際際滷

際際滷Share a Scribd company logo
Scalable and Usable Attribute
Mappings
David Chadwick
University of Kent
How Many Are There?
 Millions of potential IdPs (cf LDAP directories)
 Billions of potential identity attributes (cf
different variants of LDAP attributes)
 How to manage this in a simple, scalable, easy
to use, trustworthy way?
3 Filters
IdPs
Trusted
IdP filter Trusted
Attribute
filter
Trusted Attributes
from Trusted IdPs
Mapping
Rules
filter
Keystone
Attributes
Attributes from
Trusted IdPs
Net Effect
 Gives the administrator must better and finer
control
 Much easier to specify mapping rules (which
can be complex)
 Dont need to worry about unknown
attributes and regex matches on them
 Simpler and less complex mapping rules
Simple Example
 Suppose you trust 3 IdPs
 Trust IdP 1 to issue attributes a and b
 Trust IdP 2 to issue attributes a and c
 Trust IdP 3 to issue attributes a, b and c
 With existing scheme you need 3 largish mapping rules
 IdP 1: a maps to g1, b maps to g2
 IdP 2: a maps to g1, c maps to g3
 IdP 3: a maps to g1, b maps to g2, c maps to g3
 With proposed scheme you need 3 simpler rules
 a maps to g1
 b maps to g2
 c maps to g3
 Along with 3 trusted attribute rules
 Trust IdP1 to issue a and b
 Trust IdP2 to issue a and c
 Trust IdP3 to issue a, b and c
What about Large Federations?
 The current mapping rules are even worse.
 E.g. UK AMF has over 100 IdPs who all issue the same set of EduPerson
Schema attributes
 This will require >100 almost identical rules
 IdP 1: a maps to g1, b maps to g2
 IdP 2: a maps to g1, b maps to g2
 ..
 IdP 100: a maps to g1, b maps to g2
 Instead of
 a maps to g1
 b maps to g2
 Trust IdP1 to issue a and b
 Trust IdP2 to issue a and b
 
 Trust IdP 100 to issue a and b
 We may want to allow Trust All IdPs to issue a and b
Implication
 All attributes must be syntactically and semantically unique
in a federation
 But what if attribute a from IdP 1 is syntactically the same
as but semantically different to attribute a from IdP 2?
 E.g. VP in IdP1 means senior manager, lots of them
 VP in IdP2 means 2nd in command, only 1 of them
 Solution  Optionally qualify identity attribute in mapping
rule with issuing IdP
 IdP1.a maps to g1
 IdP2.a maps to g2
 b maps to g2
 c maps to g3
 If IdP is missing it means all IdPs

More Related Content

Similar to Scalable and usable attribute mappings in Keystone - Openstack (20)

Accelerating Data Science with Better Data Engineering on Databricks
Accelerating Data Science with Better Data Engineering on DatabricksAccelerating Data Science with Better Data Engineering on Databricks
Accelerating Data Science with Better Data Engineering on Databricks
Databricks
Clustering - ACM 2013 02-25
Clustering - ACM 2013 02-25Clustering - ACM 2013 02-25
Clustering - ACM 2013 02-25
MapR Technologies
Connected Components Labeling
Connected Components LabelingConnected Components Labeling
Connected Components Labeling
Hemanth Kumar Mantri
Building Identity Graphs over Heterogeneous Data
Building Identity Graphs over Heterogeneous DataBuilding Identity Graphs over Heterogeneous Data
Building Identity Graphs over Heterogeneous Data
Databricks
Lambda Data Grid: An Agile Optical Platform for Grid Computing and Data-inten...
Lambda Data Grid: An Agile Optical Platform for Grid Computing and Data-inten...Lambda Data Grid: An Agile Optical Platform for Grid Computing and Data-inten...
Lambda Data Grid: An Agile Optical Platform for Grid Computing and Data-inten...
Tal Lavian Ph.D.
How does the Cloud Foundry Diego Project Run at Scale, and Updates on .NET Su...
How does the Cloud Foundry Diego Project Run at Scale, and Updates on .NET Su...How does the Cloud Foundry Diego Project Run at Scale, and Updates on .NET Su...
How does the Cloud Foundry Diego Project Run at Scale, and Updates on .NET Su...
