[9160] in DCNS Development
Upcoming IS&T NGS3 Round Table: Security Analysis of Portals and
daemon@ATHENA.MIT.EDU (Dean P Briggs Ph.D.)
Tue Sep 8 08:56:29 2009
From: "Dean P Briggs Ph.D." <dpbriggs@MIT.EDU>
To: "sais.staff@mit.edu" <sais.staff@mit.edu>,
"itag-tap@mit.edu"
<itag-tap@mit.edu>,
"map-contrib@mit.edu" <map-contrib@mit.edu>,
"developers@mit.edu" <developers@mit.edu>,
"security@mit.edu"
<security@mit.edu>, "network@mit.edu" <network@mit.edu>,
"javausers@mit.edu"
<javausers@mit.edu>
CC: "cmeholic@mit.edu" <cmeholic@mit.edu>,
"wdsouza@mit.edu"
<wdsouza@mit.edu>, "tregan@mit.edu" <tregan@mit.edu>,
Catherine T Iannuzzo
<iannuzzo@mit.edu>,
Suresh Damodaran <sureshd@mit.edu>, JoAnne Stevenson
<jsteven@mit.edu>,
John Harmon <jvharmon@mit.edu>
Date: Tue, 8 Sep 2009 08:56:14 -0400
Message-ID: <EEDC15E2A6D72B4EAA6397F6491AD49E290307C10A@w92expo2.exchange.mit.edu>
In-Reply-To: <D7D4BC99F9132A488930E0B535F77B8B3A7764129F@w92expo3.exchange.mit.edu>
Content-Language: en-US
Content-Type: multipart/mixed;
boundary="_004_EEDC15E2A6D72B4EAA6397F6491AD49E290307C10Aw92expo2excha_"
MIME-Version: 1.0
--_004_EEDC15E2A6D72B4EAA6397F6491AD49E290307C10Aw92expo2excha_
Content-Type: multipart/alternative;
boundary="_000_EEDC15E2A6D72B4EAA6397F6491AD49E290307C10Aw92expo2excha_"
--_000_EEDC15E2A6D72B4EAA6397F6491AD49E290307C10Aw92expo2excha_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Dear Colleagues,
You are invited to the second Round Table discussion sponsored by the Next-=
Generation Student Services System program (NGS3):
* September 16, 2009, 2 PM-3:30 PM in Back Bay: "Security Analysis of P=
ortals and Services"
A presentation and discussion of end-to-end security for developers impleme=
nting open-source solutions using standards-based portals and web services.=
Cookies will be provided.
Below are links to documents that offer background on what we will discuss.
* Preliminary Application Security Gap Analysis <https://web.mit.edu/stu=
-future/www/docs/briefs/NGS3-Security-Preliminary-Analysis-1.4.pdf>
A report on the security environment in which NGS3 applications will be dep=
loyed, and a preliminary gap analysis of security implications of deploying=
web applications and web services in IS&T to stimulate discussions on the =
subject.
* Authorization in N-Tier Web Applications<https://web.mit.edu/stu-futur=
e/www/docs/briefs/AuthNTierWebApps.pdf>
An approach to passing the "originating principal" (data about who logged i=
n to use the software application using a browser) down to all the tiers of=
software securely.
* Client Authenticated SSL for Tomcat with CXF Client<https://web.mit.ed=
u/stu-future/www/docs/briefs/ClientAuthenticatedSSL.pdf>
Configuration information for creating client-authenticated SSL connections=
between a Web services client and a server hosting the Web service.
* Touchstone & Moira Integration with Liferay in RHEL5<https://web.mit.e=
du/stu-future/www/docs/briefs/LiferayTouchstoneIntegration.pdf>
Steps and best practices to integrate portal technology with these componen=
ts of MIT's technical infrastructure.
We look forward to seeing you there!
-The NGS3 Team
Please click on the attachment to add this meeting to your calendar.
