秋山, 豊和

Akiyama, Toyokazu

In Osaka University, a campus-wide IT authentication infrastructure based on Public Key Infrastructure (PKI), which is regarded as a technology providing high security and standard interface to many applications, has been adopted. In this authentication infrastructure, multiple CAs for the different purposes such as signing and encryption, intra-campus authentication and grid system authentication coexist. To realize security and convenience, we developed an online certificate issuance service for those multiple CAs. We also introduced PKI enabled Single Sign-On (SSO) system to provide unified authentication interface. Since the SSO system supports ‘SSO agent’, which provides SSO functionality for web applications by installing a web server module, it is possible to migrate from password authentication to PKI authentication without modifying applications. Furthermore, we established secure and flexible identity management by separating changeable, public user ID and static, internal system ID. Internal system ID is used for managing and federating user profiles among the systems. The mapping between those two IDs is done by the SSO system. In this paper, we describe design and implementation of our authentication infrastructure, know-how of system establishment and future works.

秋山, 豊和