no
problem hello everybody I'm Richard fart
I a software engineer at a in
institution South of the Border from
here um so when I'm talking about SSO I
do kind of bring that perspective which
is going to vary from the commercial
perspective of how SSO is used in the
Enterprise it's a lot of it's relatable
and I'll be focusing on the cast and SLE
protocols because those are the ones I
know and luckily I ran out of time
before I had to figure out oidc but oidc
is very simp to the components of SSO
that we talking about
anyway what is SSO SSO most properly
stands for single signon it once upon a
time still perhaps does stand for same
signon so you log into your windows M uh
your domain join Windows machine with a
password and you have to log in
something else with that same username
and password that's not single that's
same um ideally single sign on alongs
individual to login once and then access
access multiple services and it's great
because you can use the technology to
hopefully simplify or Outsource
authentication without um even needing
to go through multiple services or
multiple
organizations the other side of single
sign out is single log out SLO um it's
where you log out of one service and it
logs you out of the other services I'm
going to say it's fairly rare I'm coming
at this from a higher ed perspective
maybe industry has something else to say
about this but I've been in rooms of
people about this many people in higher
ed and the question of like who has SLO
working and one lone hand will go up and
it's not mine so I'm going to say it's
fairly rare and it can have some
negative conse quences so I'm guessing
actually I didn't test this but I'm
guessing if you log out of like Gmail
they'll log you out of YouTube as well
and that kind of makes sense and that
kind of works I'm talking higher ed it's
fall it's late fall right now right what
are students doing they're looking at
enrolling for classes for next spring
they're log into the sis the student
information system they log for the they
enroll for their class they leave the
tab open because who closes tabs anymore
they then log into the learning
management system with the single sign
on start taking their test and the sis
triggers the single logout on a timeout
and it goes through and triggers through
filters through and it logs them out of
the LMS the learning management system
as they're taking a test a tests are
frequently set up so you can only log in
and take them once and they're doing it
like today you know now is probably not
bad but they do it at you know 11: p.m.
support's not even be open so that's
some of the negative consequences I'm
talking about is they can have these
unexpected um actions and you can
configure things so that it doesn't
screw up but um this is like an actual
thing I've seen on LMS um mailing list
of people complaining about the sis
loging students out of while they're
taking tests so it's something that can
happen there's several components assess
to SSO with all the acronyms because of
course it would have all acronyms and
the terminology varies based off a
protocol um so the one acronym is IDP
stands for idty provider um in oidc um
it's called op and there's a few other
things that's called in oidc I really do
not oidc so don't hold me to any of this
uh the other side is sp the service
provider we'll get into what each of
these are in a moment
um and the other option is RP which you
will see in the oadc and the SLE worlds
they'll use relying party as well and
the other kind of key important part of
this is of course is typically the
browser and the IDP and SPS May part of
be be from the same organization or
different organizations these different
organizations may not even know about
each
other so it's an IDP it's a system
provides authentication operations it's
what people log into you can think of a
lot of different systems as an IDP but
makes sense you split it apart if you
have a standard WordPress install with a
username and passwords in your database
that's providing the identities right
it's also the service provider it's kind
of all combined doesn't make a whole lot
of sense to necessarily split them then
but that's what it does um Google and
GitHub are there's other social
providers you know some with single
letters now that used people used to use
that you can log into other services
with um cast is frequently used at
universities um you run sh typically or
different sample of things we get behind
behind the like say that's part of the
Canadian access Federation calf which is
can be part of edig gain which is an
International Federation of
federations you can have radius servers
there's actually IDP um SPS work in the
um Wireless real and so you could have a
radius server that connects to Eder roam
via Canary which is a Canadian I don't
not what that acon Standford but when
the Canadian organizations up here and
allows people to log into Wireless via
radius Federation across different
places and of course there's um OCTA and
I think entra is the new name for Azure
ad I did not fact check that one um and
then there's other things what's a
service provider it's a thing the user
wants to use most people aren't weird
like us and like are obsessed about that
login form about like how can I abuse
that thing um so the service provider is
the thing that people actually want to
use not the identity provider um so what
it's Ed another institution so you could
like Ed room is really kind of cool it's
not really the point I talk about it's
really kind of cool so you take a
student from University of maniton
University of wpeg and they can go over
they can be like at the Viking ship
Museum in Oslo and log into Wireless
using their home institution credentials
and so in that case the Viking ship
Museum would be the service provider
because that's what people want to use
um there's some you know commercial
providers out there like Zoom or docky
signer qual tricks that sort of thing
there's Orchid which is common in higher
ed there's Gmail and then kind of get
the point of like how you can use this
to simplify in your own Enterprise
there's YouTube there's the YouTube app
T TV app and the you know YouTube
Android app
so why would you want to use these one
of the most common reasons in Industry
would be to separate your login and your
account logic from the rest of your
services Netflix can have one team that
focuses on doing login and then every
other team at Netflix can not do that um
that's why we use it internally where
I'm at it's easy to write login forms
but like as soon as you want to go
