SECURING THE NEW DIGITAL EXPERIENCE

Latest Entries

Write secure code, don’t write security code. Read more

Tuning the industry’s most trusted directory server. Read more

Harnessing Sun’s OpenSSO Authentication and Authorization.

Fine-grained authorization and XACML. Read more

THE NEW DIGITALEXPERIENCE

SECURING

steffo.weber@oracle.com

Steffo Weber, Oracle

Tuesday, 11-June-2013Under AttackDesigning Diversified Websystems using Oracle API Gateway

Donnerstag, 13. Juni 13

Measures LimitsRisks

‣ Securing operations

‣What to do under attack

‣ Additional measures‣What cannot be

solved

‣ Redundancy vs Diversity

Overview

Reducing the riskRisk and Threat‣ Common threats

• Stealing password• Denial of service• Unauthorized access to data

‣ Common counter-measures• Encryption• High-Availabilty• Strong authentication• Screening

Reducing the riskRisk and Threat‣ Common threats

• Stealing password• Denial of service• Unauthorized access to data

‣ Common counter-measures• Encryption• High-Availabilty• Strong authentication• Screening

What if security mechanisms fail?

Errors in security implementationsThe SAML Case‣ SAML

• OpenSSL, IBM DataPower‣ SSL vulnerabilities

• Lucky thirteen, BEAST, Renegotiation attack (DoS)• OpenSSL, SSLeay

‣ SSH vulnerabilities• Leak of private data• OpenSSH et al

‣ Packet filtering• Firewalls• iOS

Download from OracleRecap. WebSSO

Download from OracleRecap. WebSSOoracle

download

sign-in first

Same with support...Recap. WebSSO

oracle support

... you have to login.Recap. WebSSO

login first

But once, you’re logged in...Recap. WebSSO

support

SAML allows for multi-site SSORecap. SAML

oracle.com

otn.oracle.comsupport.oracle.com

oracle.com

ibm.comLOGIN via Oracle

<samlp:AuthnRequest xmlns:samlp= "urn:oasis:names:tc:SAML:2.0:protocol">FROM: ibm.com</samlp:AuthnRequest>SSO

oracle.com

ibm.comLOGIN via Oracle

<samlp:AuthnRequest xmlns:samlp= "urn:oasis:names:tc:SAML:2.0:protocol">FROM: ibm.com</samlp:AuthnRequest>

<samlp:Response xmlns:samlp= "urn:oasis:names:tc:SAML:2.0:protocol">FROM: oracle.com<saml:Assertion> <saml:Issuer> identity.oracle.com </saml:Issuer></saml:Assertion></samlp>

SSO SSO

oracle.com ibm.com

LOGIN via Oracle

GET /fed/idp/samlv20?SAMLRequest=<base64string> HTTP/1.1Host: identity.oracle.com:8080User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:14.0) Gecko/20100101 Firefox/14.0.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-us,en;q=0.7,de;q=0.3Accept-Encoding: gzip, deflateConnection: keep-aliveReferer: http://ibm.com:8080/fedletsample/Pragma: no-cacheCache-Control: no-cache

oracle.com ibm.com

LOGIN via Oracle

Sanity check

Think of RMI or RPC or....Recap. SOAP WS

<?xml version="1.0"?><soap:Envelopexmlns:soap="http://www.w3.org/2001/12/soap-envelope"soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding">

<soap:Body xmlns:m="http://www.example.org/stock"> <m:GetStockPrice> <m:StockName>ORCL</m:StockName> </m:GetStockPrice></soap:Body>

</soap:Envelope>

SOAP Message

HTTP MessagePOST /InStock HTTP/1.1Host: www.example.orgContent-Type: application/soap+xml; charset=utf-8Content-Length: 645

Think of RMI or RPC or....Recap. SOAP WS

<?xml version="1.0"?><soap:Envelopexmlns:soap="http://www.w3.org/2001/12/soap-envelope"soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding">

