Saltar al contenido principal
Open Source
                                   Authentication
                                  & Authorization
                                Allan Foster ForgeRock
                           allan.foster@forgerock.com




Wednesday, March 9, 2011
“Build us a Web App”




                                                  2

Wednesday, March 9, 2011
Lots of examples....




                                                  3

Wednesday, March 9, 2011
New Application Demands


                                      Collaborative
                                      Workgroups
                                      Client - Server
                                      Multi user...
                                      In the cloud?


                                                 4

Wednesday, March 9, 2011
Its a WebApp!




                                           5

Wednesday, March 9, 2011
Business Logic


                               Your Business...
                                Your Logic...

                           You know how to do this!




                                                      6

Wednesday, March 9, 2011
Lots of Help
                                            Language...
                           . Net
                                                   PH P
                                                                              Ru by
                                   Pe r l
                                                              a va
                                                          J
                           +




                                                                     Py t
                       C+




                                                                            hon
                                                   vy
                 C&




                                              Groo


                                                                                      7

Wednesday, March 9, 2011
Oh yes, LOTS of help!
                                        Frameworks...
                                                                             Vel
                                        JSF                                      o   cit
                                                                                           y
                      AJA                                          PEAR
                          X


                                                              te
                           Sp r
                                                       rn
                                                            a                   es
                                  ing                e                  ce Fa c
                                              H ib                  I



                                                                                               8

Wednesday, March 9, 2011
And don’t forget...




                                                 9

Wednesday, March 9, 2011
Access Control

                             Who are our users?
                            Who can access what?
                             What can they do?
                           How do we manage this?


                                                    10

Wednesday, March 9, 2011
Its not that complicated..


                                 Authentication

                                      SSO

                                  Authorization




                                                    11

Wednesday, March 9, 2011
Authentication?

                                     Corporate LDAP




                                              12

Wednesday, March 9, 2011
But what about...




                                               13

Wednesday, March 9, 2011
or...




                                   14

Wednesday, March 9, 2011
or



                           SecureID	
  RSA	
  Logo




                                                     15

Wednesday, March 9, 2011
Maybe all?




                                        16

Wednesday, March 9, 2011
Authentication isn’t enough...




                                            17

Wednesday, March 9, 2011
Authentication isn’t enough...


                                  SSO
                             is expected!

                           I have one set of
                           credentials, Why
                            can’t I just use
                              them ONCE?

                                               18

Wednesday, March 9, 2011
Even between multiple Organizations
                               Federation
                                  eGov


                  GoogleApps



                                                   19

Wednesday, March 9, 2011
SSO implies having
                                a single
                               trusted
                            Authentication
                              service...



                                                20

Wednesday, March 9, 2011
That can be used
                              by MANY
                              different
                            applications!




                                              21

Wednesday, March 9, 2011
Without regard to
                                 HOW
                           the authentication
                           is being performed



                                                22

Wednesday, March 9, 2011
What About
                           Authorization?




                                            23

Wednesday, March 9, 2011
Is this user allowed

                               to perform

                             this action on

                             this resource?


                                                  24

Wednesday, March 9, 2011
Group Membership?

                                  Roles?

                           Some Complex Matrix?

                           Dynamic Conditions?


                                                  25

Wednesday, March 9, 2011
Access control logic can be embedded
                         in our application...



                                BUT..

                                                  26

Wednesday, March 9, 2011
New Specs
                           New Rules
                           Exceptions

                           Changes...
                           and
                           more changes!

                           ...And testing!




                                        27

Wednesday, March 9, 2011
Reprogram the door?




                                                 28

Wednesday, March 9, 2011
Centrally managed service

                                 Ca
                                   n	
  I
                                         ?