through and add in pass Keys you're now
updating every single one of your apps
as soon as you want to go through and do
different risk detection you're updating
every single one of them so you'll
basically Outsource that problem to the
IDP and um just let it take care of be
taken care of from there it could be
your own internal IDP that you're doing
so it's not I'm not saying you have to
Outsource to OCTA or some place like
that you can but you just Outsource it
to a different team so not everybody has
to do
everything in higher ed um we do
Federated access a lot I mentioned edgy
room um calf edgy gain um but you also
can see like out completely Outsourcing
to third parties with the login with uh
Google Facebook GitHub sort of buttons
that you see
there and like I said you can put a lot
of your security policy inside of the
ENT provider instead of having to move
it around apps and then redeploy and
constantly update and involve all that
sort of thing and another one um it is
good I don't know how much users notice
this to be honest but it's a consistent
login experience ideally our people are
only punching in our credentials at
places like with our logos on you can
fish stuff but like hopefully like they
just not put into stupid Weebly forms
that we all see fishing happen through
so hopefully it gives people a
consistent login experience and they
kind of look that and maybe they even
look at the Domain and know this is the
domain in the URL um that's perhaps
asking a lot but it gives them a
consistent login experience so hopefully
they're not punching in credits for your
organization all over the
place there are a couple different types
of Federated authentication that comes
into SSO there's bilateral which is what
most people are familiar with this is
where two parties agree to perform
Federate authentication it could be a
contract so you could have a contract
with Microsoft 365 to come back to your
Enterprise login or Google workspaces
the Enterprise login you actually have a
bilateral agreement when you sign up to
use like sign in with Google it's I
haven't looked at the terms of the
contract I'm definitely not a lawyer but
like you have some sort of bilateral
agreement there the other option is
multilateral and this is where you just
like a part of a there federations they
say this is common and higher ad where
you can go through and you can say well
people from this institution or this
person from this institution can use
their home credentials their home SSO
and log into my
service um and so this requires trust
that's kind of a big one of the big
challenges about multilateral
federations requires trust and so I've
listed a bunch of trust things down
there that we have in the higher ed
space as far as how we make this happen
we have incommon Baseline expectations
incommon is the a us-based organization
I'm on the board that helps set those
Baseline expectations refeds is an
international organization I believe it
stands for research and education
federations it's
like all of us in higher ed working
together um to set standards
and so they're working on Baseline
expectations that were taken from hours
um there's the MFA profile again to
where that kind of um makes some
difference in some sense there there's
Assurance profile how sure are you that
richard. frar is Richard
frar uh certify which I cannot remember
what that acronym stands for but it's a
method by which we can communicate with
each other about security incidents it
stands for like security incident
something or other I don't know um but
it's about how we can do that so if I go
through and we see somebody that's loged
into R IDP and we know that that
account's been compromised and they're
logging into let's say ligo or the
National Institute of Health or CERN or
any or even Zoom how do we go through
and tell them hey we had a compromised
account it logged into your service it
gained access to your data once again
I'm not NIH I'm not Lio I'm not CERN
right how how do we go through and
securely tell them and in a in a a
trusting method in a way that hopefully
does preserve some privacy and some
Integrity I suppose because I mean we
know the security incidents happen how
do we go through and we properly tell
them what's going on how do they respond
back if they discover somebody's logged
into say ligo um how do they tell us
that they think that one of our accounts
has been compromised how do they respond
back to us that's what certify is it's
it's all like trust and policy and the
National Institute of Health is using
basically all the above to drive their
policies and procedures the NIH um
provides out granting money to a lot of
it's not just us-based organizations
they provide out tons of Health uh
research dollars across the globe and
one of the things that they do is they
also have like medical data right for
researchers to gain access to where they
want to make sure it's really that
medical researcher gaining access to
this data not someone
else so if we go and look at how SSO
works if we got now we're out of policy
there's a general web flow that this
basically holds mostly true for like I
said cast saml oidc the user hits the
service provider which is either YouTube
or drive or Gmail or whatever it is um
the service provider redirects the user
over to the
IDP um and this by redirects the user
means sends the browser right so this in
this case you would go to Google's and
Google might redirect you back to your
Enterprise which then starts involving
proxies which are very common in higher
ad as well the user authenticates the
IDP in some manner the IDP directs the
user browser to send some sort of
information back to the sp sp performs
some sort of validation hopefully and
then the users load in the system this
is assuming that everything is good and
fine
so let's talk about the cast protocol
this is very specific to higher ed I
don't think it's common outside of it
much but it's a fairly simple protocol
as well so it helps for us to look at it
for the details there's three versions
one two three um this can be done by the
Cass IDP the shth IDP the simple sample
PHP IDP plus other ones and there's you
know PHP casts and there's modof casts
and there's Spring Security can do it
there's a bunch of different ways you
can do it uh for versions one is old two
had a nearly ubiquitous extension and
three just adopted that extension
there's also a thing called SLE version
1.1 which is a security assertion markup
language it's the same SLE that you
probably know but it's SLE 1.1 is not
that
SLE so let's look at the login
flow and I think there's an oidc FL that
