CIS 2015- Beyond Federation Protocols- Praerit Garg
3 likes499 views
The document discusses the evolution of federated identity protocols over the past 10+ years. While OAuth 2.0 is now widely adopted for federating web identities, the document argues that federation protocols alone are not sufficient. It suggests that applications also need ways to: 1) scope trust with federated identity providers, 2) provision access for federated identities, and 3) enable collaboration across federated identities. The document calls on the audience to build on existing work and find standards-based solutions to make these capabilities easier.
CIS 2015- Beyond Federation Protocols- Praerit Garg
- 2. Beyond Federation Protocols Praerit Garg GM, AWS Identity & Directory Services
- 3. Copyright © 2015 Cloud Identity Summit . All rights reserved. 3 Rewinding the clock… Infoworld, July 2002 “In a talk here at the Burton Group Catalyst Conference 2002, Praerit Garg, Microsoft group program manager, detailed the company's vision for federated security, which will in the future include room for SAML (Security Assertion Markup Language).” Infoworld, July 2002
- 4. Copyright © 2015 Cloud Identity Summit . All rights reserved. 4 10+ Years, 2 career detours later…
- 5. Copyright © 2015 Cloud Identity Summit . All rights reserved. 5 Google search for federation yields… OAuth 2.0 is broadly adopted for federating Web Identities – Google, Facebook, Amazon, Microsoft, Twitter*, … OAuth2 SAML Assertions support is standards track and gaining traction But, SAML is DEAD! (OpenID Connect is the future) 97% OF SAAS VENDORS BACKING SAML-BASED SINGLE SIGN-ON Cloud Security Alliance and OneLogin Survey, 2014 OAuth Wikipedia Page Craig Burton IETF, Phil Hunt’s blog, Salesforce
- 6. Copyright © 2015 Cloud Identity Summit . All rights reserved. 6 Federated Identities are now powering the Cloud Economy Congratulations and Thank You!
- 7. Copyright © 2015 Cloud Identity Summit . All rights reserved. 7 But… Have we simply adapted Kerberos protocols for the web? Replaced ASN.1 encoding with XML and now JSON? I HEARD YOU LIKE ASN.1 SO I PUT AN OCTET STRING IN YOUR OCTET STRING SO YOU CAN PARSE WHILE YOU PARSE
- 8. Copyright © 2015 Cloud Identity Summit . All rights reserved. 8 Unfortunately, federation protocols aren’t sufficient (those pesky “assertions” or “claims” matter)
- 9. Copyright © 2015 Cloud Identity Summit . All rights reserved. 9 1. Apps need to scope the trust with federated IDPs?
- 10. Copyright © 2015 Cloud Identity Summit . All rights reserved. 10 Mapping SAML Attributes to AWS Policy Keys
- 11. Copyright © 2015 Cloud Identity Summit . All rights reserved. 11 Federating using AWS Directory Service
- 12. Copyright © 2015 Cloud Identity Summit . All rights reserved. 12 2. Apps need to provision access for a federated Ids?
- 13. Copyright © 2015 Cloud Identity Summit . All rights reserved. 13 3. Apps need to enable collaboration experiences across federated identities?
- 14. Copyright © 2015 Cloud Identity Summit . All rights reserved. 14 Call to Action • Build on the great work you’ve all done thus far • Find standards based solutions to • make it easy to setup federated trust policies • make it easy to provision access to federated identities – e.g. identity lookups • make it easy to enable collaboration experiences across federated identities – e.g. identity search