--_000_EEDC15E2A6D72B4EAA6397F6491AD49E290307C10Aw92expo2excha_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3DContent-Type content=3D"text/html; charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:System;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Trebuchet MS";
panose-1:2 11 6 3 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Trebuchet MS","sans-serif";
color:navy;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:143741444;
mso-list-template-ids:1100539660;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1
{mso-list-id:443772809;
mso-list-template-ids:1872122074;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2
{mso-list-id:724987575;
mso-list-type:hybrid;
mso-list-template-ids:-420859356 159518010 67698691 67698693 67698689 6769=
8691 67698693 67698689 67698691 67698693;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;
color:black;}
@list l2:level2
{mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level3
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level4
{mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l3
{mso-list-id:1047608643;
mso-list-template-ids:46722914;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4
{mso-list-id:1162281055;
mso-list-template-ids:-645873806;}
@list l4:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5
{mso-list-id:1264997556;
mso-list-template-ids:2088268644;}
@list l5:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6
{mso-list-id:1886988435;
mso-list-type:hybrid;
mso-list-template-ids:-987072070 67698689 67698691 67698693 67698689 67698=
691 67698693 67698689 67698691 67698693;}
@list l6:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l6:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l6:level3
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l6:level4
{mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l6:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l6:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l6:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l6:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l6:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3DEN-US link=3Dblue vlink=3Dpurple>
<div class=3DSection1>
<p class=3DMsoNormal><b><i>Dear Colleagues,<o:p></o:p></i></b></p>
<p class=3DMsoNormal><o:p> </o:p></p>
<p class=3DMsoNormal><b><i>You are invited to the second Round Table discus=
sion
sponsored by the Next-Generation Student Services System program (NGS3):<o:=
p></o:p></i></b></p>
<ul style=3D'margin-top:0in' type=3Ddisc>
<li class=3DMsoNormal style=3D'mso-list:l6 level1 lfo3'><b>September 16, 2=
009, 2
PM-3:30 PM in Back Bay: “Security Analysis of Portals and
Services”<o:p></o:p></b></li>
</ul>
<p class=3DMsoNormal style=3D'margin-left:.5in'>A presentation and discussi=
on of
end-to-end security for developers implementing open-source solutions using
standards-based portals and web services. Cookies will be provided.<o:p></o=
:p></p>
<p class=3DMsoNormal><b><o:p> </o:p></b></p>
<p class=3DMsoNormal><b>Below are links to documents that offer background =
on
what we will discuss. <o:p></o:p></b></p>
<p class=3DMsoNormal><b><o:p> </o:p></b></p>
<ul style=3D'margin-top:0in' type=3Ddisc>
