Project DIRECT.ppt

Providing Authentication (cont’d)
• Install and configure Advanced Security
– Import policy store classes into directory using LDIF
• Can use same or different directory as for users
Project DIRECT
Directory of Edinburgh University Corporate Topography
john.smith@
Deliverables
• Joint project between EUCS and MIS • LDAP directory
Authentication SCWEIMS Portal
• Student Centric Web-based Educational and Instructional Management System • Funded by SHEFC • Uses Cold Fusion as the application server and Oracle or SQL Server as the data warehouse • Runs on either Solaris or NT/Win2K • Roll out Autumn 2001
Providing Authentication
• Cold Fusion Advanced Security • Uses Netegrity’s SiteMinder product
– Supports many vendors directory server products
• Allows use of LDAP enabled directory for:
•
Use ACL’s to implement security policy
– –
• •
iPlanet specific features
–
Missing and inaccessible data is an issue
Sample ACL
dn: ou=people, dc=ed, dc=ac, dc=uk changetype: modify add: aci aci: (target="ldap:///uid=*, ou=people, dc=ed, dc=ac, dc=uk") (targetfilter ="(edupersonaffiliation=student)") (targetattr="cn || sn || mail || telep honenumber") (version 3.0; acl "local permit of student details"; all ow (read, search, compare) userdn = "ldap:///anyone" and dns = "*.ed.ac.u k";)
• iPlanet Directory server v4.n • Includes eduPerson object class
– Widely used attributes in higher education
• Uses domain component naming
dc=ed,dc=ac,dc=uk
– Sun, Oracle, Novell, Microsoft
• Database optimised for reading with entries as attribute value pairs • Provide sophisticated filtering capabilities
The Directory Server
– Authentication and authorisation – All individuals know to University – Generated from relational database
• Authentication services for SCWEIMS portal () • Investigate linking up with NDS and ADS
– Staff
• Significant numbers of casual and non-paid staff at all levels
• Grey members
– Visitors, guests, consultants, retirees etc.
Directory Services
– – – – Database uses attribute names for table column names Based on student and staff corporate systems Daily full and incremental loads for staff and students Directory is automatically updated each day using cron scripts. – Directory performance poor whilst updating
– Configure SiteMinder to use LDAP as policy store – Define “User Directory” – Create a “Security Context” – Define “Rules” and “Policies” for “Resources”
Example of eduPerson
dn: uid= John Smith - 1852, ou=people, dc=ed, dc=ac, dc=uk changetype: add objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson objectclass: eduPerson cn: John Smith sn: Smith departmentNumber:356 displayName: John Smith employeetype: Staff givenName: John initials: JS l: "MAIN LIBRARY","GEORGE SQUARE","EH8 9LJ","","" preferredLanguage: en edupersonAffiliation: Staff edupersonnickname: John eduPersonOrgDN: dc=ed, dc=ac, dc=uk eduPersonOrgUnitDN: ou=people, dc=ed, dc=ac, dc=uk employeeNumber: 1852
The CFML Code
• <CFAUTHENTICATE> tag to handle authentication to LDAP
<!--authenticate the user ---> <cftry> <!--- use error trapping ---> <cfauthenticate securitycontext="#attributes.security_context#" username="#ername#" password="#attributes.password#"> <cfcatch type="Security"> <!--- if we catch an error send email ---> <cfmail to="#emailfooter#" from="#emailfooter#" subject="LDAP Demo - authentication failure"> The LDAP Demo application authentication produced the following output: #cfcatch.message# at #nowtime# on #nowdate# Remote host: #CGI.remote_addr# User Agent: #CGI.http_user_agent# </cfmail> </cfcatch> </cftry>
• Everyone is in the “people” bucket
– Avoids admin overhead of complex DIT
dn: cn=jsmith,ou=people,dc=ed,dc=ac,dc=uk
Populating the Directory
• Directory management is via LDIF files • LDIF files produced from Oracle “people” database using sqlplus job
– User authentication – Policy Store - what authenticated users can do
• Single-stop authentication and authorisation mechanism for multiple applications