looks very close to this um so the
service provider redirects the user to
the IDP and it sticks in um in cast's
case it sticks basically a service as a
parameter of the URL so the URL has a
parameter on it says service equals HPS
state. trick.com and sends it on over
the IDP validates that that service is
registered or allowed you could do
reject services so one could foolishly I
would think say I'm just going to
everything htps allow that through um
the user logs in there's the uh ability
for a user to do uh attribute release
consent where they can say I don't want
to release my first name or I don't want
to release my last name or whatever else
it is uh that may or may not make allow
the service to keep working they might
require that information
we are using cerbos terminologies so
we're going to slap a ticket granny
ticket that he into the cookie this is
basically just a session right with the
IDP IDP sends the user back to the SP
with the service ticket so it just says
iot with the even URL is but this is
basically says you know ticket equals
st-12
345 while this connection is being held
open by the browser um the server will
then make a separate uh HTTP hopefully
htps connection back to the IDP and says
I am this I am qualtrix and I have this
service ticket and the IDP will validate
that that service ticket belongs to the
service and hasn't been used yet to stop
you from swapping the tickets around um
or replaying them the IDP then on that
back Channel releases the attributes to
the service provider and then the
service provider establishes his own
session with the user for things like C
and um s protocols you basically think
of these as swapping out your your
traditional login form so after you get
it done you then um put in your own
session control
this uses one important concept that um
show shows up inside of SSO terminology
this is back Channel I don't remember if
that's supposed to be two words or one
but basically it's server deserver
communication right the back channel is
um the SP reaching back to the IDP this
does require that the IDP be reachable
by the SP so you can't have firewalls
and everything else in the way of that
um so that's one limitation of a back
Channel communication uh but it very
much simplifies the payload being sent
to the browser because the browser is
now just saying just grabbing this
ticket and sending that on
over attribute return you can return
back the standard ones like first name
last name email address entitlements we
can translate identities my ident my
normal username is rich. pro which is
mutable so you can send back different
usernames which is Handy um a couple
things that the cast 3 protocol does it
can send the SSO login time we're
talking about multiple organizations so
maybe you're not happy with a login time
from 12 hours ago but maybe that's too
long ago for your risk profile there's
ways to check it and address that it
also can send back the multiactor method
maybe you don't want to use a 30-day
remember me Cookie maybe you want to
rely on something that's fishing
resistant you can detect that as
well there's three methods to do login
with Cass um that I'm claiming there's a
few others but the three I'll focus on
is one is um there's the standard method
as described above and if you have a
ticket granted ticket or existing SSO
session the second time you hit an app
it'll just transparently all happen you
just won't be prompted for login there's
one called renew and this forces
authentication so this is where you go
through and you say that SSO time was
from 12 hours ago I I want it within the
last hour okay well how do you get that
well you force them to log in now right
you can pass a flag in there renew flag
it forces it in there is a question of
what does this mean for multiactor if
they're punched in first credential but
then their Duo is a 30-day remember
me there is a partial answer that I'll
give you later but right now it's
and then the other option is there's a
Gateway option right so if it it'll
bounce people through that entire flow
that I described before but it won't
prompt for credentials it'll just grab
an SSL session and a service that you're
used to using probably that matches this
idea um it does not use Cass but this
idea is like YouTube right you can go to
YouTube and you can use YouTube without
logging in but if you're logged into
Gmail and you go to YouTube on the same
browser it's going to opportunistically
grab that session it's not going to
force you to log in there's a login
button if you want to it's not going to
force you to log in but it will grab
that opportunistic
and and go on and that's what a Gateway
is when it comes to
Cass so let's talk about SLE 2 this is
almost always what people mean when they
say samle um it's like the next version
of the one I just the one that kind of
really gloss over but it's way different
um the most popular open source project
that does this is called shith um and
the word shith has historical uses as a
authentication mechanism where different
groups could pron pronounce it correctly
or not and so turned you into an ingroup
or an
outgroup so that's why that name exists
um so sometime people will just call
this shth authentication as well but
they're talking saml to this can be done
in the shth IDP the Cass IDP the simple
samle PHP IDP the three I just last
named right A lot of these Iden
providers in open source world can go
through and talk multiple protocols
because it just makes life easy um OCTA
and others can do that as well the
feature support varies by IDP the three
above are very good ones like OCTA and
entra and stuff are not adfs um in my
opinion because I have fancy
multilateral fation
requirements on the SP side there is
something called the Shi of SP it runs a
demon called shd um and this has various
integration in modules into hbd engine X
and IIs and how that one works is it
just keeps injecting the headers um and
mod Off cast does the same thing and
there's an oidc one that does this too
but basically the um web server will
keep injecting your authentication
detail so keep injecting firstand richer
firstand richer firstand richer on every
single request that go through it's
behind these um modules and your browser
can just your not your browser sorry
your software can just go through and
look at basically the headers and see if
your person's allowed through or not uh
one advantage of using these modules is
you can protect just like flat file
directories without having to throw like
a PHP proxy in or a spring or whatever
proxy you want to throw in to actually
