Jérôme DUCLOS Architecte Winwise Sécuriser une application avec le Framework Geneva et la plate-forme Azure Rochdi CHAKROUN Lead Technique Winwise Jérôme DUCLOS Architecte Winwise

e-mail : contact@winwise.ch Site web : www.winwise.ch Société d’expertise spécialisée sur les nouvelles technologies Microsoft 90 consultants experts certifiés sur les dernières technologies Microsoft dont 7MVP et 1 RD 4 centres de compétences pour réaliser vos projets à forte valeur ajoutée : Travail collaboratif  Business Intelligence & Data Management Génie logiciel et Cycle de vie des applications  Interfaces Utilisateurs et « Smart Clients » 1er centre de formation en France sur les technologies .Net et la BI Pour tout renseignement rendez-vous sur notre stand partenaire

Sécuriser une application avec le Framework Geneva et la plate-forme Azure

Sommaire L’identité, nouveau modèle Etude de cas Feuille de route Microsoft Services Connector « Geneva » Server « Geneva » Framework « Geneva » CardSpace Access Control Service Feuille de route

Identité Identité numérique : ensemble de revendications (claims) émis par un sujet, se rapportant soit à lui-même soit à un autre sujet. 1

Identité Claims Claim (revendication) Etablit un fait se rapportant à une chose ou une personne. Exemple : Majeur : Oui N° police d’assurance : 2571771

Identité Jeton de sécurité TechReady7 Breakout Chalktalk Template 3/30/2017 Identité Jeton de sécurité matériel de clé [facultatif] Signature de l’émetteur S NomClaim1: Valeur1 E … NomClaimn: Valeurn Collection de Claims Chiffrement pour le public concerné © 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Software + Service Combiner applications existantes et services hébergés sur Internet 2

Software + Service Vos applications

Software + Service Services Modèle d’accès sur les claims Logiciels Liberté de choix Amélioration de la productivité Basé sur les standards Live Identity Services Microsoft Federation Gateway .NET Access Control Service Services Modèle d’accès sur les claims “Geneva” Server Microsoft Services Connector Windows CardSpace “Geneva” “Geneva” Framework Live Framework Logiciels Active Directory

Le méta-système d’identités Architecture ouverte et reposant sur des standards afin d’assurer l’échange des claims, sous contrôle de l’utilisateur. 3

Le méta-système d’identité Le médecin fournit le certificat Le réglement exige un certificat médical Relation 1. Demande de claims 2. Obtention de claims 3. Envoi de claims Coureur

Le méta-système d’identité STS WS-Trust RP S

Le méta-système d’identité STS Security Token Service Externalisation de l’authentification (ou pas) IP-STS associé à un magasin d’identités R-STS transforme simplement les claims (indirection, format) Fournit les claims

Le méta-système d’identité RP Relying Party Une application, un fournisseur de ressources, un STS Consomme les claims

Le méta-système d’identités « passif » = non SOAP Obtient contrôle et transmet les claims S Subject

Fédération Pour une application b2b ou utilisant des services hébergés il est essentiel de ne pas multiplier les comptes et de pouvoir proposer le SSO aux utilisateurs. 4

Fédération STS STS RP S

Scénarios Deux ministères fusionnent pour donner le ministère de la Santé et des Sports : les agents des directions régionales doivent partager des ressources une application qui recense les associations et équipements sportifs

Scénarios 1er défi : Partage de répertoires et de calendriers 2ème défi : Accéder à une application depuis l’extérieur, depuis un autre domaine 3ème défi Permettre aux clubs d’accéder à l’application 4ème défi Intégrer des partenaires et des services extérieurs

Scénarios Microsoft Service Connector « Geneva » Server Framework Access Control Service

Microsoft Services Connector

Microsoft Service Connector 3/30/2017 1:00 AM Microsoft Service Connector Nom de domaine Certificat SSL URL publique © 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Microsoft Service Connector 3/30/2017 1:00 AM Microsoft Service Connector Ajout des utilisateurs 3 claims © 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Microsoft Service Connector 3/30/2017 1:00 AM Microsoft Service Connector Gestion automatique des mises à jour Installation possible en mode proxy ou ferme sur une forêt ou plus Protocoles WS-*, SAML Jetons SAML © 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Scénarios Microsoft Service Connector « Geneva » Server Framework Access Control Service

« Geneva » Server

démo "Geneva" Server Intégrer les claims 3/30/2017 1:00 AM © 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Geneva Server Fedutil Ce qui change Ce que l’on gagne Création et échange des méta-données pour établir la relation Mode d’authentification (anonyme) Redirection de l’utilisateur qui s’authentifie ailleur et retourne des claims Ce que l’on gagne Sans modification du code : la sécurité par rôle fonctionne Souplesse : l’administrateur du définit le mode d’authentification et les rôles des utilisateurs