Amit Gupta
How does the Cloud Foundry Diego Project Run at Scale?
How does the Cloud Foundry Diego Project Run at Scale?How does the Cloud Foundry Diego Project Run at Scale?
How does the Cloud Foundry Diego Project Run at Scale?
VMware Tanzu
Data Science At Zillow
Data Science At ZillowData Science At Zillow
Data Science At Zillow
Nicholas McClure
Ralf Herbrich - Introduction to Graphical models in Industry
Ralf Herbrich - Introduction to Graphical models in IndustryRalf Herbrich - Introduction to Graphical models in Industry
Ralf Herbrich - Introduction to Graphical models in Industry
Bayes Nets meetup London
Apache Kylin: OLAP Engine on Hadoop - Tech Deep Dive
Apache Kylin: OLAP Engine on Hadoop - Tech Deep DiveApache Kylin: OLAP Engine on Hadoop - Tech Deep Dive
Apache Kylin: OLAP Engine on Hadoop - Tech Deep Dive
Xu Jiang
Dbms chapter iv
Dbms chapter ivDbms chapter iv
Dbms chapter iv
Bala Ganesh
Machine Learning Essentials Demystified part1 | Big Data Demystified
Machine Learning Essentials Demystified part1 | Big Data DemystifiedMachine Learning Essentials Demystified part1 | Big Data Demystified
Machine Learning Essentials Demystified part1 | Big Data Demystified
Omid Vahdaty
Lc3 beijing-june262018-sahdev zala-guangya
Lc3 beijing-june262018-sahdev zala-guangyaLc3 beijing-june262018-sahdev zala-guangya
Lc3 beijing-june262018-sahdev zala-guangya
Sahdev Zala
Challenging Web-Scale Graph Analytics with Apache Spark
Challenging Web-Scale Graph Analytics with Apache SparkChallenging Web-Scale Graph Analytics with Apache Spark
Challenging Web-Scale Graph Analytics with Apache Spark
Databricks
Challenging Web-Scale Graph Analytics with Apache Spark with Xiangrui Meng
Challenging Web-Scale Graph Analytics with Apache Spark with Xiangrui MengChallenging Web-Scale Graph Analytics with Apache Spark with Xiangrui Meng
Challenging Web-Scale Graph Analytics with Apache Spark with Xiangrui Meng
Databricks
Strata Conference + Hadoop World NY 2016: Lessons learned building a scalable...
Strata Conference + Hadoop World NY 2016: Lessons learned building a scalable...Strata Conference + Hadoop World NY 2016: Lessons learned building a scalable...
Strata Conference + Hadoop World NY 2016: Lessons learned building a scalable...
Sumeet Singh
Ben Coverston - The Apache Cassandra Project
Ben Coverston - The Apache Cassandra ProjectBen Coverston - The Apache Cassandra Project
Ben Coverston - The Apache Cassandra Project
Morningstar Tech Talks
Infrastructure API Lightning Talk by Jeremy Pollard of box.com
Infrastructure API Lightning Talk by Jeremy Pollard of box.comInfrastructure API Lightning Talk by Jeremy Pollard of box.com
Infrastructure API Lightning Talk by Jeremy Pollard of box.com
DevOps4Networks
PraveenBOUT++
PraveenBOUT++PraveenBOUT++
PraveenBOUT++
Praveen Narayanan
Lessons Learned from Using Spark for Evaluating Road Detection at BMW Autonom...
Lessons Learned from Using Spark for Evaluating Road Detection at BMW Autonom...Lessons Learned from Using Spark for Evaluating Road Detection at BMW Autonom...
Lessons Learned from Using Spark for Evaluating Road Detection at BMW Autonom...
Databricks
Accelerating Data Science with Better Data Engineering on Databricks
Accelerating Data Science with Better Data Engineering on DatabricksAccelerating Data Science with Better Data Engineering on Databricks
Accelerating Data Science with Better Data Engineering on Databricks
Databricks
Clustering - ACM 2013 02-25
Clustering - ACM 2013 02-25Clustering - ACM 2013 02-25
Clustering - ACM 2013 02-25
MapR Technologies
Building Identity Graphs over Heterogeneous Data
Building Identity Graphs over Heterogeneous DataBuilding Identity Graphs over Heterogeneous Data
Building Identity Graphs over Heterogeneous Data
Databricks
Lambda Data Grid: An Agile Optical Platform for Grid Computing and Data-inten...