<li class=3DMsoNormal style=3D'mso-list:l2 level1 lfo6'><a
href=3D"https://web.mit.edu/stu-future/www/docs/briefs/NGS3-Security-P=
reliminary-Analysis-1.4.pdf">Preliminary
Application Security Gap Analysis </a><o:p></o:p></li>
</ul>
<p class=3DMsoNormal style=3D'margin-left:.5in'>A report on the security
environment in which NGS3 applications will be deployed, and a preliminary =
gap
analysis of security implications of deploying web applications and web
services in IS&T to stimulate discussions on the subject.<o:p></o:p></p=
>
<ul style=3D'margin-top:0in' type=3Ddisc>
<li class=3DMsoNormal style=3D'color:blue;mso-list:l2 level1 lfo6'><u><a
href=3D"https://web.mit.edu/stu-future/www/docs/briefs/AuthNTierWebApp=
s.pdf">Authorization
in N-Tier Web Applications</a></u> <u><o:p></o:p></u></li>
</ul>
<p class=3DMsoNormal style=3D'margin-left:.5in'>An approach to passing the
“originating principal” (data about who logged in to use the
software application using a browser) down to all the tiers of software
securely.<o:p></o:p></p>
<ul style=3D'margin-top:0in' type=3Ddisc>
<li class=3DMsoNormal style=3D'color:blue;mso-list:l2 level1 lfo6'><u><a
href=3D"https://web.mit.edu/stu-future/www/docs/briefs/ClientAuthentic=
atedSSL.pdf">Client
Authenticated SSL for Tomcat with CXF Client</a></u> <u><o:p></o:p></u=
></li>
</ul>
<p class=3DMsoNormal style=3D'margin-left:.5in'>Configuration information f=
or creating
client-authenticated SSL connections between a Web services client and a se=
rver
hosting the Web service. <o:p></o:p></p>
<ul style=3D'margin-top:0in' type=3Ddisc>
<li class=3DMsoNormal style=3D'color:blue;mso-list:l2 level1 lfo6'><u><a
href=3D"https://web.mit.edu/stu-future/www/docs/briefs/LiferayTouchsto=
neIntegration.pdf">Touchstone
& Moira Integration with Liferay in RHEL5</a></u> <u><o:p></o:p></=
u></li>
</ul>
<p class=3DMsoNormal style=3D'margin-left:.5in'>Steps and best practices to
integrate portal technology with these components of MIT’s technical
infrastructure.<o:p></o:p></p>
<p class=3DMsoNormal><b><o:p> </o:p></b></p>
<p class=3DMsoNormal><b><i>We look forward to seeing you there!<o:p></o:p><=
/i></b></p>
<p class=3DMsoNormal><b>-The NGS3 Team <o:p></o:p></b></p>
<p class=3DMsoNormal><o:p> </o:p></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><span style=3D'font-size=
:10.0pt;
font-family:"System","sans-serif"'>Please click on the attachment to add th=
is
meeting to your calendar.<o:p></o:p></span></p>
<p class=3DMsoNormal><o:p> </o:p></p>
<p class=3DMsoNormal><o:p> </o:p></p>
</div>
</body>
</html>
--_000_EEDC15E2A6D72B4EAA6397F6491AD49E290307C10Aw92expo2excha_--
--_004_EEDC15E2A6D72B4EAA6397F6491AD49E290307C10Aw92expo2excha_
Content-Type: message/rfc822
From: John Harmon <jvharmon@exchange.mit.edu>
Date: Wed, 29 Jul 2009 16:30:43 -0400
Subject: IS&T NGS3 Technical Round Table: Security Analysis of Portals and
Services
Thread-Index: AcoQi3I1lq1venNTS5GcAioypsTsjQ==
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Content-Type: multipart/alternative;
boundary="_000_7166666870657278737777706669698073727178747366707270667_"
MIME-Version: 1.0
--_000_7166666870657278737777706669698073727178747366707270667_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
