some
initial
support but I have a couple more requirements I will raise
separately.
That would be nice.
The next area I am looking into is SSL and Client Cert style
authentication - a couple of things I am interested in here is - is
there a capability to take a certificate, validate it and then return
the identity of the user from that certificate? i.e. I am not
looking
to load the user first and then validate the certificate.
Today we have no such capability. We load the user using the information from the
certificate (eg.: the principal) and then validate the cert. But we can write something
considering what you want. Maybe using the picketbox-keystore project (see bellow).
You can also configure the mechanism to trust the cert if the principal is stored in IDM
(no cert checking). The use case for that is when you're using HTTPs and the server
already validated the certificate.
Secondly in this area could it be conceivable to implement a
X509TrustStore that is backed by PicketLink? If we could obtain all
validate certificates or the certificate of a CA we could create
somethign in advance but I am interested in if we could have
something
more dynamic.
I think picketlink-keystore can help with that. Maybe Anil can give more details about
this project. It uses a database-based Java Keystore.
Following on from this I have one more case that I am not sure if it
would fit within an IDM or if we would handle it outside first and
only
access the IDM once we have verified the user and that is
GSSAPI/SPNEGO
style authentication. In this case we receive one or more tokens
from a
user and send one or more challenges back to the user - at the end of
this authentication process we know the identity of the user.
I started to write a GSSAPI/Kerberos (reusing somethings from JBoss Nego) authentication
mechanism. Basically, it expects a token to validate it against a KDC. The IDM kicks in
when the user is authenticated and we need to get his information from the store such as
roles, groups, attributes, etc.
Also interested in knowing if anyone else has other authentication
scenarios identified where all we may have is the 'Credential' and
the
user is not identified until after this has been verified.
Regards,
Darran Lofthouse.
_______________________________________________
security-dev mailing list
security-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/security-dev
5037
days inactive
5037
days old
4 comments
3 participants
participants (3)
-
Bill Burke -
Darran Lofthouse -
Pedro Igor Silva