Lambda Data Grid: An Agile Optical Platform for Grid Computing and Data-inten...Lambda Data Grid: An Agile Optical Platform for Grid Computing and Data-inten...
Lambda Data Grid: An Agile Optical Platform for Grid Computing and Data-inten...
Tal Lavian Ph.D.
How does the Cloud Foundry Diego Project Run at Scale, and Updates on .NET Su...
How does the Cloud Foundry Diego Project Run at Scale, and Updates on .NET Su...How does the Cloud Foundry Diego Project Run at Scale, and Updates on .NET Su...
How does the Cloud Foundry Diego Project Run at Scale, and Updates on .NET Su...
Amit Gupta
How does the Cloud Foundry Diego Project Run at Scale?
How does the Cloud Foundry Diego Project Run at Scale?How does the Cloud Foundry Diego Project Run at Scale?
How does the Cloud Foundry Diego Project Run at Scale?
VMware Tanzu
Ralf Herbrich - Introduction to Graphical models in Industry
Ralf Herbrich - Introduction to Graphical models in IndustryRalf Herbrich - Introduction to Graphical models in Industry
Ralf Herbrich - Introduction to Graphical models in Industry
Bayes Nets meetup London
Apache Kylin: OLAP Engine on Hadoop - Tech Deep Dive
Apache Kylin: OLAP Engine on Hadoop - Tech Deep DiveApache Kylin: OLAP Engine on Hadoop - Tech Deep Dive
Apache Kylin: OLAP Engine on Hadoop - Tech Deep Dive
Xu Jiang
Dbms chapter iv
Dbms chapter ivDbms chapter iv
Dbms chapter iv
Bala Ganesh
Machine Learning Essentials Demystified part1 | Big Data Demystified
Machine Learning Essentials Demystified part1 | Big Data DemystifiedMachine Learning Essentials Demystified part1 | Big Data Demystified
Machine Learning Essentials Demystified part1 | Big Data Demystified
Omid Vahdaty
Lc3 beijing-june262018-sahdev zala-guangya
Lc3 beijing-june262018-sahdev zala-guangyaLc3 beijing-june262018-sahdev zala-guangya
Lc3 beijing-june262018-sahdev zala-guangya
Sahdev Zala
Challenging Web-Scale Graph Analytics with Apache Spark
Challenging Web-Scale Graph Analytics with Apache SparkChallenging Web-Scale Graph Analytics with Apache Spark
Challenging Web-Scale Graph Analytics with Apache Spark
Databricks
Challenging Web-Scale Graph Analytics with Apache Spark with Xiangrui Meng
Challenging Web-Scale Graph Analytics with Apache Spark with Xiangrui MengChallenging Web-Scale Graph Analytics with Apache Spark with Xiangrui Meng
Challenging Web-Scale Graph Analytics with Apache Spark with Xiangrui Meng
Databricks
Strata Conference + Hadoop World NY 2016: Lessons learned building a scalable...
Strata Conference + Hadoop World NY 2016: Lessons learned building a scalable...Strata Conference + Hadoop World NY 2016: Lessons learned building a scalable...
Strata Conference + Hadoop World NY 2016: Lessons learned building a scalable...
Sumeet Singh
Ben Coverston - The Apache Cassandra Project
Ben Coverston - The Apache Cassandra ProjectBen Coverston - The Apache Cassandra Project
Ben Coverston - The Apache Cassandra Project
Morningstar Tech Talks
Infrastructure API Lightning Talk by Jeremy Pollard of box.com
Infrastructure API Lightning Talk by Jeremy Pollard of box.comInfrastructure API Lightning Talk by Jeremy Pollard of box.com
Infrastructure API Lightning Talk by Jeremy Pollard of box.com
DevOps4Networks
Lessons Learned from Using Spark for Evaluating Road Detection at BMW Autonom...
Lessons Learned from Using Spark for Evaluating Road Detection at BMW Autonom...Lessons Learned from Using Spark for Evaluating Road Detection at BMW Autonom...
Lessons Learned from Using Spark for Evaluating Road Detection at BMW Autonom...