just force authentication to serve up a
JPEG or a PDF or something like that you
can just use um shd sh or mod offcast or
like this mod oidc all for like engine X
and
hbd we do a lot of like multilateral
federations so there's a thing called W
where are you from um places that you've
probably seen this is um who all does
this DocuSign does this Adobe does this
Microsoft does this Google you your
first login bit is your username it's
grabbing your domain and figuring out if
it needs to re redirect back off to an
Enterprise login that's a where you're
from Discovery mechanism we have a lot
of extensions for sample 2 and higher ed
and I'm going to say it has some unique
um security challenges it's old it's the
protocol is from 2005 and I have a
couple dates years down there just to
kind of help remind some of us old
people how old that old is um the Arab
Spring was in 2010 that's when there was
um protests and revolts in many places
including in Libya and I distinctly
remember from this time period that
there was concern because people were
organ organizing these I'm going to call
them protests for lack of a better word
um via Facebook messenger and there was
a concern that the Libyan government was
going to go through and do a man in the-
middle and intercept these messages and
do bad things to these people right and
so I remember Facebook like rushing out
to put HPS in front of stuff because in
2010 we were not putting htps in front
of everything right this is like insane
now um glitch B was talking about uh
strict Transport Security earlier by by
just forcing everything so that it works
in htps
we weren't weren using it for most
anything at all back then um and I
remember Facebook like rushing and
putting um TLS Sears in front and it was
like well the Libyan government actually
has a trusted CA so they could have
still man in the middle and put their
own ca for facebook.com in there and
then we have Edward snowden's
disclosures in 2013 um about talking
about intercepting once again
unencrypted communication so some of the
security challenges of how it looks and
works is because it was trying to
address problems that from a world where
we encrypting traffic and it has front
Channel which I'll go into in a
moment so the S 2 login flow once again
these all look fairly similar um the SP
redirects the user to the IDP this time
we include a SLE payload what's a SLE
payload it's an XML document that's
being
published key in these XML this XML
document is the entity ID which I'll get
into what that is but it's basically
identifies as the service assertion
consumer service URL ACS URL where to
send the user back to um this payload
can be optionally encrypted because
we're running um on a non-hps world from
2005 and it can be signed the IDP looks
up this the SP metadata which is an XML
document
typically to make sure that it's valid
to uh be communicated with the user
authenticates optional attribute release
consent um an SSO session cookie is
created we're no longer calling it The
TGT because we're not copying Kerberos
terminology but we can create a SSO
session the IDP creates a SLE payload it
can be optionally encrypted using the
sp's public key from metadata because
once again we're in 2005 world this
doesn't happen much really anymore um
the next thing is it can sign it using
its private key which really should
happen um the IDP redirects the browser
to post this um XML blob back to the
sp's ACs URL and then the SP should U
validate that the sign payload is valid
with the idp's public key that it has
from its copy of the metadata and then
the SP will then start its own user
session with the
user one security issue is you could not
validate the ACs URL um there's an ACS
URL that comes in from the post that I
talked about there's one inside the
metadata you should probably make sure
that those line up I think you can have
multiple ACS URLs for different methods
and different endpoints inside your
metadata and so you should make sure at
least one of them matches ideally you're
running a system that like libraries
that just take care of this for you
right I talk front Channel um burp Suite
so front channel uh let's talk about
this real quick front Channel I get my
slides basically out of order um is that
the browser is transporting all the data
from the IDP to the SP so it's user
provider data if it's user provider data
we can screw with it we can mess with it
we can have fun with it so this is why
idps should be signing the the payload
and SPS should be validating that the
payload is correct the signature is
correct so burp burp Suite can do
everything and it has a plugin called
called s raater and here's I think this
is a truncated chunk of output of XML
cuz it's awfully short for this sort of
thing it's definitely missing a
signature um and I believe I deleted
that off because it just keeps scrolling
but this is kind of what it looks like
we can see that it has NDSU edu there's
uh I don't know if my mouse is showing
up no not really but
um it has a not on or after and it's
going to educa is what I was logging
into now I could swap that out and claim
a mic. Saunders at ncdu he's not part of
our institution but I could just wrap
his name in to see what happens I'm
picking on him because he's speaking
next um but like I could swap that on
out or I could try richard. but you
Winnipeg doca and see what happens well
hopefully you're validating that
signature and not and not getting the
the service is validating that signature
that's being provided is truncated off
of here and so that you can't go through
and do it but I know there's a lot of
SPS out there that aren't going to be
validating that signature and that's
something you need to be um testing as
you deploy this stuff and want to
validate um there are front Channel
communication mechanisms uh with oidc as
well and um I think several a couple of
those are deprecated now because it is a
problem I keep talking about this
metadata thing what is it um it's
typically an XML document that's what my
familiarity is with it um it contains a
few different pieces it contains an enti
ID this is just just just a string um it
I think bypc it has to be Ur in in
almost all our URLs um but it should be
something in your namespace and
something you control um third party
vendors Cloud providers SSL providers
don't let you do this but if it's you
know your company. oo.com when you want
to move to someplace else you're not
going to be able to grab that OCTA bring
that
oct.ca they're not going to let you
assert in any ID of
oct.ca you do this which causes problems
in the higher ed space um another key
