EXTENDING DRUPAL AUTHENTICATION

Charles RussellCTSC

UC Davis Medical CenterBennubird Media

SacProNet

What is wrong with this picturehttp://web-cms.findthebest.com/compare/2-42/Drupal-vs-Liferay-Portal

Drupal Authentication

• Multi Layered Security System• Account/Role based• SQL table based and internal into the system• OpenID (optional)

Great for a stand alone site, but what if• You have to integrate with legacy systems• You have to tie this site to other service

providers not using Drupal.• You have to coordinate with other

organizations

Enterprise Level Authentication

• Directory Based• May be some type of SQL based system• LDAP (Lightweight Directory Access

Protocol) • Central Single Sign On

• Kerberose• CAS (Central Access System)

• Federated System• OpenID• SAML (Security Assertion Markup Language)• XACML ( eXtensible Access Control Markup

Language)• Shibboleth• Oauth

Two sides to the authentication

• Identity Providers (IP)• Verify and provide credentials

• Service Providers (SP)• Provide the requested services if user authenticates

In a Drupal only site Drupal is both IP and SP

Things we must understand about Drupal

• Drupal requires accounts• Drupal needs three pieces of information to establish an

account. • User name• Password• Email

• Direct Login is possible and plans should be made to handle the case that the IP no longer certifies the user.

Directory Based Solutions

There are many SQL implementations are custom so look up is going resist generic a generic solution

LDAP is a standard and fortunately is the most common implementation of directory.

A good argument could be made that Drupal’s native authentication is of this type

LDAP(Lightweight Directory Access Protocol)

Directory System Agent is contacted by a client which sends a response back to the client.

• Requests and Responses are sent in plain text

• Every entry has a unique Identifier DN and a set of attributes.

Drupal Implementation of LDAPhttp://drupal.org/project/ldap

Drupal 6 use LDAP Integration Module not LDAP Module

Central Single Sign On

Allows users throughout an organization use a single password to access all of the resources of that organization.

• Passwords are not shared with the application• Communication between client and server are

encrypted and prevents eves dropping and replay attacks

• Kerberos and CAS Protocols are the most common implementation.

Kerberos

Developed at MIT as part of Project Athena which was a project a campus wide computing environment

Drupal Implementation of Kerberos

http://drupal.org/project/kerberos_authentication

CAS

Developed at Yale University. Currently maintained by Java Architectures Special Interest Group.

Drupal Implementation of CAShttp://drupal.org/project/cas

Federated SolutionsAllows access to users of the system outside of their local environment, sending identity information to the application or site that has already been verified by the IP

Allows you to send users to external resources and allows external resources to in a secure way to use your site..

There is a long list of federated protocols some of the more popular open source solutions are OpenID, OAuth, SAML, and Shibboleth.

Open ID

• Developed in 2005 Originally Called YADIS• Comes with Drupal Out of the box• Because Drupal requires user and password

Open id must be assigned to Drupal user • Email still required so legitimacy can be

established• Documentation at

http://Drupal.org/documentation/modules/openid

OAUTH

• Grew out of Open ID• Commercial use very common• Allows sharing of private information with giving

out credentials

Drupal Implementation of OAUTH

http://drupal.org/project/oauth

• Shibboleth is an open-source project that provides Single Sign-On capabilities and allows sites to make informed authorization decisions for individual access of protected online resources in a privacy-preserving manner.

• Very common in education and government• Shibboleth home page http://shibboleth.net

Drupal Implementation of Shibboleth

http://drupal.org/project/shib_auth

OASIS

Organization for the Advancement of Structured Information Standards

SAMLSecurity Assertion Markup Language

• XML Based mark up language to assert Identity• Usually assertion sent as web service in soap wrapper

<saml:Assertion Version="2.0" IssueInstant="2009-02-04T23:08:00.173Z" ID="el-hJZpkAd5XlBywvK_LxieTaC."> <saml:Issuer>IDFED_E2E_IDP_SP_APP</saml:Issuer> <ds:Signature> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> <ds:Reference URI="#el-hJZpkAd5XlBywvK_LxieTaC."> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> <ds:DigestValue>A7IVn/YqCJW6ZQT9/PqFBdZzhuY=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> ……….</saml:Assertion >

Drupal Implementation of SAML