Databricks

Recently uploaded (20)

What is Satellite Communication and How Does it Work.pdf
What is Satellite Communication and How Does it Work.pdfWhat is Satellite Communication and How Does it Work.pdf
What is Satellite Communication and How Does it Work.pdf
Telecoms Supermarket
Mastering SEO: Build a Winning Strategy from the Ground Up
Mastering SEO: Build a Winning Strategy from the Ground UpMastering SEO: Build a Winning Strategy from the Ground Up
Mastering SEO: Build a Winning Strategy from the Ground Up
thedigicenter
The Evolution of Home Security from Cameras to Smart Systems.pdf
The Evolution of Home Security from Cameras to Smart Systems.pdfThe Evolution of Home Security from Cameras to Smart Systems.pdf
The Evolution of Home Security from Cameras to Smart Systems.pdf
Internet Bundle Now
download di slideshare ngak bisa padahal udah upload file 2 kali
download di slideshare ngak bisa padahal udah upload file 2 kalidownload di slideshare ngak bisa padahal udah upload file 2 kali
download di slideshare ngak bisa padahal udah upload file 2 kali
haikalmalikpranasta
Amazon Sidewalk: A Global Wake-Up Call for the Telecom Industry
Amazon Sidewalk: A Global Wake-Up Call for the Telecom IndustryAmazon Sidewalk: A Global Wake-Up Call for the Telecom Industry
Amazon Sidewalk: A Global Wake-Up Call for the Telecom Industry
David Swift
Mdf Board manufacturer in india.........
Mdf Board manufacturer in india.........Mdf Board manufacturer in india.........
Mdf Board manufacturer in india.........
veerseo13
AI & Cybersecurity: Strengthening Business Security in 2025
AI & Cybersecurity: Strengthening Business Security in 2025AI & Cybersecurity: Strengthening Business Security in 2025
AI & Cybersecurity: Strengthening Business Security in 2025
privaxic
Press Conference Future of Business: Trends and Predictions for 2025
Press Conference Future of Business: Trends and Predictions for 2025Press Conference Future of Business: Trends and Predictions for 2025
Press Conference Future of Business: Trends and Predictions for 2025
SanskarTiwari20
Introduction to WordPress Basics - WP 101
Introduction to WordPress Basics - WP 101Introduction to WordPress Basics - WP 101
Introduction to WordPress Basics - WP 101
Joe Querin
Copy of Tech Startup by 際際滷sgo....pptx
Copy of Tech Startup by 際際滷sgo....pptxCopy of Tech Startup by 際際滷sgo....pptx
Copy of Tech Startup by 際際滷sgo....pptx
ErdiErdi6
Cloud Security Services: Protect Data with Cutting-Edge Solutions
Cloud Security Services: Protect Data with Cutting-Edge SolutionsCloud Security Services: Protect Data with Cutting-Edge Solutions
Cloud Security Services: Protect Data with Cutting-Edge Solutions
privaxic
DT Presentation[1].pptxeffsffewfwefewfewefefeef
DT Presentation[1].pptxeffsffewfwefewfewefefeefDT Presentation[1].pptxeffsffewfwefewfewefefeef
DT Presentation[1].pptxeffsffewfwefewfewefefeef
dipanshu1721
Byzantine Empire.pdf, history and geography yes yes yes
Byzantine Empire.pdf, history and geography yes yes yesByzantine Empire.pdf, history and geography yes yes yes
Byzantine Empire.pdf, history and geography yes yes yes
estuchedetumadre
"Revolutionizing Tomorrow: The Power of AI"
"Revolutionizing Tomorrow: The Power of AI""Revolutionizing Tomorrow: The Power of AI"
"Revolutionizing Tomorrow: The Power of AI"
kulbhushanmohtra
BGP Best Practices, presented by Imtiaz Sajid
BGP Best Practices, presented by Imtiaz SajidBGP Best Practices, presented by Imtiaz Sajid
BGP Best Practices, presented by Imtiaz Sajid
APNIC
MiniTool Power Data Recovery Crack Latest
MiniTool Power Data Recovery Crack  LatestMiniTool Power Data Recovery Crack  Latest
MiniTool Power Data Recovery Crack Latest
adreeskhan14780
Frontier Internet Availability Expanding Access to Rural Communities.pdf
Frontier Internet Availability Expanding Access to Rural Communities.pdfFrontier Internet Availability Expanding Access to Rural Communities.pdf