component of this is X there's x509
zerts and the whole point of having an
x509 S is just a way to go through and I
think it's Bas 64 encode a b basically
it's you've all seen x509 search well
most of you have um it's just a way to
put a public key in there right it's
like the search Parts kind of don't
really matter it's the fact that there's
a public key in there and so it's a
method of encoding and transporting the
public key in the metadata so so please
please please do not make these tlss
these should not be TLS CTS that go back
to a public CA you should not be getting
these from Global sign or let's encrypt
or whoever right these are these are
just a way to transport the public key
if you're having him rotate every two
years it's a pain in the ass um I had to
wrot one rotate one of ours U was
something that was integrated about I
don't know 50 60 times we did have one
fail and this is through a system that
was supposed to actually really really
handle it well um so go self-signed with
long lived if you need need to rotate
earlier rotate
earlier um and then inside also inside
the metadata you can include um
different extensions for different data
um some of these are better less
supported some of these might be core I
don't remember but you can put Security
contact information for that certify
problem right I talked about before if
you discover something's been
compromised um you can put in entity
categories which I'll get into a moment
you can put in support context error URL
somebody if one of my users has a hard
time run into a difficulty of logging
into somebody's thing because they
oped out of providing their email
address let's say it'll send back to me
and put up because I'm an IDP operator
it'll put up an error to contact
basically our help desk um you can say
which requested your attributes you want
to have there's privacy policy or El so
I can for people log in I can say here's
the privacy policy of the thing you're
trying to log into because it could be a
random service off in Germany that we
have no connection with that set up to
help grad students out somehow um and
put your logo URLs because you know
everybody likes logos to be put
up some of the enhancements for saml
higher ed is that we do large scale
Federation um there's one service
provider it's a Wiki that allows like
6,000 different institutions to log into
it so when I say large scale that's how
high are Ed roles um the authentication
context request we actually have a
method that we've added so that you can
go through I think it's prior of the
core spec we've like standardized on it
to go through and say we require
multiactor to happen because people are
organizations are very different look
spots in their migration to multiactor
Across The Globe and we can say yeah
you if you're going to if you're going
to access their service we require
multiactor to
happen we um something that's just part
of core SLE is forced authentication so
the same thing I say back for cast like
I want a new authentication I don't want
to trust anything that's old so then
back to my question of what does this
mean for MFA with the 30-day remember me
on
Duo well if you are conforming and
applying and requesting whatever refeds
MFA 1.2 which is not quite yet um
ratified but that has the very
specification in it says if I am doing a
force authentication and I'm forcing and
I'm asking for multiactor I expect it to
happen I it doesn't have to be strong
right now um you can still do dual
pushes and text messages but you can't
do a 4our Remember Me Maybe you can do a
4H hour remember but you can't do like a
30-day remember me on a duo or something
like that we want this to happen a lot
quicker couple other things that you can
do um this is like I said sample feature
but you can do this in a d providers
period um when you Federate with people
is we have entity categories that are
come rolling out now in higher ed the
three categories are Anonymous
synonymous and uh it used to be called
Anonymous but people didn't know what
Anonymous meant so it's called
personalized I didn't know what
Anonymous I didn't know Anonymous was in
a word until they said that and I'm like
you know what that kind of makes sense
with this Anonymous and pous thing there
must be something going on there but so
Anonymous is where people log in and you
don't say who logged in it's an
anonymous login which sounds kind of
crazy from I'm sure a lot of your
perspectives but this comes from a
couple different places um um one is the
temperature in the EU is very much
privacy focused um and in the other
temperature in the United States is that
I think the patriot acces who um
subpoena off people's Library records
which libraries don't like that I'm not
sure what the temperature is up here but
the idea is we won't do privac privacy
preserving so if you're logging into a
library and you're only accessing online
resources physical books mean something
different because you can walk away with
those right if you're logging in and
getting access to an online resource or
you're logging into journals do they
really need to know who you are right
maybe not if they're coming in from an
institution and the institution says
they're permitted to get in under our
license do they need know who they are
answer is probably no um the next option
is pseudonymous which is still the they
don't know who they are but every time
you log in you're given the same
basically fake username with that
service what does that allow well that
means you can favorite your favorite
Journal articles that sort of thing
right um but both of these stop two
different service providers from two
different Publishers let's say two
different journals from playing goldfish
with users as well right they can't say
well do you have Jeff yes I got Jeff
that's going to match or do I have Katie
yes I've got Katie and now you can start
going through and uh maybe correlating
where we don't want people to be
correlating from a privacy preserving
point of view so that's the advantage of
anonymous and Su Anonymous and
personaliz is sending you know fa email
address and stuff like that they're all
very
valuable one of the great attacks
against saml it's called Golden saml um
this is for
2.0 if you can get a hold of the idp's
private key you basically have the whole
it's you have the whole game right if
you can get that private key you can
generate any payload you want you can
sign it and the SP will validate it um
hopefully it still catches like domain
swaps you could only use it for the one
domain but you could be log in as root.
