# Presentation: 573816

## caGridWebSSO

***caGrid Web Single Sign On ***

- Kunal Modi
**January 2008**

## Agenda

**Introduction (3 min)**
- Team Members
- What is Single Sign On
- Web Single Sign On (WebSSO) Project
**Overview (7 min)**
- Components of WebSSO Solution
- Establish the SSO Session Workflow
**Installation/ Configuration of the WebSSO Server (2 min)**
**Integration of the WebSSO Client (3 min)**
**Accessing WebSSO Attributes(2 min)**
**Information (2 min)**

## Team Members

**Kunal Modi**
- Team Lead – Ekagra Software Technologies Ltd.
**David Wu**
- Project Manager – Booz Allen Hamilton
**Steve Langella**
- Ohio State University
**Scott Oster**
- Ohio State University
**Joshua Phillips**
- Semanticbits, LLC

## What is Single Sign On

**Ability for a user to login into single application and then navigate to another application within the same realm without being challenged for credentials during that browser session**
**Traditionally, SSO solutions deal with maintaining a single logged in session amongst web applications only**
**In Grid domain, this signed-in session should be extended allowing the users to invoke grid services without providing their credentials again.**

## Web Single Sign On (WebSSO) Project

**The Web Single Sign On (WebSSO) Project is effort to provide the Single Sign On capabilities for the web applications as well the grid services using a single solution**
**Uses the caGrid’s GAARDS framework in back end to authenticate and validate the user**
**Allows users to use single set of local credentials to both navigate amongst different web applications and also invoke various grid services**
**Provides an automated mechanism for delegation and retrieval of user’s grid credentials there by avoiding transfer of grid credentials around**
**Built on top of JA-SIG’s Central Authentication Service (CAS) which provides the core Single Sign On capability**

## Components of WebSSO Solution

**WebSSO Server**
- Installed centrally in a separate web container
- Responsible for establishing the Single Sign On Session
- Interacts with Authentication Service (IdP) to validate user’s local credentials
- Interacts with Dorian (IFS) to obtain user’s grid credentials
- Prepares a delegation policy describing which host identities can obtain user’s grid credentials and publish it in the Central Delegation Service (CDS)
**WebSSO Client**
- Integrated with each target web application in the SSO realm
- Responsible for checking if a Single Sign On session has been established or not. If not, then route the user to WebSSO Server for authentication
- Once authenticated and Single Sign On session established, the WebSSO client connects and retrieves user’s attributes as well grid credential

## Establish the SSO Session Workflow

- Authentication Service

- Dorian

- Delegation Service

- Target
- WebApp

**1. User Request**

**2. Credentials**

**3. Credentials**

**4. SAML**

**5. SAML**

**6. Grid Proxy**

**8. Delegation Policy (Grid Proxy)**

**10. Single Sign **
**On Ticket**

**14. Grid Proxy**

**15. User Attribute**
**+ Grid Proxy**

- CLIENT

- WEB

- GRID

- Grid Service A

**16. Grid Proxy**

**13. Delegation EPR**

**11. Single Sign **
**On Ticket**

**12. User **
**Attributes**
**Assertion**

- GTS

**7. Validate**

**9. Delegation**
**              ****EPR**

## Installation/Configuration of WebSSO Server

**Obtain the WebSSO Server Release from caGrid Download Center**
**Configure the WebSSO Properties**
- Configure the Authentication Service Information (IdP)
- Configure the Dorian Information (IFS)
- Provide list of Host Identities to which the User’s Grid Credentials are to be delegated
- Configure the Delegation Service (CDS) which would hold the delegation policy
**Build the WebSSO Project**
**Deploy the Server Web Application into a web container**
**Secure the Web Container for SSL**

## Integration of WebSSO Client

**Obtain the WebSSO Client Release from the caGrid Download Center**
**Copy all the jar files in your web application’s lib directory**
**Configure WebSSO Filters into your web application’s web.xml file**
- Provide the path to Host’s cert and key file (used for connecting to delegation service)
**Configure WebSSO Client to talk to the WebSSO Server via the cas.properties file**
**Copy & Install the Server certificates to facilitate SSL**
**Deploy your web application with WebSSO Client embedded inside into the web container**

## Accessing WebSSO Attributes

**WebSSO Client retrieves User’s Attributes from the WebSSO Server**
**It also retrieves User’s Grid Credentials from the Central Delegation Service (CDS)**
**All these attributes and grid credentials are stored in the HTTP Session of the user as session attributes**
**Following is list of attributes which are available to the application for retrieval from the HTTP Session**
- User’s First Name
- User’s Last Name
- User’s Email Id
- User’s Grid Identity
- User’s Grid Credential
- End Point Reference to the published Delegation Policy in CDS

## Information

**Wiki**
- http://www.cagrid.org/mwiki/index.php?title=WebSSO:Web_Single_Sign_On
**Documentation**
- http://gforge.nci.nih.gov/plugins/scmcvs/cvsweb.php/cagrid-1-0/Documentation/docs/security/sso/?cvsroot=cagrid-1-0
**Download**
- <<TBD>>
**- Thank You**