Elevating trust in user identity during RESTful authentication and authorization
Credentials sent over a back channel during the authentication of a user to a RESTful service can elevate the trust the recipient system can place in the user's identity. The addition of an identity credential of higher strength can increase confidence in user identities electronically presented with a lower strength credential. Attributes from either credential can be used to determine authorization to a protected resource.
1. A computer-implemented method of authenticating and authorizing an entity, comprising:
receiving, by a RESTful service, a request from an entity, wherein the request is for access to a protected resource;
redirecting the entity to a relying party, wherein the relying party facilitates the authentication of the entity and stores a first credential and a SAML credential;
receiving, by the RESTful service, the first credential from the relying party, wherein the first credential is received through a front channel;
receiving, by the RESTful service, the SAML credential from the relying party, wherein the SAML credential is received through a back channel;
authenticating the entity at a level of confidence based on the credential strength of the first credential and based on the credential strength of the SAML credential; and
authorizing the entity's access to the protected resource, wherein the authorization is based on attributes contained in the SAML credential.
2. The method of claim 1 , wherein the relying party facilitates the authentication of the entity using an OpenID identity provider.
3. The method of claim 1 , wherein the SAML credential has a credential strength of DoDI 8520.03 level C.
4. The method of claim 1 , wherein the SAML credential has an SP 800-63 level of assurance 3.
5. The method of claim 1 , wherein the SAML credential has an SP 800-63 level of assurance 4.
6. The method of claim 1 , wherein the SAML credential passed by the relying party contains X.509 attributes.
7. The method of claim 1 , wherein information passed on the back channel is encrypted using SSL protocol.
8. The method of claim 1 , wherein information passed on the back channel is encrypted using TLS protocol.
9. The method of claim 1 , wherein information passed on the back channel is exchanged using SOAP protocol.
10. The method of claim 1 , wherein the first credential is a CAS credential.
11. A computer-implemented system, comprising:
a computer having a processor and a memory, and
a RESTful service operable to:
receive, from an entity via an entity agent, a request to access a protected resource,
redirect the entity agent to a relying party,
receive a first credential related to the request, wherein the first credential is received from the relying party and through a front channel,
receive a SAML credential related to the request, wherein the SAML credential is received from the relying party and through a back channel,
authenticate the entity at a level of confidence based on the credential strength of the first credential and based on the credential strength of the SAML credential, and
authorize the entity's access to the protected resource, wherein the authorization is based on attributes contained in the SAML credential;
a relying party operable to:
facilitate the authentication of the entity,
store the first credential and the SAML credential,
send, through the front channel, the first credential to the RESTful service, and
send, through the back channel, the SAML credential to the RESTful service.
12. The method of claim 11 , wherein the relying party is further operable to facilitate authentication by using an OpenID profile.
13. The method of claim 11 , wherein the SAML assertion has the credential strength of DoDI 8520.03 level C.
14. The method of claim 11 , wherein the SAML assertion has an SP 800-63 level of assurance 3.
15. The method of claim 11 , wherein the SAML assertion has an SP 800-63 level of assurance 4.
16. The method of claim 11 , wherein the SAML assertion contains X.509 attributes.
17. The method of claim 11 , wherein the relying party is further operable to encrypt the back channel using SSL protocol.
18. The method of claim 11 , wherein the relying party is further operable to encrypt the back channel using TLS protocol.
19. The method of claim 11 , wherein the relying party is further operable to use SOAP protocol on the back channel.
20. A computer-implemented system, comprising:
a computer having a processor and a memory and operable to:
receive, from an entity via an entity agent, a request to access a protected resource,
redirect the entity agent to a relying party,
receive a first credential related to the request, wherein the first credential is received from the relying party and through a front channel,
receive a SAML credential related to the request, wherein the SAML credential is received from the relying party and through a back channel,
authenticate the entity at a level of confidence based on the credential strength of the first credential and based on the credential strength of the SAML credential, and
authorize the entity's access to the protected resource, wherein the authorization is based on attributes contained in the SAML credential;
a relying party operable to:
facilitate the authentication of the entity,
store the first credential and the SAML credential,
send, through the front channel, the first credential to the RESTful service, and
send, through the back channel, the SAML credential to the RESTful service.