1 of 24

REFEDS Assurance Suite�

IAM Online 13 December 2018

Mikael Linden, REFEDS assurance wg chair, mikael.linden@csc.fi

Jule Ziegler, GN4-2 assurance subtask lead, ziegler@lrz.de�

2 of 24

Outline

The assurance challenge
REFEDS Assurance Framework
Single-factor authentication SFA
Multi-factor authentication MFA
Testing it

3 of 24

The assurance challenge

Service Provider

eduGAIN interfederation

Home University/Institution

Identity Provider

Local federation

Service Provider

How was the registration/Identity Proofing done?

Is that even a shared account (libraryuser1@university.org)?

Can this user ID be later reassigned to some other person?

How fresh is that affiliation information?

How was the user authentication done?

ePPN=”bob@university.org”,�ePAffiliation=”faculty”

4 of 24

REFEDS Assurance suite

REFEDS Assurance Framework (RAF) ver 1.0

Approved and published
https://refeds.org/assurance

REFEDS Single-factor authentication profile (SFA) ver 1.0

Approved and published
https://refeds.org/profile/sfa

REFEDS Multi-factor authentication profile (MFA) ver 1.0

approved in June 2017
https://refeds.org/profile/sfa

5 of 24

The big picture of assurance in REFEDS

Identifiers

ID proofing

Authentication

Attributes

ID is unique, personal and traceable

ePPN is unique, personal and traceable

Low �(self-asserted)

Medium�(e.g. postal credential delivery)

High

(e.g. F2F)

Single-factor authentication

Multi-factor authentication

Affiliation freshness �1 month

Affiliation freshness �1 day

6 of 24

Split of responsibility between REFEDS specs�

Identifiers

ID proofing

Authentication

Attributes

ID is unique, personal and traceable

ePPN is unique, personal and traceable

Low �(self-asserted)

Medium�(e.g. postal credential delivery)

High

(e.g. F2F)

Single-factor authentication

Multi-factor authentication

Affiliation freshness �1 month

Affiliation freshness �1 day

REFEDS Assurance framework (RAF)

AuthN profiles

Separate specification: REFEDS Single-Factor Authentication (SFA)

Separate specification: REFEDS Multi-Factor Authentication (MFA)

7 of 24

Assurance Framework assertions and profiles

To be expressed by the CSP in the eduPersonAssurance attribute

$PREFIX$=https://refeds.org/assurance

8 of 24

RAF values for properties of identifiers

Identifiers

ID proofing

Authentication

Attributes

ID is unique, personal and traceable

ePPN is unique, personal and traceable

Low �(self-asserted)

Medium�(e.g. postal credential delivery)

High

(e.g. F2F)

Single-factor authentication

Multi-factor authentication

Affiliation freshness �1 month

Affiliation freshness �1 day

eduPersonAssurance=$PREFIX$/ID/unique

The user identifier represents a single natural person
The CSP can contact the person to whom the identifier is issued
The user identifier is never re-assigned
The user identifier is eduPersonUniqueID, SAML 2.0 persistent nameId, subject-id or pairwise-id or OIDC sub (public or pairwise)

eduPersonAssurance=$PREFIX$/ID/no-eppn-reassign

- eduPersonPrincipalName value has properties 1-3 (see above).

eduPersonAssurance=$PREFIX$/ID/eppn-reassign-1y

- eduPersonPrincipalName value has properties 1-2 (see above) but may be re-assigned after a hiatus period of 1 year or longer.

9 of 24

RAF values for identity proofing

Identifiers

ID proofing

Authentication

Attributes

ID is unique, personal and traceable

ePPN is unique, personal and traceable

Low �(self-asserted)

Medium�(e.g. postal credential delivery)

High

(e.g. F2F)

Single-factor authentication

Multi-factor authentication

Affiliation freshness �1 month

Affiliation freshness �1 day

eduPersonAssurance=$PREFIX$/IAP/low

sections 5.1.2-5.1.2.9 & 5.1.3 of Kantara AL1
IGTF level DOGWOOD or ASPEN

Identity proofing and credential issuance, renewal, and replacement qualify to any of…

eduPersonAssurance=$PREFIX$/IAP/medium

sections 5.2.2-5.2.2.9, 5.2.2.12&5.2.3 of Kantara AL2
IGTF level BIRCH or CEDAR
section 2.1.2, 2.2.2 and 2.2.4 of eIDAS low

eduPersonAssurance=$PREFIX$/IAP/high

section 5.3.2-5.3.2.9, 5.3.2.12&5.3.3 of Kantara AL3
section 2.1.2, 2.2.2 and 2.2.4 of eIDAS substantial

10 of 24

RAF values for attribute freshness

Identifiers

ID proofing

Authentication

Attributes

ID is unique, personal and traceable

ePPN is unique, personal and traceable

Low �(self-asserted)

Medium�(e.g. postal credential delivery)

High

(e.g. F2F)

Single-factor authentication

Multi-factor authentication

Affiliation freshness �1 month

Affiliation freshness �1 day

eduPersonAssurance=$PREFIX$/ATP/ePA-1m

eduPersonAffiliation, eduPersonScopedAffiliation and eduPersonPrimaryAffiliation attributes (if populated and released to the RP) reflect user’s departure within 31 days time

eduPersonAssurance=$PREFIX$/ATP/ePA-1d

eduPersonAffiliation, eduPersonScopedAffiliation and eduPersonPrimaryAffiliation attributes (if populated and released to the RP) reflect user’s departure within one days time

Departure = organisation (its business process) decides a person no more qualifies to that organisational role.

This attribute describes maximum “IT lag” after the decision.

