aai @ chuv - switch · 2010. 8. 27. · •presentation of the chuv ... 3 aai authentication 4...

CHUV

AAI @ CHUV

Vincent BexSystems Engineer

[email protected]

Patrick ZossoInfrastructure Project Manager

[email protected]

CHUV

• Presentation of the CHUV

• Security concepts at CHUV

• The challenge

• AAI implementation for UNIL students

Agenda

CHUV

Some indicators• 7100 Employees + 400 Students

• 1300 Beds

• 2 campuses and several small remotesites

Presentation

CHUVPresentation

• Equipments• PC 7000

• Printers 1930

• Servers 250

• Applications 750

• Storage• 70Tbytes

CHUVPresentation

• Locations• One LAN spread on 2 main campuses

• 23 Small remote sites

• 385 network equipments• VPN

• Firewalls

• Routers

• Switches

• WiFi

• …

CHUV

• Security concepts at CHUV

• The challenge


Agenda

CHUV

Internet

Intranet

DataCenter

DMZ

tcp any

http://www.switch.aaiOrhttp://kodc2.nfrdi.re.kr:8001

Security concepts at CHUV

http://www.switch.aai

http://kodc2.nfrdi.re.kr:8001

CHUV

Internet

Intranet

DataCenter

DMZHTTPProxy

tcp 8080

tcp any


CHUV

Internet

Intranet

DataCenter

DMZ

UnilStudent

HTTPProxy

tcp 8080

tcp any

LDAP

HTTPProxy


CHUV

• The challenge


Agenda

CHUVThe Challenge

The situation:

• Users who are not CHUV employees (UNIL students) needto access internet from our premises

• They use specific PCs from the library

• They use PCs configured to automatically logon with ageneric account

CHUVThe Challenge

The needs:

• We need to identify the users who access internet forpolicy enforcement purpose

CHUVThe Challenge

The environment:

• Our proxies are currently BlueCoat appliances

• BlueCoat does not support mod_shib authentication

• Shibboleth is “easy” to implement on IIS or Apache

• We need to force the PCs to use the proxy

CHUVThe Challenge

The solution:

• A dedicated BlueCoat proxy

• A Service Provider on Debian 4.0

• Apache 2.2 with mod_shib enabled

• Open LDAP

• Two CGI scripts

• A GPO to force the user’s PCs to use the proxy

CHUV


Agenda

CHUVAAI implementation for UNIL students

Internet1

HTTPRequest/response

1 Internet access request

HTTP Proxy

CHUV

Internet

HTTP Redirection

2

HTTP Proxy

2 Redirection to a perl script protected by ShibbolethHTTP

Request/response

AAI implementation for UNIL students

CHUV

InternetServer to server connection

3

3

HTTP Proxy

3 AAI authenticationHTTP

Request/response

HTTP Redirection


CHUV

Internet

4

HTTP Proxy

Server to server connection


HTTP Redirection

4 Creating the LDAP user


CHUV

Internet

5

HTTP Proxy



HTTP Redirection

5 Creating and sending the authentication form


CHUV

Internet

6

HTTP Proxy



HTTP Redirection

6 The proxy requests authentication to the LDAP server


CHUV

Internet

7

HTTP Proxy



HTTP Redirection

7 LDAP user gets deleted


CHUV

Internet

8

HTTP Proxy



HTTP Redirection

8 Redirection to the requested URL


CHUV

Internet9

HTTP Proxy



HTTP Redirection

9 Internet access


CHUV

Internet1

2

3

3

7

5

4

9

1 Internet access request2 Redirection to a perl script protected by Shibboleth3 AAI authentication4 Creating the LDAP user

8

5 Creating and sending the authentication form6 The proxy requests authentication to the LDAP server7 LDAP user gets deleted8 Redirection to the requested URL9 Internet access

6

HTTP Proxy



HTTP redirect


CHUV

Q&A

Q&A

aai @ chuv - switch · 2010. 8. 27. · •presentation of the chuv ... 3 aai authentication 4...

Documents