�ݺ�ߣ

Workshop: Advanced Federation
Use-Cases with PingFederate

Craig Wu - Director, Product Development
Peter Motykowski - Senior Engineer/Developer

Agenda

• Introductions

• New Features Overview
– OAuth
– Adaptive Federation
– PingFederate 6.7 and beyond

2 Copyright © 2011. Cloud Identity Summit. All Rights Reserved.

Agenda

• Demos
– OAuth Authorization Code Flow
– Adaptive Federation Use Cases
• Adapter Selectors
• Composite Adapter
• Multiple IdP data stores


Agenda

• Extending PingFederate
– Developing Plugins
• PingFederate SDK
– Building a custom adapter selector


Who are these guys?

INTRODUCTIONS


Craig Wu

• Director, Product Development
• Been with Ping Identity since Feb 2007
• Started with Integration Kits
• PF STS integration
• PingFederate Fall 2009 – PF 6.2


Peter Motykowski

• Senior Engineer/Developer
• Been with Ping Identity since May 2007
• Started with PingLabs
• PF STS Integration, Adapter
Selectors, OAuth


PingFederate Engineering Team

Denver, CO - Vancouver, BC - Moscow, Russia - Dublin, Ireland


PingFederate 6.5

OAUTH


OAuth - Drivers


OAuth - Securing APIs

• Simple and Standard
– exchange user credentials for tokens
– Present token for access
• Scopes to limit access
• Easily revoke access
• Browser, mobile and desktop clients
• PingFederate Authorization Server
– User authenticates with AS
– Leverage existing PF authentication


OAuth Demo
Demo Overview

• Payment Gateway with REST API
secured using OAuth 2.0
(Resource Server)

• Users authenticate to the PF
Authorization Server, then approve
issuance of an OAuth token (Client)

• Tunes Partner application can request:
• One-time Payments
• Perpetual Payments

• Initiated via Web or Native Mobile
Application partner OAuth clients

12

Web One Time / Initial Payments
( 4 ) Validate Token

( 5 ) Charge

Authorization Server

( 2 ) Get Token

Payment Gateway
(REST API endpoint)

Browser
( 3 ) Use Token

( 1 ) Request Action

Tunes Partner Web

13

PingFederate 6.6

ADAPTIVE FEDERATION


PingFederate Adaptive Federation

1 2 3
Define rules for directing user to an Create a “chain” of authentication SAML
Gather identity attributes from multiple
authentication method adapters sources allowing for smart attribute
retrieval and reducing the need for
Examples Examples deploying a virtual directory
• If user is from specific IP • Consumer - Facebook AND One
• If user is from outside firewall Time Password Example
• If app requires specific type of • Remote User - LDAP AND RSA Fulfill attribute contract with LDAP and
authentication SecurID RDBMS data sources

Adapter Selectors
• Administrators create
authentication rules
using adapter selectors
• Authentication Rules
are evaluated during
SSO transaction
• The result values are
mapped to specific
adapters to be used for
authentication
• Executed in ordered
sequence
• Bundled 6.6 selectors
– CIDR
– SAML AuthN Context
• Custom Selector SDK

SAML AuthN Context Adapter Selector

Adapter Chaining via Composite Adapter
• Administrators chain
adapters to execute in
ordered sequence
• Composite adapter
instance treated as
single adapter instance
• Required policy
creates multi-factor
authentication
• Sufficient policy
supports OR condition
• Authentication context
weight and override

Multiple Datastore Attribute Lookup
• Connect to multiple
directories and
databases
• Pull attributes from any
number and
combination of data
sources
• Fulfill complex attribute
requirements
• Benefits
– Easily aggregate
identity attributes from
multiple data sources
• Reduce need for:
• Virtual Directories
• Custom Data
Sources

IdP Multiple Datastore Lookup

• SP Connection Attribute Contract
Fulfillment
– Browser SSO
– WS-Trust
– Adapter to Adapter
– Attribute Query
• Use return values from one data store as a
filter criteria for a subsequent data store
query

LDAP Adapter Replacement
• HTML Form Adapter
– Session Management
• Global
• Per Adapter
• None
– Per instance form template

• HTTP Basic Adapter

• Password Credential Validators
– Simple Username
– LDAP Username
– Can have multiple PCV instances per adapter

Adaptive Federation Demo


Monitoring Splunk App for PingFederate
• Support PF 6.3 and above
– Based on audit log
– Enable Splunk log4j appender

• SSO transaction and system report
– current transactions
– system health
– system errors
• Service Reports
– daily usage report
– SP/IdP provider reports per connection
• Trend Reports
– weekly/monthly usage report
– trend analysis


Splunk App for PingFederate


Free on SplunkBase

http://splunk-base.splunk.com/apps/Splunk+App+for+PingFederate


PingFederate 6.7 and beyond

PINGFEDERATE FUTURES


PingFederate 2012 Releases

• Two month releases
– RTM Release to Marketing
– Fully qualified and documented
– Upgrade Utility

• Marketing determines GA


PingFederate 6.7 - RTM Feb 24, 2012

• Admin Console Optimizations
– Large number of connections
– Large number of adapters

• Splunk App for PingFederate


PingFederate 6.8 – RTM April 27, 2012

• Centralized configuration for AD
Domains/Kerberos Realms
– IWA 3.0 Adapter
– Kerberos Token Translator 2.0

• OAuth Client Management API
– REST API for CRUD operations


Centralized AD Domain Configuration


IWA Adapter 3.0


PingFederate 6.9 – RTM June 29, 2012

• Microsoft Office 365 Interoperability

• Upgrade Jetty
• Remove JBoss


PingFederate Software Development Kit (SDK)

EXTENDING PINGFEDERATE


PingFederate Plugins

• Adapters
• Token Translators
• Custom Data Sources
• Adapter Selectors
• Password Credential Validators


Custom Adapter Selector

• HTTP Header Adapter Selector


Adapter Selector API Overview
Methods needing to be implemented for the
com.pingidentity.sdk.AdapterSelector interface:

PluginDescriptor getPluginDescriptor();

void configure(Configuration configuration);

AdapterSelectorContext selectContext(HttpServletRequest req,
HttpServletResponse resp, Map<String, String>
mappedAdapterIdsNames, Map<String, Object> extraParameters,
String resumePath);

void callback(HttpServletRequest req, HttpServletResponse resp,
Map authnIdentifiers, String adapterInstanceId,
AdapterSelectorContext adapterSelectorContext);


�ݺ�ߣ

Workshop: Advanced Federation Use-Cases with PingFederate

Recommended

More Related Content

Similar to Workshop: Advanced Federation Use-Cases with PingFederate (20)

Recently uploaded (20)

Workshop: Advanced Federation Use-Cases with PingFederate

Editor's Notes