11 of 24

RAF conformance criteria

REFEDS Assurance framework (RAF)

Identifiers

ID proofing

Attributes

ID is unique, personal and traceable

ePPN is unique, personal and traceable

Low �(self-asserted)

Medium�(e.g. postal credential delivery)

High

(e.g. F2F)

Affiliation freshness �1 month

Affiliation freshness �1 day

In all cases the CSP MUST (baseline expectations for Identity Providers):

The Identity Provider is operated with organizational-level authority
The Identity Provider is trusted enough that it is (or it could be) used to access the organization’s own systems
Generally-accepted security practices are applied to the Identity Provider
Federation metadata is accurate, complete, and includes at least one of the following: support, technical, admin, or security contacts

A CSP indicates its conformance to this profile by asserting $PREFIX$.

12 of 24

“Cappuccino” for low-risk research use cases�

Identifiers

ID proofing

Authentication

Attributes

ID is unique, personal and traceable

ePPN is unique, personal and traceable

Low �(self-asserted)

Medium�(e.g. postal credential delivery)

High

(e.g. F2F)

Single-factor authentication

Multi-factor authentication

Affiliation freshness �1 month

Affiliation freshness �1 day

REFEDS Assurance framework (RAF)

AuthN profiles

”Goes with”

13 of 24

“Espresso” for more demanding use cases�

Identifiers

ID proofing

Authentication

Attributes

ID is unique, personal and traceable

ePPN is unique, personal and traceable

Low �(self-asserted)

Medium�(e.g. postal credential delivery)

High

(e.g. F2F)

Single-factor authentication

Multi-factor authentication

Affiliation freshness �1 month

Affiliation freshness �1 day

REFEDS Assurance framework (RAF)

AuthN profiles

”Goes with”

14 of 24

Single-factor authentication profile

https://refeds.org/profile/sfa

To be expressed by the CSP in the AuthnContextClassRef (SAML) or acr claim (OIDC)

15 of 24

SFA profile requirements

Identifiers

ID proofing

Authentication

Attributes

ID is unique, personal and traceable

ePPN is unique, personal and traceable

Low �(self-asserted)

Medium�(e.g. postal credential delivery)

High

(e.g. F2F)

Single-factor authentication

Multi-factor authentication

Affiliation freshness �1 month

Affiliation freshness �1 day

Authenticator type	Secret basis	Min length
Memorized Secret	≥52 characters (e.g. 52 letters)	12 characters
Memorized Secret	≥72 characters (e.g. 52 letters + 10 digits + 10 special characters)	8 characters
Time based OTP-Device�Out-of-Band Device	10-51 characters (e.g. 10 digits)	6 characters
Time based OTP-Device�Out-of-Band Device	≥52 characters (e.g. 52 letters)	4 characters
Look-Up Secret Sequence based OTP-Device	10-51 characters (e.g. 10 digits)	10 characters
Look-Up Secret Sequence based OTP-Device	≥52 characters (e.g. 52 letters)	6 characters
Cryptographic Software/Device�	RSA/DSA	2048 bit
Cryptographic Software/Device�	ECDSA	256 bit

16 of 24

Further SFA requirements

Protection against online guessing (e.g. rate limiting).
Secrets cryptographically protected at rest and in online transit

Way of delivery	Maximum life time
Time based OTP Device	5 minutes
Telephone network (e.g. SMS, phone)	10 minutes
E-mail �(e.g. recovery link)	24 hours
Postal mail	1 month

17 of 24

SFA requirements:�Replacement of a lost authentication factor

An existing secret must not be sent to the user (e.g. a stored password).
The replacement procedure does not solely rely on knowledge-based authentication (e.g. answer a secret question).
Human based procedures (e.g. service desk) ensure a comparable level of assurance of the requesting user identity as the initial identity vetting.
In order to restore a lost authentication factor, an OTP may be sent to the users address of record.
For authenticators which are provided to the user as a backup, all requirements of the corresponding authentication factor apply.

18 of 24

Multi-factor authentication profile

https://refeds.org/profile/mfa

To be expressed by the CSP in the AuthnContextClassRef (SAML) or acr claim (OIDC)�

19 of 24

MFA profile requirements

Identifiers

ID proofing

Authentication

Attributes

ID is unique, personal and traceable

ePPN is unique, personal and traceable

Low �(self-asserted)

Medium�(e.g. postal credential delivery)

High

(e.g. F2F)

Single-factor authentication

Multi-factor authentication

Affiliation freshness �1 month

Affiliation freshness �1 day

The authentication of the user’s current session used a combination of at least two of the four distinct types of factors: something you know, something you have, something you are, something you do)
The factors are independent (access to one factor does not by itself grant access to other factors)
The combination of the factors mitigates single-factor only risks related to non-real-time attacks such as phishing, offline cracking, online guessing and theft of a (single) factor

20 of 24

Configuring and testing IdP

21 of 24

Configuring IdP products

Shibboleth:

https://wiki.refeds.org/x/MYBRAg

SimpleSAMLphp:

please contribute to REFEDS wiki!

Microsoft ADFS:

custom attributes (eduPersonAssurance) supported
custom authentication contexts not supported

22 of 24

https://attribute-viewer.aai.switch.ch/aai/

RAF values released by your IdP

You can ask the test SP to request particular authentication context and display IdP’s response

23 of 24

What RAF/SFA/MFA does not cover

no SAML2 metadata defined

no technical requirements for federation operator metadata management

no conformance check program defined

self-assessment of the CSP
use SWITCHaai attribute viewer for testing technical conformance

24 of 24

Questions?

The work has been funded by

AARC, AARC2 and GN4 projects