                                             29

Wednesday, March 9, 2011
AuthN and AuthZ as a service




                           IdenAty	
  services	
  (OpenAM)




                                                             30

Wednesday, March 9, 2011
Authentication
                                 SSO

                             Authorization



                                             31

Wednesday, March 9, 2011
32

Wednesday, March 9, 2011
Authentication is
                                      NOT
                             Identity Management

                               Validation against
                           EXISTING identity sources!


                                                        33

Wednesday, March 9, 2011
We don’t need to know
                           user implementation details

                              We only need to know

                                  User Identity

                                 and possibly
                              some user attributes.
                                                         34

Wednesday, March 9, 2011
Integrate into existing process


                            Plugable Authentication
                                    modules

                           Built on Standards - JAAS

                           Multiple Modules & Chains


                                                       35

Wednesday, March 9, 2011
Se
                 AP                                                 cu
               LD                                                        reI
                                                                               D
                                                                                                 n ix
                                                                                            U
                           rti f i c ate   S afeW
             x5   0 9 Ce                         o rd
                                                                JD
                                                                     BC
                                                                                   SAML2
                           O
                      EG




                                                 Custom                                                    ds
                   PN




                                                                                                         ar
                                                                                                  r tC
                -S




                                                                                                a
                                                                                           Sm
             AD




                                     MSISDN

                                                               Extens ible
                                              Me m
                                                     be rs
                                                             h ip

                                                                                                    36

Wednesday, March 9, 2011
Authentication determines identity

                               Identity is what matters..

                                          NOT

                              the method it is determined

                                                            37

Wednesday, March 9, 2011
38

Wednesday, March 9, 2011
Browser                                           ApplicaAon                             OpenAM


                           Request	
  applicaAon	
  content

                           Redirect	
  for	
  AuthenAcaAon

                           Request	
  AuthenAcaAon	
  from	
  AuthenAcaAon	
  server

                           NegoAate	
  AuthenAcaAon...

                           Redirect	
  back	
  to	
  ApplicaAon	
  with	
  Token

                           Request	
  applicaAon	
  content

                                                                            Validate	
  Token
                                                                            ValidaAon	
  Response
                           Provide	
  applicaAon	
  content
                                                                                                       39

Wednesday, March 9, 2011
Authentication

                               SSO
                           Authorization



                                            40

Wednesday, March 9, 2011
41

Wednesday, March 9, 2011
42

Wednesday, March 9, 2011
43

Wednesday, March 9, 2011
Allan Foster
                           Speaker
                           ConFoo 2011




                                          44

Wednesday, March 9, 2011
45

Wednesday, March 9, 2011
Allan Foster
                           Speaker
                           ConFoo 2011




                                          46

Wednesday, March 9, 2011
47

Wednesday, March 9, 2011
One Pass

                           Multiple Doors

                           Single Sign On


                                            48

Wednesday, March 9, 2011
Application validates
                              credentials...

                           Does NOT issue them!



                                                   49

Wednesday, March 9, 2011
We don’t “Login”

                              We validate Identity.

                           This is a conceptual hurdle
                                  for developers!

                                                         50

Wednesday, March 9, 2011
Authentication service
                            determines identity

                           Authentication service
                               issues tokens


                                                    51

Wednesday, March 9, 2011
Browser                                        ApplicaAon                     OpenAM


                            Request	
  applicaAon
                                                                Validate	
  Token

                                                                 ValidaAon	
  Response

                           Provide	
  applicaAon	
  content




                                                                                            52

Wednesday, March 9, 2011
New applications
                           easily integrate
                             into existing
                            infrastructure




                                              53

Wednesday, March 9, 2011
And for many
                             projects

                           This is success!

                           Single Sign on!