you know institution. edu Orca or
whatever like that um and one of the
problems is is that since this is all
front Channel there's nothing that ever
goes back to the IDP so the IDP is never
told that this person logged in it just
happens and so it's impossible to detect
a golden saml attack at the IDP side if
you have access to the SP which I don't
have access to this grad helping
software over in Germany right I don't
have access to them I don't even know
who they are I just look through logs
and randomly saw it but like I can't do
correlation if you if you can do
correlation between this stuff you could
detect this but um if you can't do
correlation you can't detect it unlike
um the golden I'm trying to remember my
stuff because I'm not a domain domain
admin but there's the golden ticket that
eventually will time out and talk to
back to the DC and you perhaps you could
detect that then but this one there's
nothing that comes back to the
IDP um one piece of notion when it comes
to trust is that the idps can say really
whatever they want to the SP um like I
said it comes down to trust it comes
down to being a good actor um so the ISP
puts a lot of of trust into the idps
because idps released whether or not MFA
happened I can lie my bottom bullet
point is I can lie there was one
institution um that was asserting that
if Duo wasn't available but the person
would have duoed they could still assert
that multiactor happened and the um
there was kind of a loophole in the spec
around that one and so the Spec's been
patched um as far as the trust framework
it's like no if they didn't do
multiactor then you cannot claim that
they did multiactor um I can pop about
usernames um you might not be able to do
this in an OCTA or something like that
with like a cast or um shith like in
cast when I configure releasing of
attributes it's I typically to say
release whatever I got in the directory
we use a ad in our case but I can put in
Javas not JavaScript I can put in groovy
and I can just write whatever I want I
could say if I see you know richard.
proverb swap out and repace somebody
else's name so I can become somebody
more powerful my account has a ton of
access so there's not many others but
but like I could swap mine out and so
you need to trust all this sort of
stuff um some capabilities that the IDP
can do um is you can rename attributes
uh so you can easily just swap things
out so mail becomes email um you can
replace them with something less mutable
I've got M set up to always lowercase
the usernames because I got tired of
seeing usernames in different casing um
I can modify attributes I can filter
what attributes being released so I
don't need to release all of my
entitlements to all of my um third
parties
uh we can also on from a security point
of view on the IDP side we can go
through and we can say oh is this person
allowed to even go on out to say Zoom or
qualtrix or wherever else like that we
can filter on the IDP side and make it
so the SP doesn't have to do it or maybe
the SP does it as well um it's kind of a
you can go either Direction with it
depending on what you want to
do um but that is a way you can add some
more Security on top of
stuff couple of other ways to attack the
idps um if you can get onto the system
you can examine memory and you can
probably see a lot of creds a lot of
beginning parts of creds the
um Cass the Cass IDP the Shi of IDP and
keycloak are all which I don't know
really anything about keycloak but it's
an IDP um they're all Java based and
Java likes to keep string sitting around
in memory a lot so you can potentially
you might not be able to correlate
between things but you probably can
simplify your search space and get your
p uh password stuff hang on
down um you can also use like an
unsecured tomat manager just you know
load a payload next to the IDP that's
running in there and Away you go if it's
if it's a Java based one um with cast
now people are running it via like an
embedded Tomcat or embedded Jetty shth
is best run by with a jetty and know and
uh keycloak is via web spere I think so
there's potential ways to to abuse the
underlying systems that are running this
and as soon as you can see creds from
there you can you can get in and and do
bad things um I don't know if this is a
IDP or attack or not because I really
haven't thought about much but I believe
it was the har archives right from OCTA
where they're getting in and they're
basically grabbing those session cookies
with the IDP or they perhaps they could
have grabbed session cookies for
anything right because they grabbed all
the session cookies but if you can get
and get to the session cookies and grab
them you potentially could go through
and um it's not so much an IDP attack
but it's attacking the user and using
the IDP to to further out um your
attack
um depending upon how your stuff's
deployed stuff's a lot better at this
now so hopefully you're keeping your
idps by the way are of course security
products right they should be kept up to
date you shouldn't be running cast 3 or
something like that which
is that was from like eight years ago um
stuff has changed been updated since
then but if you don't have your B MFA
you have to make sure that your step UPS
actually happen so you hit a low the
issue here is that the person hits a low
um risk system you're not forcing MFA on
the person and then they go to hit a
highrisk one making sure that yeah they
pushed in US password but I need to step
them up making sure that that happens
would be a good thing to test um I
haven't had to deal with it because we
just say if you're logging in you're
doing multiactor no matter