A presentation and discussion of end-to-end security for developers impleme=
nting open-source solutions using standards-based portals and web services.
Cookies will be provided.
--_000_7166666870657278737777706669698073727178747366707270667_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<meta name=3D"Generator" content=3D"Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left:=
#800000 2px solid; } --></style>
</head>
<body>
<font face=3D"Calibri, sans-serif" size=3D"2">
<div style=3D"padding-left: 90pt; text-indent: -90pt; ">A presentation and =
discussion of end-to-end security for developers implementing open-source s=
olutions using standards-based portals and web services.</div>
<div style=3D"padding-left: 90pt; text-indent: -90pt; ">Cookies will be pro=
vided.</div>
<div style=3D"padding-left: 90pt; text-indent: -90pt; "> </div>
</font>
</body>
</html>
--_000_7166666870657278737777706669698073727178747366707270667_
Content-Type: text/calendar; charset="utf-8"; method=PUBLISH
Content-Transfer-Encoding: base64
QkVHSU46VkNBTEVOREFSDQpNRVRIT0Q6UFVCTElTSA0KUFJPRElEOk1pY3Jvc29mdCBFeGNoYW5n
ZSBTZXJ2ZXIgMjAwNw0KVkVSU0lPTjoyLjANCkJFR0lOOlZUSU1FWk9ORQ0KVFpJRDpFYXN0ZXJu
IFN0YW5kYXJkIFRpbWUNCkJFR0lOOlNUQU5EQVJEDQpEVFNUQVJUOjE2MDEwMTAxVDAyMDAwMA0K
VFpPRkZTRVRGUk9NOi0wNDAwDQpUWk9GRlNFVFRPOi0wNTAwDQpSUlVMRTpGUkVRPVlFQVJMWTtJ
TlRFUlZBTD0xO0JZREFZPTFTVTtCWU1PTlRIPTExDQpFTkQ6U1RBTkRBUkQNCkJFR0lOOkRBWUxJ
R0hUDQpEVFNUQVJUOjE2MDEwMTAxVDAyMDAwMA0KVFpPRkZTRVRGUk9NOi0wNTAwDQpUWk9GRlNF
VFRPOi0wNDAwDQpSUlVMRTpGUkVRPVlFQVJMWTtJTlRFUlZBTD0xO0JZREFZPTJTVTtCWU1PTlRI
PTMNCkVORDpEQVlMSUdIVA0KRU5EOlZUSU1FWk9ORQ0KQkVHSU46VkVWRU5UDQpPUkdBTklaRVI7
Q049Sm9obiBIYXJtb246TUFJTFRPOmp2aGFybW9uQGV4Y2hhbmdlLm1pdC5lZHUNCkRFU0NSSVBU
SU9OO0xBTkdVQUdFPWVuLVVTOkEgcHJlc2VudGF0aW9uIGFuZCBkaXNjdXNzaW9uIG9mIGVuZC10
by1lbmQgc2VjdQ0KIHJpdHkgZm9yIGRldmVsb3BlcnMgaW1wbGVtZW50aW5nIG9wZW4tc291cmNl
IHNvbHV0aW9ucyB1c2luZyBzdGFuZGFyZHMtYmFzDQogZWQgcG9ydGFscyBhbmQgd2ViIHNlcnZp
Y2VzLlxuQ29va2llcyB3aWxsIGJlIHByb3ZpZGVkLlxuXG4NClNVTU1BUlk7TEFOR1VBR0U9ZW4t
VVM6SVMmVCBOR1MzIFRlY2huaWNhbCBSb3VuZCBUYWJsZTogU2VjdXJpdHkgQW5hbHlzaXMgbw0K
IGYgUG9ydGFscyBhbmQgU2VydmljZXMNCkRUU1RBUlQ7VFpJRD1FYXN0ZXJuIFN0YW5kYXJkIFRp
bWU6MjAwOTA5MTZUMTQwMDAwDQpEVEVORDtUWklEPUVhc3Rlcm4gU3RhbmRhcmQgVGltZToyMDA5
MDkxNlQxNTMwMDANClVJRDowN2QwNjc1ZS00NmZhLTRiNzUtOTg3NS1hN2YzZjAxYTJkYzYNCkNM
QVNTOlBVQkxJQw0KUFJJT1JJVFk6NQ0KRFRTVEFNUDoyMDA5MDkwOFQxMjUxMThaDQpUUkFOU1A6
T1BBUVVFDQpTVEFUVVM6Q09ORklSTUVEDQpTRVFVRU5DRTowDQpMT0NBVElPTjtMQU5HVUFHRT1l
bi1VUzpCYWNrIEJheQ0KWC1NSUNST1NPRlQtQ0RPLUFQUFQtU0VRVUVOQ0U6MA0KWC1NSUNST1NP
RlQtQ0RPLU9XTkVSQVBQVElEOi0xDQpYLU1JQ1JPU09GVC1DRE8tQlVTWVNUQVRVUzpCVVNZDQpY
LU1JQ1JPU09GVC1DRE8tSU5URU5ERURTVEFUVVM6QlVTWQ0KWC1NSUNST1NPRlQtQ0RPLUFMTERB
WUVWRU5UOkZBTFNFDQpYLU1JQ1JPU09GVC1DRE8tSU1QT1JUQU5DRToxDQpYLU1JQ1JPU09GVC1D
RE8tSU5TVFRZUEU6MA0KQkVHSU46VkFMQVJNDQpBQ1RJT046RElTUExBWQ0KREVTQ1JJUFRJT046
UkVNSU5ERVINClRSSUdHRVI7UkVMQVRFRD1TVEFSVDotUFQxME0NCkVORDpWQUxBUk0NCkVORDpW
RVZFTlQNCkVORDpWQ0FMRU5EQVINCg==
--_000_7166666870657278737777706669698073727178747366707270667_--
--_004_EEDC15E2A6D72B4EAA6397F6491AD49E290307C10Aw92expo2excha_--