<soap:Body xmlns:m="http://www.example.org/stock"> <m:GetStockPrice> <m:StockName>ORCL</m:StockName> </m:GetStockPrice></soap:Body>

</soap:Envelope>

SOAP Message

OAGis made

handle this out-of-the-

Federated Login

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="aaf23196-1773-2113-474a-fe114412ab72" Version="2.0" IssueInstant="2004-12-05T09:21:59" AssertionConsumerServiceIndex="0" AttributeConsumingServiceIndex="0"> <saml:Issuer>https://ibm.com/SAML2</saml:Issuer> <samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/> </samlp:AuthnRequest>

SAML Message

Federated Login

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="aaf23196-1773-2113-474a-fe114412ab72" Version="2.0" IssueInstant="2004-12-05T09:21:59" AssertionConsumerServiceIndex="0" AttributeConsumingServiceIndex="0"> <saml:Issuer>https://ibm.com/SAML2</saml:Issuer> <samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/> </samlp:AuthnRequest>

SAML Message

Not handled out-of-the-

Check SAMLRequest messagesThe SAML Case

identity.oracle.comOAGReverseProxySAML

Request

Get SAMLRequestConfigure OAG

Request is- zipped- base64 enc

From HTTP param to DOM objectConfiguring OAG

import com.vordel.mime.XMLBody;import com.vordel.mime.HeaderSet;import com.vordel.mime.ContentType;import com.vordel.mime.ContentType.Authority;import java.lang.String;import com.vordel.common.base64.Decoder;import com.oracle.identity.SamlRequest;import groovy.xml.DOMBuilder;import groovy.xml.dom.DOMCategory;

def invoke(msg) { def saml = msg.get("saml.request"); def reader = new StringReader(SamlRequest.decode(saml)); def samlRequest = DOMBuilder.parse(reader); def samlMimeBody = new XMLBody(new HeaderSet(),new ContentType(ContentType.Authority.MIME,"text/xml"), samlRequest); msg.put("content.body",samlMimeBody); return true; }

Groovy Filter: dynamic language support

Now we can apply OAG default filters.Donnerstag, 13. Juni 13

Applying security filtersConfiguring OAG‣ Check whether XML document (SAML Request) is

• well-formed• does not exceed a certain size• has a limited number of children/attributes per node• does not contain a virus

‣ Preventing DoS attacks via throttling• restricting the no of messages per minute

Applying security filtersConfiguring OAG

Admin Console w FiltersConfiguring OAG

vs. RedundancyDiversification ‣ Scenario

• SAML vulnerability becomes public• SSL implmentation is vulnerable• DataPower and OpenSSO affected

‣ Solution (other possible)• Only authenticated users are allowed to use OIF

service• Establish SSO via Access Manager• Terminate SSL traffic at a different implentation/box

vs. RedundancyDiversification

identity.oracle.com

SAMLRequest

OAGReverseProxy

WebGate LDAPOAM

Summary

Benefits LimitsProtection

‣ SOAP/REST‣ SAML‣ HTML Form‣ Custom

‣ Training‣ Coding Skills

‣ Flexibility‣ Diversification‣ Integrated with

Oracle Stack

SECURING THE NEW DIGITAL EXPERIENCE

Documents

Securing Industry in the Digital Age

Securing Your Web World - Digital River

Experience Design Framework for securing Large Scale...

Securing land rights in post-conflict settings: experience.....

How Securing Digital Identities & Information Can Help...

Digital Experience Analytics v10. Agenda Digital Experience....

ROBERT MORGUS SECURING DIGITAL DIVIDENDS

Securing Content In A Digital World

Report on Securing and Growing the Digital Economy

Accelerating and securing the digital experience

SECURING THE DIGITAL CITY - dkf1ato8y5dsg.cloudfront.net ·...

Securing your digital world - Cybersecurity for SBEs

Securing Your Digital Wallet

Securing the New Digital Enterprise Infographic

2021 Trends in Securing Digital Identities

Securing Democracy In the Digital Age - Amazon S3