Frontier Internet Availability Expanding Access to Rural Communities.pdf
Internet Bundle Now
State of Artificial Intelligence Report - 2024 ONLINE.pdf
State of Artificial Intelligence Report - 2024 ONLINE.pdfState of Artificial Intelligence Report - 2024 ONLINE.pdf
State of Artificial Intelligence Report - 2024 ONLINE.pdf
ManuBatra12
APNIC and Policy Development Process (PDP)
APNIC and Policy Development Process (PDP)APNIC and Policy Development Process (PDP)
APNIC and Policy Development Process (PDP)
APNIC
Chapter 6-firewalls-whitman-information security.ppt
Chapter 6-firewalls-whitman-information security.pptChapter 6-firewalls-whitman-information security.ppt
Chapter 6-firewalls-whitman-information security.ppt
ayeshabatool947681
What is Satellite Communication and How Does it Work.pdf
What is Satellite Communication and How Does it Work.pdfWhat is Satellite Communication and How Does it Work.pdf
What is Satellite Communication and How Does it Work.pdf
Telecoms Supermarket
Mastering SEO: Build a Winning Strategy from the Ground Up
Mastering SEO: Build a Winning Strategy from the Ground UpMastering SEO: Build a Winning Strategy from the Ground Up
Mastering SEO: Build a Winning Strategy from the Ground Up
thedigicenter
The Evolution of Home Security from Cameras to Smart Systems.pdf
The Evolution of Home Security from Cameras to Smart Systems.pdfThe Evolution of Home Security from Cameras to Smart Systems.pdf
The Evolution of Home Security from Cameras to Smart Systems.pdf
Internet Bundle Now
download di slideshare ngak bisa padahal udah upload file 2 kali
download di slideshare ngak bisa padahal udah upload file 2 kalidownload di slideshare ngak bisa padahal udah upload file 2 kali
download di slideshare ngak bisa padahal udah upload file 2 kali
haikalmalikpranasta
Amazon Sidewalk: A Global Wake-Up Call for the Telecom Industry
Amazon Sidewalk: A Global Wake-Up Call for the Telecom IndustryAmazon Sidewalk: A Global Wake-Up Call for the Telecom Industry
Amazon Sidewalk: A Global Wake-Up Call for the Telecom Industry
David Swift
Mdf Board manufacturer in india.........
Mdf Board manufacturer in india.........Mdf Board manufacturer in india.........
Mdf Board manufacturer in india.........
veerseo13
AI & Cybersecurity: Strengthening Business Security in 2025
AI & Cybersecurity: Strengthening Business Security in 2025AI & Cybersecurity: Strengthening Business Security in 2025
AI & Cybersecurity: Strengthening Business Security in 2025
privaxic
Press Conference Future of Business: Trends and Predictions for 2025
Press Conference Future of Business: Trends and Predictions for 2025Press Conference Future of Business: Trends and Predictions for 2025
Press Conference Future of Business: Trends and Predictions for 2025
SanskarTiwari20
Introduction to WordPress Basics - WP 101
Introduction to WordPress Basics - WP 101Introduction to WordPress Basics - WP 101
Introduction to WordPress Basics - WP 101
Joe Querin
Copy of Tech Startup by 際際滷sgo....pptx
Copy of Tech Startup by 際際滷sgo....pptxCopy of Tech Startup by 際際滷sgo....pptx
Copy of Tech Startup by 際際滷sgo....pptx
ErdiErdi6
Cloud Security Services: Protect Data with Cutting-Edge Solutions
Cloud Security Services: Protect Data with Cutting-Edge SolutionsCloud Security Services: Protect Data with Cutting-Edge Solutions
Cloud Security Services: Protect Data with Cutting-Edge Solutions
privaxic
DT Presentation[1].pptxeffsffewfwefewfewefefeef
DT Presentation[1].pptxeffsffewfwefewfewefefeefDT Presentation[1].pptxeffsffewfwefewfewefefeef
DT Presentation[1].pptxeffsffewfwefewfewefefeef
dipanshu1721
Byzantine Empire.pdf, history and geography yes yes yes
Byzantine Empire.pdf, history and geography yes yes yesByzantine Empire.pdf, history and geography yes yes yes
Byzantine Empire.pdf, history and geography yes yes yes
