Identity and Authentication

Web Architecture (INFO 290-03)

Erik Wilde, UC Berkeley School of Information
2008-09-16

Creative Commons License

This work is licensed under a CC
Attribution 3.0 Unported License

Abstract

For any task involving personalization and/or trust, it is not only necessary to have a concept for providing privacy, but also to have concepts for identity and how to prove identity, which needs authentication. HTTP has built-in mechanisms for authentication, and the standard HTTP Authentication mechanisms are Basic Authentication and Digest Access Authentication. Instead of these mechanisms, many applications implement their own ways of authentication, which often are based around authentication using HTML Forms.


Anonymous Authenticity

Outline (Anonymous Authenticity)

  1. Anonymous Authenticity [2]
  2. HTTP Authentication [6]
    1. Basic Authentication [2]
    2. Digest Access Authentication [2]
  3. Application Authentication [4]
  4. Conclusions [1]

Certificates and Identity


Usernames and Password


HTTP Authentication

Outline (HTTP Authentication)

  1. Anonymous Authenticity [2]
  2. HTTP Authentication [6]
    1. Basic Authentication [2]
    2. Digest Access Authentication [2]
  3. Application Authentication [4]
  4. Conclusions [1]

HTTP Access Control


HTTP Authentication

HTTP Authentication

Basic Authentication

Outline (Basic Authentication)

  1. Anonymous Authenticity [2]
  2. HTTP Authentication [6]
    1. Basic Authentication [2]
    2. Digest Access Authentication [2]
  3. Application Authentication [4]
  4. Conclusions [1]

Authentication Information


Repeated Access

  • Clients typically access more than one protected resource
    • a perfectly stateless client would always request authentication from the user
    • using the Authentication Information clients can identify repeated accesses
  • Clients remember the authentication and replay it automatically
    • browsers provide little control over this feature
    • logging out of HTTP authenticated sessions is hard

Digest Access Authentication

Outline (Digest Access Authentication)

  1. Anonymous Authenticity [2]
  2. HTTP Authentication [6]
    1. Basic Authentication [2]
    2. Digest Access Authentication [2]
  3. Application Authentication [4]
  4. Conclusions [1]

Better HTTP Authentication

  • Basic Authentication is a serious security problem
    • username and password are transmitted unencrypted
  • Digest Access Authentication does not require transmission of the password
    • only information computed using a One-Way Function is transmitted via HTTP
    • server-side needs clear-text password to compute HTTP header values
  • Three-step one-way function calculation of response value
    1. HA1 = MD5(username, realm, password)
    2. HA2 = MD5(HTTP method, request URI)
    3. Response = MD5(HA1, nonce, nc, cnonce, qop, HA2)
  • Server responses may include AuthenticationInfo
    • information for the next authenticated request

Example Headers

HTTP/1.0 401 Unauthorized
WWW-Authenticate: Digest realm="testrealm@host.com",
	qop="auth,auth-int",
	nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
	opaque="5ccc069c403ebaf9f0171e9517f40e41"
GET /dir/index.html HTTP/1.0
Authorization: Digest username="Mufasa",
	realm="testrealm@host.com",
	nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
	uri="/dir/index.html",
	qop=auth,
	nc=00000001,
	cnonce="0a4f113b",
	response="6629fae49393a05397450978507c4ef1",
	opaque="5ccc069c403ebaf9f0171e9517f40e41"

Application Authentication

Outline (Application Authentication)

  1. Anonymous Authenticity [2]
  2. HTTP Authentication [6]
    1. Basic Authentication [2]
    2. Digest Access Authentication [2]
  3. Application Authentication [4]
  4. Conclusions [1]

Login Page


HTTP and Form-Based Login


Form-Based Authentication

Form-Based Authentication

HTML Session Management

<form action=".../generateReport.cfx" method="post">
 <input name="vin" type="hidden" class="inputVINfield" value="{vin}"/>
 <input type="hidden" name="user" value="...@DRET.NET"/>
 <input type="hidden" name="email" value="...@DRET.NET"/>
 <input type="hidden" name="zip" value="94709"/>
 <input type="hidden" name="sessionSequence" value="070916220678735"/>
 <input type="hidden" name="encryptedSid" value="yVXQOIQV01yWJBf8EtB7hA%3D%3D"/>
 <input type="hidden" name="cardHolderName" value="Erik Wilde"/>
 <input type="hidden" name="chargeAmount" value="29.99"/>
 <input type="hidden" name="sendMeEmail" value="N"/>
 <input type="hidden" name="addressOne" value="1771 ... Street"/>
 <input type="hidden" name="addressTwo" value=""/>
 <input type="hidden" name="cfxId" value="CFX000017762596"/>
 <input type="hidden" name="city" value="Berkeley"/>
 <input type="hidden" name="state" value="CA"/>
 <input type="hidden" name="consumerId" value="10100990"/>
 <input type="hidden" name="sid" value="yVXQOIQV01yWJBf8EtB7hA%3D%3D"/>
 <input type="hidden" name="expireDate" value="20071016220836"/>
 <input type="hidden" name="reportsAvailable" value="199"/>
 <input type="hidden" name="product" value="UCP"/>
 <input id="reportButton" name="reportButton" type="submit"/>
</form>html-form-state.xml

Conclusions

Outline (Conclusions)

  1. Anonymous Authenticity [2]
  2. HTTP Authentication [6]
    1. Basic Authentication [2]
    2. Digest Access Authentication [2]
  3. Application Authentication [4]
  4. Conclusions [1]

Web or Application Architecture