FIDO/GLUU Identity Provider

This guide describes how to implement a NIEF SAML Identity Provider (IDP) system that authenticates with Fast IDentity Online (FIDO) credentials held on a personal mobile device.

Background

FIDO is a standard for performing multifactor authentication of users by verifying proof of possession of a smart phone, along with requiring the user to authenticate themself to the smart phone with a biometric. This FIDO/Gluu Implementation Guide provides details on how to deploy a NIEF SAML IDP using the Gluu Server along with the ThumbSignIn online FIDO service. The Gluu Server only runs on the Linux operating system (it can be run within a virtual machine or docker container).

This guide is designed around the use of commercial software that has free versions that are sufficient for small and simple deploys:

• ThumbSignIn
• Gluu Server Community Edition

Getting Started

The Gluu Server runs on various versions of Linux, details of all supported versions can be found within the Gluu Installation Guide. For this guide, we will assume the use of CentOS 7 as it is free and the version of Linux the NIEF team knows best.

Preparing Linux

• Prior to installing Gluu update the CentOS selinux settings to permissive within the /etc/selinux/config file.
• There are additional preparatory steps listed within the Gluu Installation Guide that may be required depending on your virtual hosting platform/service and/or version of Linux.

Installing Gluu

Installing RPMs

It may be easier to follow the detailed Gluu Installation Guide, but the quick version of the install steps are included here. Each of these commands should be executed from a root login on the Linux machine to add/trust the Gluu repository and then install the Gluu Server RPM:

   # wget https://repo.gluu.org/centos/Gluu-centos7.repo -O /etc/yum.repos.d/Gluu.repo
   # wget https://repo.gluu.org/centos/RPM-GPG-KEY-GLUU -O /etc/pki/rpm-gpg/RPM-GPG-KEY-GLUU
   # rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-GLUU
   # yum clean all
   # yum install gluu-server-3.1.5

Updating Linux Startup

Next you need to update the Linux server to start the Gluu service on boot:

   # /sbin/gluu-serverd-3.1.5 enable 
   # /sbin/gluu-serverd-3.1.5 start

Initial Gluu Setup

Finally, you need to login to the Gluu container and configure it for initial use:

   # /sbin/gluu-serverd-3.1.5 login
   # cd /install/community-edition-setup
   # ./setup.py

This setup script will prompt for a variety of things, most of these should be obvious how to populate or can be left as the default settings. There are three we call out as important:

• Password for oxTrust and LDAP superuser - This password is important for further configuration of the system, be sure to set it to something you can remember and/or use in your password manager.
• Install Apache HTTPD Server - If your Linux deploy already has a working Apache httpd install, you may wish to forgo this and use your configuration of Apache HTTPD. If you prefer to use the Gluu version, you may need to disable the Apache Httpd you have installed.
• Install Shibboleth SAML IDP - This defaults to false, but it is required for our purposes.

At the end of this install you will be redirected to use a browser to point to the configuration GUI for Gluu. If that URL works, you should see a login page that looks like this:

Gluu Login

You will want to login as admin with the password specified during the setup step (Password for oxTrust and LDAP superuser) specified earlier. If the login fails, you may need to reboot your system, as some of the required services may not have started on install.

Create ThumbSignIn Account

Install ThumbSignIn App

Initially you will need to install the ThumbSignIn App from the Google Play Store or the Apple App Store. Searching for ThumbSignIn should show the app, it is published by Pramati.

Create ThumbSignIn Account

You can regsiter a new ThumbSignIn account on the register page: https://app.thumbsignin.com/signup. You will need to provide an email address which will be associated with the account and used for account recovery. Account creation proceeds using the ThumbSignIn mobile app.

Required Data

There are only two critical data items required from the ThumbSignIn portal, you can get them by using the links to automatically copy them to the clipboard during later Gluu configuration steps:

Configuring Gluu

To use the Gluu configuration UI you will need to login to oxAuth. You should be able to do this by following the link provided during install. Once you have logged into Gluu as a superuser, you should see a configuration UI that looks like the following:

Configuring ThumbSignIn Plugin

Find the ThumbSignIn Plugin in the menu under configuration -> manage custom scripts as seen here:

Within this script you will need to populate three fields:

You will need to populate these three fields:

1. ts_host - https://api.thumbsignin.com
2. ts_apiKey is the Application ID from the ThumbSignIn Portal
3. ts_apiSecret is the Secret Key from the ThumbSignIn Portal

You must enable the the plugin by clicking the checkbox at the bottom of the ThumbSignIn expanded script:

Finally, you have to click Update to load the plugin:

Configuring Registration

For more sophisticated user registration customized for your organization and deploy, please review the capabilities available within Gluu's SCIM 2.0 APIs. For very simple user registration useful for a demonstration deploy you can enable basic user registration.

A quick synopsis for basic user registration is included here. Navigate to the user registration custom script:

If you want to mimic the behavior of the existing NIEF demonstration at https://fido.nief.org, you will also want to update the script value for enable_user to true so that an administrator does not need to enable each user registered. For production deploys this value would likely remain false if this user registration script is used. Click the enable checkbox and click update to enable user registration:

You can now access this user registration page at https://<hostname>/identity/register.

Configuring SAML Trusted Partners

TBD - May wish to tweak to insure Gluu doesn't corrupt a working Shibboleth configuration.

Testing

It is always a good idea to test and validate a new IDP deployment within a test environment. The NIEF Testbed is intended for exactly this purpose.