                                              54

Wednesday, March 9, 2011
Authentication

                                 SSO

                           Authorization


                                             55

Wednesday, March 9, 2011
Multi User Application

                              Access Control

                           Rights and Privileges



                                                    56

Wednesday, March 9, 2011
Access Control can be


                                 Very Complex
                                Domain Specific
                              Dependent on Many
                                  Conditions



                                                   57

Wednesday, March 9, 2011
Several Options


                           • Ad Hoc
                           • J2EE Policy
                           • URL Access
                           • Custom Developed
                           • External Policy Engine


                                                      58

Wednesday, March 9, 2011
Ad Hoc


                           •Localized if - then - else
                           •Cumbersome
                           •No Reuse
                           •Inconsistent enforcement
                           •Unverifiable
                           •Possible security holes

                                                         59

Wednesday, March 9, 2011
J2EE Policy


                           •Standards..
                           •Role Based
                           •Supported in the deployment
                           •Designed from the start
                           •Difficult to change
                           •Domino Effect


                                                          60

Wednesday, March 9, 2011
URL Access



              •Course Grained
              •Tree Level Access
              •Often at Application or server Level
              •Access Control NOT Entitlements


                                                  61

Wednesday, March 9, 2011
Custom Policy


                           •Expensive
                           •Hard to Maintain
                           •Proprietary
                           •Administration is Daunting!
                           •Difficult to change and adapt


                                                            62

Wednesday, March 9, 2011
External Policy Engine


                           •Policy Evaluation
                           •Extensible
                           •Flexible
                           •Centralized Administration
                           •What about domain specifics?


                                                      63

Wednesday, March 9, 2011
EnAtlement	
  services	
  (OpenAM)




                                                                27
                                                                64

Wednesday, March 9, 2011
Can
                               This User
                                access
                             This Resource
                                 under
                           These Conditions?



                                               65

Wednesday, March 9, 2011
Define Rules for Access

                             Rules can be changed
                                 dynamically

                           Standards based - XACML3



                                                       66

Wednesday, March 9, 2011
Rules

                   Resources
                   Actions
                   Subjects
                   Conditions

                                        Response
                                         Attributes
                                         Advice

                                                67

Wednesday, March 9, 2011
Resources

                    URLs
                    Accounts
                    Buttons
                    Projects
                    etc......
                                       Hierarchical
                                       Scalable
                       Plugable API
                                                 68

Wednesday, March 9, 2011
Actions

                           Performed on a resource

                              Fine Grained access

                                                      C re at
                                   Withdraw                   e
                    G ET T                           Re ad
                       OS E        Balance           Upda
                     P ET                                   te
                        EL
                      D Y          Transfer         De let
                         OP                                e
                       C


                                                                  69

Wednesday, March 9, 2011
Subjects

                           Who does the rule apply to?

                                                                            D at a
                                                    o up                               sto re
                                                 Gr                                             Att r
                                          DA P                                                        ib   u te
                                   b er L
                           M em
                                                    Se s
                                                           s io
                              o re Att r i b u te                 nA              Custom Subject
                  D at a st                                         tt r
                                                                           i bu
                                                                                  te

                   Plugable API                                     Combination Logic
                                                                                                   70

Wednesday, March 9, 2011
Conditions

                                     Simple or Complex
                                       Dependencies
                                                                           dr ess
                           ib u te      Ba n k B
                                                      a la n c e    IP Ad
                  Att r                                                        Ti
                                                                                    me
                                                      o ut                               of
                                                 im                                           Da
                                               T                                                   y
         Au                             io n
                the
                    nti       S ess                                     tt r i b u te
                 lev c atio                                  Sess io n A
                     el     n

                   Plugable API                                    Combination Logic
                                                                                              71

Wednesday, March 9, 2011
Access control
                                can be:
                             Role based,
                           Attribute based,
                             or Dynamic.

                                              72

Wednesday, March 9, 2011
Policy Enforcement Point

                           Policy Decision Point

                Policy Administration Point

                                                   73

Wednesday, March 9, 2011
Policy Enforcement Point




                                                  74

Wednesday, March 9, 2011
Policy Enforcement Point

                               Simplest case

                           Agent plugged into web
                                 container.
                                     ISapi
                                    NSApi
                                   Mod_auth


                                                    75

Wednesday, March 9, 2011
Zero changes to app.