what um this is kind of a this one may
maybe doesn't apply quite so much
anymore if you've updated stuff but the
um Legacy Duo web integration which they
are moving um off of like that ends like
next summer uh all that responded back
was that yes the person got past Duo so
that duo web integration did not really
say anything so depending on how your
integration was configured in Duo it it
it it said the same thing whether the
person was using fishing resistant MFA
or if they weren't registered for Duo
and they were not required to register
or do anything past that and they were
just allowing people pass because you
were doing bypass for people that
weren't registered it say the exact same
damn thing and so you really couldn't
tell so you need to make sure when you
put these systems together that you
actually know this is this is very
specifically the integration with Duo
but you need to make sure that you um
understand what it's saying back and
then in my case if you're seting it out
to third parties randomly you need to
make sure that you're actually not
asserting multiactor out to a party that
really cares about like NIH when it
didn't happen because you allow to
bypass the new dual method tells you
what MFA method was done so you know
whether it was fishing resistant or
weaker so that was a kind of a whirlwind
overview of a lot of it there's some
other protocols out there that are worth
definitely mentioning there's ad hoc
just please don't do it just please
don't like there's standards out there
they're actually good standards um one
oidc is a good standard oh that's a good
standard like do those um I this is
years ago but I looked at one and went
what's my browser sending from this
login it was like oh my employee number
without any signature anything else off
to the the parking system I'm like
that's not
great ask somebody else and I I tried it
with a different number I got clearance
to do that tried with a different number
and yeah I got into theirs it's like
that's not great and some institutions
are like using that to like scan license
plates and do parking and stuff like
that and you could do like kind of scary
stalking and harassment because people
could get in that way uh there's an
older one called WS fed I'm going to
call it kind of a pain um and seems to
be really only support by Microsoft it
is like in Oasis standard I think but
yeah it's basically Microsoft one of the
cool things about WS fed um is that if
you log into like Microsoft 365 and
you're doing this via W's fed um you I
punch in richard. at ND us at edu that
case and it goes okay well I know where
to send you to the Enterprise login and
when I get to the Enterprise login it
punches in my username that I punched in
before um that is because WS fed
actually has ability to for that us name
on um so that's a cool feature about WS
fed if you're using a password manager
which you should be using password
managers it's just going to fill it in
for you so you don't have to retype your
username and password well you have to
type you have to retype your
username there was a thing called open
ID I don't know if it really ever was
used all that much that was kind of like
a roll your own bring your own identity
provider sort of thing so you'd log into
random stuff and you punch it in the URL
of like your WordPress instance and I
can't remember who all else would
support it and you could log in with
that so it was like a very much a um one
of the terms that's coming around for
other things these days is like self-
Sovereign identity basically you could
log in with your own creds to other
places um so it's like this Federation
that I've work with in higher ed but
like with no trust B into baked into
it the good one one of the good ones on
this list is um ooth 2 um it allows the
IDP to issue an authorization token to
third party make API calls you need to
secure the different tokens there's
different flows through there uh the one
good example I saw of that is as said
I'm not from here so I went and got my
card and so the IDP would be the person
at the front desk of the hotel my token
is my key card and the SP is my door and
the door doesn't need to know who I am
at all it just needs to know that I'm
allowed into that hotel room and so
that's how oath works if you need to
know who the person is um and there's
different audiences and once again I'm
not good at this at all but that's what
oidc is and so oid C sits on top of OA
it is oo but it has the ability to
actually send actual user information as
well um oidc I don't remember why they
took open ID because I don't think it's
actually a successor to open ID but open
ID connect is very much different from
the original open ID um and there's a
YouTube video there it has a it's from
this is from OCTA um about how oath and
oidc work in the different flows and if
you watch that video which I did the
other night to try to refresh my memory
on some of this stuff they talk about
the front Channel they talk about
whether or not stuff's being passed in
which parties are involved a lot of
stuff I've been talking about today um
but way more specific to ooth and
oidc that's my worldwind tour of SSO do
people have questions and I do see a
hand I see a hand behind
Mike right there
so the question is with all these
protocols and all these different places
how do you know what they're doing in
the back end right and whether you need
to get a um certificate was from
is yeah so whether you get the list of
what they're doing um yeah that is
something You' want to do uh for your
Enterprise especially if it's um your
bilateral agreements we'll definitely
