Single Sign On with TYPO3 Flow

Slide 1

Slide 1 text

Single Sign On with Inspiring Flow 2013

Slide 2

Slide 2 text

@hlubek Christopher Hlubek

Slide 3

Slide 3 text

Work

Slide 4

Slide 4 text

TYPO3 Flow Surf Neos ...

Slide 5

Slide 5 text

Sign-On Sign-In Authentication Authorization Single-Sign-On

Slide 6

Slide 6 text

Authentication

Slide 7

Slide 7 text

Who ? >Identity

Slide 8

Slide 8 text

j.doe ****** Login j.doe

Slide 9

Slide 9 text

Username / Password over and over ...

Slide 10

Slide 10 text

What do we repeat in every new webapp?

Slide 11

Slide 11 text

= +

Slide 12

Slide 12 text

„Can we store all accounts centrally and login once and forever?“ [enter customer name here] quote

Slide 13

Slide 13 text

Service oriented apps Large Monolithic Unmaintainable App monster Focussed Clean Small Service Apps

Slide 14

Slide 14 text

Requirements Seamless login Flow integration Server and client Expiration sync

Slide 15

Slide 15 text

Existing SSO solutions CAS Shibboleth SAML 2.0 OpenId OAuth

Slide 16

Slide 16 text

Peek into the SAML 2.0 spec

Slide 17

Slide 17 text

No content

Slide 18

Slide 18 text

We built a custom solution...

Slide 19

Slide 19 text

Why? Ease of use Reduce complexity Flexibility

Slide 20

Slide 20 text

Flowpack.SingleSignOn.*

Slide 21

Slide 21 text

In cooperation with Robert Lemke

Slide 22

Slide 22 text

Basic architecture Flow app SSO Server package Your domain package The

Slide 23

Slide 23 text

A roundtrip

Slide 24

Slide 24 text

Server Instance 1 access secured resource 2 redirect to server authenticate 3 5 redeem token 4 redirect back 6 redirect to secured res.

Slide 25

Slide 25 text

Confused?

Slide 26

Slide 26 text

Demo

Slide 27

Slide 27 text

Some more detail

Slide 28

Slide 28 text

Server Server key pair Service base URI > server identiﬁer Client 1 Public key Service base Client 2 Public key Service base Stored

Slide 29

Slide 29 text

Client Client key pair Service base URI > client identiﬁer Stored

Slide 30

Slide 30 text

Server Instance 2 redirect to server /sso/authentication?originalUri=...&ssoClientIdentiﬁer=...&signature=... RSA signing of requests

Slide 31

Slide 31 text

Server authenticate 3 Use existing authentication providers

Slide 32

Slide 32 text

Server Instance 4 redirect back Encrypted access token for server-side data transfer /sso/authentication/callback?originalUri=...&accessToken=...&signature=...

Slide 33

Slide 33 text

Server Instance 5 redeem token Server-side signed request Validates token Get account data from server POST /sso/token/jNkmyO6oC1gm4xozKt1FR579/redeem

Slide 34

Slide 34 text

Instance 6 redirect to secured res. Create / get account from data Authenticated!

Slide 35

Slide 35 text

Features

Slide 36

Slide 36 text

It works ;)

Slide 37

Slide 37 text

Flow security framework integration

Slide 38

Slide 38 text

SSO on instance is just a provider with entry point

Slide 39

Slide 39 text

Re-use existing providers on SSO server LDAP UsernamePassword OpenID

Slide 40

Slide 40 text

Flexible account data mapping

Slide 41

Slide 41 text

Expiration synchronization

Slide 42

Slide 42 text

Single-Sign-Off

Slide 43

Slide 43 text

Account switching on server

Slide 44

Slide 44 text

Uses advanced Flow SessionTM

Slide 45

Slide 45 text

Sessions of instances can be destroyed remotely

Slide 46

Slide 46 text

Sessions on server are fully manageable

Slide 47

Slide 47 text

Sessions can use existing Cache backends Redis Riak Memcached ...

Slide 48

Slide 48 text

Development

Slide 49

Slide 49 text

Quality assurance

Slide 50

Slide 50 text

Tests...

Slide 51

Slide 51 text

1 Acceptance tests with Behat

Slide 52

Slide 52 text

Feature: Instance Login with Single Sign-On In order to access a secured resource on an instance (some web application) As a user of the instance I need to be able to log in using my central user account on the SSO server Background: Given I am not authenticated on the server or the instance Scenario: Protected resource on instance redirects to server login Given I am on the instance homepage When I click on the link "Go to secure action" Then I should be redirected to the server And I should see a login form Scenario: Login on server with correct credentials redirects to original URI Given I am on the instance homepage And I click on the link "Go to secure action" When I ﬁll in "Username" with "admin" And I ﬁll in "Password" with "password" And I press "Login" Then I should be redirected to the instance And the URI should not contain SSO parameters Scenario: Login forwards account information to instance Given I am on the instance homepage