Geneva Server

démo "Geneva" Server Extranet Web SSO 3/30/2017 1:00 AM © 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Geneva server STS sur l’AD Fournisseur de cartes gérées sur l’AD Fournisseur d’identité et de fédération Fournisseur de cartes gérées sur l’AD Sélecteurs d’identité CardSpace et InfoCard Gestionnaire de confiance pour fédération Automatisation de la maintenance par échange de meta-données Standards et interoperabilité Protocoles WS-* & SAML 2.0 “Web SSO profile” Jetons SAML 1.1 & 2.0

Geneva Server

démo "Geneva" Server Fédération 3/30/2017 1:00 AM © 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Geneva Server Federation Ce qui change Echange de métadonnées pour établir la relation Transformation des claims pour adapter ce qui arrive en entrée aux claims attendus par l’application L’utilisateur précise son domaine Ce que l’on gagne Installation facile, il suffit de connaître l’URL du STS du partenaire Pas de réécriture de l’application : impédance par la transformation des claims SSO pour les utilisateurs (par choix) Fédération possible avec tout STS conforme aux standard WS-Federation et SAML 2.0

Geneva Server « Geneva» CardSpace Sélecteur d’identité Carte d’information ou i-card contient des métadonnées : types de jeton émis types de claim émis identifiant de l’émetteur type d’authentification exigé points de terminaison du STS

« Geneva » Server ADFS 2 AD FS 1 “Geneva” (Server) WS-Federation 1.0 1.0, 2.0 WS-Trust 1.3 n/a Oui WS-SecurityPolicy 1.2 Protocoles Web SSO SAML 1.0/1.1 Protocoles Web SSO SAML 2.0 Jetons SAML 1.1 Jetons SAML 2.0 Magasin de comptes AD Magasin d’attributs AD Magasin de policy Fichier plat SQL Information Card Non

Scénarios Microsoft Service Connector « Geneva » Server Framework Access Control Service

« Geneva » Framework STS sur mesure et génération de carte

STS sur mesure et génération de carte 3/30/2017 1:00 AM Geneva Framework démo STS sur mesure et génération de carte © 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Geneva Framework Modèle de claims IClaimsPrincipal IClaimsIdentity IClaimsIdentity Sample Fill Sample Fill Claim ClaimType = “Name” Value = “Bob” Issuer = “WLID” Subject

Geneva Framework Home Realm Discovery Service Relying Party Client MMC: Policy UX MMC: Service UX Geneva FX API Card Space Geneva FX API {WS-Fed Passive } {WS-Fed Metadata} {WS-Fed Passive } {WS-Trust WS-MEX} {WS-Fed Metadata} {Information Card Issuance} {Policy Management} {WMI} Geneva Server Runtime Geneva FX API Protocol Hosting (WS-Trust, Metadata, WS-Federation) Information Card Issuance Service Policy Management Service WMI Provider Issuance Engine Identity Store Interface Policy Store Interface LDAP Store SQL Store {SQL} {LDAP} {FileIO} AD/ADAM User Attribute AuthN Store Config File SQL Policy Store

Scénarios Microsoft Service Connector « Geneva » Server Framework Access Control Service

Acces Control Service

Access Control Service 3/30/2017 1:00 AM Access Control Service démo © 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Access Control Service Architecture Quatre services : STS délivrant les jetons, service de gestion des règles, moteur de règles, portail API publique pour le STS et le service de gestion des règles STS Gestion règles Portail Modèle Données Moteur de règles Stockage

Access Control Service STS Security Token Service Custom Handlers, Authenticators, Policies … IDFX Security Token Service Custom Handlers, Authenticators, Policies … IDFX STS Custom Handlers, Authenticators, Policies … “Geneva” Framework WCF Front-End WS-Trust WS-Federation (Passive) Internet SOAP Client HTTP Client

Feuille de route Software Services “Geneva” Server Aujourd’hui S1 2009 S2 2009 Software “Geneva” Server Beta 1 Beta 2 RTM Beta Microsoft Service Connector CTP RTM “Geneva” Fx, CardSpace Beta 1 Beta 2 RTM Live Framework In Production Services Live Identity Services OpenID RTM OpenID Beta Microsoft Federation Gateway In Production .Net Access Control Service CTP Beta 1

Références “Geneva” sur Microsoft Connect Microsoft Services Connector http://go.microsoft.com/fwlink/?LinkId=122266 Microsoft Services Connector www.microsoft.com/servicesconnector Microsoft Federation Gateway Whitepaper Access Control Service www.microsoft.com/azure/accesscontrol.mspx

Save the date for tech·days next year! 3/30/2017 1:00 AM Save the date for tech·days next year! 14 – 15 avril 2010, CICG © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Premium Sponsoring Partners 3/30/2017 1:00 AM Premium Sponsoring Partners Classic Sponsoring Partners © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.