                            Simple to install..

                  Easily protect “Closed” apps

                                                  76

Wednesday, March 9, 2011
Policy Enforcement Point


                  Fine for URL access control
                    when resource is a URL.

                           But how do we address
                               entitlements?

                                                   77

Wednesday, March 9, 2011
Policy Enforcement Point
        Simple Web Service Call wrapper
        Coded into Application
                                 This	
  User   This	
  Resource   These	
  CondiAons

                      if (entitled(userToken,   resource, env)) {
                          ...
                          ...
                      }



              Language Agnostic!
                                                                                 78

Wednesday, March 9, 2011
Simple JSON responses


                  {
                       "statusCode":200,
                       "statusMessage":"OK"
                       "body":{
                               "actionsValues":{"GET":true},
                               "attributes":{},
                               "advices":{},
                               "resourceName":"http:/
                                                    /www.anotherexample.com:80/index.html"
                           }
                   }



                                                                                      79

Wednesday, March 9, 2011
Policy Decision Point




                                                   80

Wednesday, March 9, 2011
Policy Decision Point

                            Policy Evaluation

                                Separate
                           the Rule evaluation
                                  from
                            the enforcement
                                                   81

Wednesday, March 9, 2011
Scalable and extensible
                                policy engine

                           Scalable to millions of
                               entitlements

                             Standards based -
                                 XACML3
                                                     82

Wednesday, March 9, 2011
83

Wednesday, March 9, 2011
Policy Administration


                            Administration UI
                           Dynamic rule changes
                              Auditability
                               Consistency


                                                   84

Wednesday, March 9, 2011
Standards based XACML3

                            Any editor...
                           Any workflow...


                                             85

Wednesday, March 9, 2011
Rule changes take
                              immediate effect

                           No impact on application
                                development

                                                  86

Wednesday, March 9, 2011
Keep track of rules and
                                  changes

                           Reuse rules for reusable
                                  resources

                                                      87

Wednesday, March 9, 2011
Separate Administration


                                  Application
                                Administration is
                                    separate
                                      from
                                  Entitlement
                                 Administration



                                                     88

Wednesday, March 9, 2011
Simplify the app
                               admin

                              Consistent
                           administration of
                             permissions
                             for all apps.


                                               89

Wednesday, March 9, 2011
ForgeRock




                                       90

Wednesday, March 9, 2011
OpenAM

                           OpenAM As A Service
                                   gives
                                Flexibility,
                              Consistency &
                               Management
                                     to
                              Authentication
                                    and
                               Entitlements.
                                                 91

Wednesday, March 9, 2011
OpenAM


                           Started life as Sun Access
                                   Manager

                            OpenSourced in 2007

                              Strong Community


                                                        92

Wednesday, March 9, 2011
OpenAM

                              OpenAM is

                           fully opensource,
                              100% Java,
                                scalable,
                           high performance,

                           AuthN and AuthZ

                                               93

Wednesday, March 9, 2011
OpenAM


                              Full XACML3 Support
                           Simple policies and Complex
                                   Entitlements
                                Extensible Plugins
                             Central Administration
                              Leverage existing SSO


                                                         94

Wednesday, March 9, 2011
OpenAM


                             OpenAM Community

                                  ForgeRock

                           http:/
                                /www.forgerock.com



                                                     95

Wednesday, March 9, 2011
Download it.
                                 Use it.
                              Get involved!


                           info@forgerock.com
                                                96

Wednesday, March 9, 2011
Questions?




                                        97

Wednesday, March 9, 2011
Demo

                                  98

Wednesday, March 9, 2011
Open Source
                               Authentication
                              & Authorization
                           Allan Foster ForgeRock




Wednesday, March 9, 2011
Access Control - Policy

                    Rights and Privileges - Entitlements

                                 Scalability

                                 Flexibility


                                                     100

Wednesday, March 9, 2011