Attribute Authorities, Sites, Targets,

1
Attribute Authorities, Sites, Targets, SHARs

• Marlena Erdos
• March 5, 2001

2
Outline of Talk

• Picture (high-level)
• Purpose of an Attribute Authority
• Attribute Release Policies (high-level)
• Inter-institutional Agreements
• User choice
• Discussion of Site Target SHAR

3
Destination
Origin (Brown U)
Resource
Shibb Attribute Requestor (SHAR)
Steven Camody Staff David Cooper
Faculty Marlena Erdos Alum
Resource
Resource
Site Foo
Attribute Authority
Shibb Attribute Requestor (SHAR)
Resource
Resource
Browser User
HTTPS
Site Bar
4
Components at the Origin Site
AuthN System
Attr Authority
Browser
5
HTTP Server
SHAR (protocol engine)
Components at the target site
Policy Decision Point (PDP)
5
Resource Manager Proxy
PEP
Resource Manager resources
PEP
1
4
6
7
2
3
Attribute Mapper
Policy Decision Point (PDP)
6
Purpose of an Attribute Authority

• Official source of attributes about a user
• Sends user attributes to legitimate Shibb
  Attribute Requestors (Shars)
• Attributes should be packaged to be
• Tamper-evident
• Possibly confidential
• Hard to replay

7
Attribute Release Policies

• Inter-Institutional Agreements
• E.g. University and commercial database
• Pre-defined attributes for access
• Defined Out-of-Band
• Likely to be member of not identity
• User choice
• Choose what attrs get sent and not sent
• E.g. No EPPN
• Choose based on destination

8
Sites Targets Outline

• Intro
• What is a target?
• Syntax
• Examples
• Semantics
• More examples

9
Sites and Targets Intro

• These definitions apply at the AA only!
• Purpose
• Allow inter-institutional agreements
• Allow user choice

10
What (and why) is a Target?

• A Target is a means of attaching an Attribute
  Release Policy to a set of related resources.
• The Target definition lists
• A set of related resources
• The SHAR for these resources
• The user attributes to be released to the SHAR

11
Sites Targets Syntax

• Target Definition Syntax
• URL
• Site SHAR PKI Name
• Site SHAR Public Key (plus other PKI parameters)
• Attribute Release Policy

12
Target Example Inter-institutional Agreement

• Target at Browns AA for Tractors Were Us, a
  supplier of information about antique farm
  equipment.
• URL www.twu.com/all
• Site SHAR Name twu.com
• Site SHAR Public Key lt123ab98cgt
• Attr Release Policy member of community

13
Target SyntaxWhat does it mean

• The URL refers to all resources below it
• www.twu.com/all includes
• www.twu.com/all/plows
• www.twu.com/all/plows/ancient
• www.twu.com/all/tractors/JohnDeere
• Etc ..
• BUT, a more specific target will win out!

14
Target Example User Choice

• Steven Carmody
• an expert on antique tractors
• has a special relationship with TWU
• he administrates part of their site
• he needs to send his identity
• Steve sets up his own TWU target

15
Stevens TWU Target

• URL www.twu.com/all/tractors/admin
• Site SHAR Name twu.com
• Site SHAR Public Key lt123ab98cgt
• Attr Release Policy EPPN member of
  community

16
Semantics of Targets

• The URL refers to a set of resources
• resources are in a naming tree
• Attribute Release Policy applies to entire set
• Same Shibb Attribute requestor for all
• PKI name/public key identifies the right
  requestor for the set of resources

17
Implications via Example Best Fit URL

• Steven visits www.twu/all/tractors/JohnDeere
• The SHAR at TWU speaks to the Brown AA
• The AA validates that TWU can ask for attrs.
• The AA looks for the best target match for the
  requested URL
• The AA returns member of community

18
Best Fit Target URL Matches

• Inter-Institutional Target
• URL www.twu.com/all
• Stevens Target
• URL www.twu.com/all/tractors/admin
• Steve requested www.twu.com/all/tractors
• The Inter-Institutional Target is the best match

19
Implications (cont)Caching

• Steven sees an error on the John Deere Page. He
  wants to correct it. He next tries to visit
• www.twu/all/tractors/admin/update
• What happens?

20
Caching

• TWUs SHAR cached attrs from Stevens last
  access.
• It has member of community_at_brown.edu
• It tries the access with this attribute.
• The access fails.
• The TWU SHAR should attempt to retrieve a new
  set of attrs

21
Caching (cont)

• If TWUs SHAR does attempt to retrieve attrs
  again ...
• Stevens own target is the best match
• URL www.twu/all/tractors/admin
• The Brown AA will send back
• Steven Carmody Member of community
• The access will succeed (in this case)

22
Caching

• If Steven had visited the admin part of the
  site first, then even when he visited the plow
  part of TWU, his EPPN would likely be handed over
  to the resource manager for the plow.
• Implication Users must understand that a given
  SHAR may send any attributes it gets to any
  resources it is the SHAR for.
• Surfing order matters!