have that uh multilateral Federation
across the institutions you're kind of
going well here's what my risk profile
is and you're relying on the trust
you're I'm relying on the fact that um
CF trusts the University of Winnipeg and
um in common where I'm at trusts calf
and so therefore we go it's a very much
in this higher Edge stuff it's very much
a web of trust trust and that people are
actually um bothering to pay attention
to the standards
correctly the SPs are the ones that
actually have a lot of risk in
here
so
you essentially will allow
us ourselves the middle of that auth
tokens so the question is is how do we
go through and detect and defend against
man- ofthe middle attacks on multiactor
authentication um and yeah that's a
problem um one of the things that we're
trying to go through and Define in the
community is like what is strong
authentication nist is doing some work
around that as well um and the question
is do you just do Hardware tokens and
yeah the answer basically comes back to
um using with there's two types of
Hardware tokens um but if you use like
the standard normal consumer available
Hardware tokens you are fishing
resistant which is the key thing that
we're care man in the middle or fishing
or fishing are the two things we care
about so a UB key and a Pass Key use
pass keys are getting really weird
because of like what Apple wants to do
and stuff like that I barely understand
it but it's getting a little weird but
if you just like a yubik and you plug it
in and you hit it that is resistant so
long as the attacker can't get to DNS um
if the attacker can get to DNS they can
somehow screw with those um which
happened at a bank um there's a person
that's like set like writes all these
standards has talked about this at a
conference so I'm like repeating what he
said from my memory Okay so
um but basically if you can go through
and you can get to DNS you can
compromise those tokens if you're using
the full fips tokens um then that's DNS
um Shenanigans resistance as
well question over here yeah
okay so the question is why do you split
your IDP and your multiactor provider
given that Microsoft 365 and Duo both
are multiactor providers that can also
do ID provider stuff um it's a good
question those two are not going to be
good at multilateral Federation with
with Edy gain and so that is one of the
things there are ways to proxy up
basically you can create a proxy just
for that particular use case and you
take your rest of your use cases and if
if you have the multilateral Federation
which he's also at a university so he
has multilateral Federation concerns
likely um so yeah that's why you would
want to split them um the other thing is
is that some of those don't let you
bring your entity IDs with you um and I
know that
places in higher ed were sensitive
everybody sens II prices but I think
we're higher sensitive prices and higher
ad and so of Duo um jacks up your costs
it it's probably easier just to move
that's just a question slide um it's
probably easier to move just your
multiactor instead of your entire ID
provider um and then also in our case we
don't we're provisioning all of
our most interesting bits of data about
our users to our ad so that's kept local
which different from a dual
perspective answer your question well
enough I know it's almost evading
but okay ideally long term I would like
to do pass keys and so our people just
log in um if you do the new pass Keys
you can log in with a
um basically the the the key and then
some sort of May the pin or Biometrics
and so people don't have to punch in
using password or doing another
multiactor run and you just log in just
with basically a you know thumb print
and you can log into stuff which is what
people we seeing I know a lot of you in
industry but like that's what we're
seeing from these different apps right
on the phone is that people are logging
in with just the front Thum prints or
your your your face IDs and students are
going to be expecting that from us in
higher ads so um be good and be able to
start supporting that the other bit um
that I didn't cover at all that I
understand even way way less is there's
the whole VI verifiable credentials and
self- Sovereign identity um we're
starting to see that in the United
States and places like Colorado with
digital driver's licenses there's a
whole spec on there um and in that case
I know that the plan is is for the 50
states plus the five I'm guessing the
five territories in DC to actually have
like bi you know 50 some OD bilateral
trusts to be able so the police can go
through and check to see if if I go into
Minnesota the police from Minnesota can
see if my digital driver's license is
actually valid in North
Dakota there's a lot of different
interesting challenges around uh
verifiable credentials and digital
wallets that are being worked on right
now I don't know if that exactly is SSO
or not but it is a way of asserting
identity from one party to
another any other questions yeah so what
are the platforms we use work heavy
right service provider conso allows for
but only if you're you're not SSO user
how would you protect the SSO
like if
you're Micosoft
3 protect on top of what for I'm missing
the question sorry okay
so 365 but if you're using local log on
to the be cons yep it
provides right
because
Microsoft it's in a documentation it's
not fully support yet okay how would you
protects
L I'm not entirely sure to be honest um
that comes down to your agreements and
your trust and that sort of thing as to
whether or not how much you trust the
IDP to be actually doing but it's as it
is okay thank you very much