estuchedetumadre
"Revolutionizing Tomorrow: The Power of AI"
"Revolutionizing Tomorrow: The Power of AI""Revolutionizing Tomorrow: The Power of AI"
"Revolutionizing Tomorrow: The Power of AI"
kulbhushanmohtra
BGP Best Practices, presented by Imtiaz Sajid
BGP Best Practices, presented by Imtiaz SajidBGP Best Practices, presented by Imtiaz Sajid
BGP Best Practices, presented by Imtiaz Sajid
APNIC
MiniTool Power Data Recovery Crack Latest
MiniTool Power Data Recovery Crack  LatestMiniTool Power Data Recovery Crack  Latest
MiniTool Power Data Recovery Crack Latest
adreeskhan14780
Frontier Internet Availability Expanding Access to Rural Communities.pdf
Frontier Internet Availability Expanding Access to Rural Communities.pdfFrontier Internet Availability Expanding Access to Rural Communities.pdf
Frontier Internet Availability Expanding Access to Rural Communities.pdf
Internet Bundle Now
State of Artificial Intelligence Report - 2024 ONLINE.pdf
State of Artificial Intelligence Report - 2024 ONLINE.pdfState of Artificial Intelligence Report - 2024 ONLINE.pdf
State of Artificial Intelligence Report - 2024 ONLINE.pdf
ManuBatra12
APNIC and Policy Development Process (PDP)
APNIC and Policy Development Process (PDP)APNIC and Policy Development Process (PDP)
APNIC and Policy Development Process (PDP)
APNIC
Chapter 6-firewalls-whitman-information security.ppt
Chapter 6-firewalls-whitman-information security.pptChapter 6-firewalls-whitman-information security.ppt
Chapter 6-firewalls-whitman-information security.ppt
ayeshabatool947681

Scalable and usable attribute mappings in Keystone - Openstack

  • 1. Scalable and Usable Attribute Mappings David Chadwick University of Kent
  • 2. How Many Are There? Millions of potential IdPs (cf LDAP directories) Billions of potential identity attributes (cf different variants of LDAP attributes) How to manage this in a simple, scalable, easy to use, trustworthy way?
  • 3. 3 Filters IdPs Trusted IdP filter Trusted Attribute filter Trusted Attributes from Trusted IdPs Mapping Rules filter Keystone Attributes Attributes from Trusted IdPs
  • 4. Net Effect Gives the administrator must better and finer control Much easier to specify mapping rules (which can be complex) Dont need to worry about unknown attributes and regex matches on them Simpler and less complex mapping rules
  • 5. Simple Example Suppose you trust 3 IdPs Trust IdP 1 to issue attributes a and b Trust IdP 2 to issue attributes a and c Trust IdP 3 to issue attributes a, b and c With existing scheme you need 3 largish mapping rules IdP 1: a maps to g1, b maps to g2 IdP 2: a maps to g1, c maps to g3 IdP 3: a maps to g1, b maps to g2, c maps to g3 With proposed scheme you need 3 simpler rules a maps to g1 b maps to g2 c maps to g3 Along with 3 trusted attribute rules Trust IdP1 to issue a and b Trust IdP2 to issue a and c Trust IdP3 to issue a, b and c
  • 6. What about Large Federations? The current mapping rules are even worse. E.g. UK AMF has over 100 IdPs who all issue the same set of EduPerson Schema attributes This will require >100 almost identical rules IdP 1: a maps to g1, b maps to g2 IdP 2: a maps to g1, b maps to g2 .. IdP 100: a maps to g1, b maps to g2 Instead of a maps to g1 b maps to g2 Trust IdP1 to issue a and b Trust IdP2 to issue a and b Trust IdP 100 to issue a and b We may want to allow Trust All IdPs to issue a and b
  • 7. Implication All attributes must be syntactically and semantically unique in a federation But what if attribute a from IdP 1 is syntactically the same as but semantically different to attribute a from IdP 2? E.g. VP in IdP1 means senior manager, lots of them VP in IdP2 means 2nd in command, only 1 of them Solution Optionally qualify identity attribute in mapping rule with issuing IdP IdP1.a maps to g1 IdP2.a maps to g2 b maps to g2 c maps to g3 If IdP is missing it means all IdPs