Identity Management with Spring Security. Dave Syer, VMware, SpringOne 2011

Transcription

1 Identity Management with Spring Security Dave Syer, VMware, SpringOne 2011

2 Overview What is Identity Management? Is it anything to do with Security? Some existing and emerging standards Relevant features of Spring Security and other Spring projects Common use cases Demo of prototype IDM system

3 Agenda Core domain: Authentication, identity, trust, delegation, claim, authorization SSO Identity Management Standards: SAML OpenID OAuth, OAuth2 OpenID Connect SCIM JWT Spring Security and other projects Use cases (Google, Facebook, CloudFoundry) and demos IDM as a Service

4 Demo Code $ git clone git://gist.github.com/ git

5 Authentication You say you are Fred Bloggs? Can you prove it? Human-human interactions Official document (passport, driving licence, etc.) We actually call it ID Letter of introduction Word of mouth, friend of a friend Machine-human interactions Something you know, hopefully unguessable, maybe random, e.g. username/password Something you have, e.g. one Time Password (OTP) from RSA hard/soft token Multifactor authentication Machine-machine interactions

6 Typical System Architecture APP I'm Fred, show me my photos User DB User details store

7 Fred Accesses his Photos

8 Two Apps, No Shared Authentication APP1 I'm Fred, show me my photos User I'm Fred, can I buy a book? APP2 DB User details store DB

9 Two Apps, Shared User Details APP1 I'm Fred, show me my photos User I'm Fred, can I buy a book? APP2 DB User details store

10 Two Apps, Single Sign On APP1 I'm Fred, show me my photos User I'm Fred, can I buy a book? SSO APP2 DB User details store

11 Single Sign On: Example Flow All Apps are the same Explicit authentication required on first visit Avoidable subsequently if App can store token but then with multiple apps you have distributed state This is unavoidable

12 Two Apps, Single Sign On with Separate Authentication APP1 I'm Fred, show me my photos User AUTH I'm Fred, can I buy a book? SSO APP2 DB User details store

13 SSO With Spring Security Good support for CAS Many custom implementations for commercial products like SiteMinder Field is fragmented OpenID...

14 Trust You say you are Fred Bloggs? Can you prove it? Oh, I remember, Martha said you're alright. Come in... I trust Martha, USDOT, UKPA, etc, to verify Fred's identity Why? Because I know them, and they say they know Fred.

15 Consumer Trusts Provider Consumer, Relying Party APP I'm Fred, show me my photos User IDP Provider DB User details store

16 Simplified User-App-IDP Interaction

17 So What did we Gain with an Identity Provider? App no longer has to do authentication or keep record of secure information about users User only has to type secrets into a known trusted site (e.g. Google) Separation of concerns Abstraction always comes at a cost Increased complexity more to understand, more to maintain, more to go wrong Complexity and Security are uneasy bedfellows Hence there are standards that cover this interaction

18 Complexity: Schematic Actual Conversation

19 Complexity: HTTP Protocol Actual Conversation

20 Compare: Native Authentication

21 OpenID Relying Party APP I'm Fred, show me my photos User OpenID Provider DB User details store

22 OpenID Protocol for attribute exchange Sits on top of HTTP(S) Form plus JSONish on back channel (attribute fetch) Form data and redirects on front channel Does not specify authentication (up to the Provider) Does not require pre-registration of Relying Parties (Apps) Implemented in various languages, e.g. Java->OpenID4J (Google code) Support in Spring Security for Relying Party

23 Spring Security OpenID RP <http xmlns=" <openid-login login-page="/openid" user-service-ref="registeringuserservice" authentication-failure-url="/login_error.jsp"> <attribute-exchange identifier-match=".*"> <openid-attribute name=" " Type=" required="true" /> <openid-attribute name="fullname" type=" required="true" /> </attribute-exchange> </openid-login> </http>

24 SSO with OpenID Relying Party APP1 I'm Fred, show me my photos User I'm Fred, can I buy a book? APP2 OpenID DB User details store Provider

25 SSO with OpenID No user input required here if IDP is stateful

26 Delegation and Client Authorization So Fred told you to come and pick up his order? You say you're Martha? Show me some ID. And what about some documentation about the order? Resource Owner Client (e.g. a service provider) Scope of responsibility

27 Delegation and Client Authorization An App needs to access Fred's resources on his behalf Resources live in a protected Resource Server (API) Fred is the Resource Owner: he can read and write his resources if he logs into the API himself But App is the Client of the API service not Fred, and Fred doesn't want to grant App write access Resource Server can grant App access to a restricted Scope of activity Fred authorizes the App to read his Resources App gets an Access Token that enables it to act on behalf of Fred Where does it get the token from? An Authorization Server

28 Delegation Client APP I'm Fred, show me my photos Resource Owner Token API Resource Server Token Services AUTH Authorization Server

29 Example Token Services using Shared Storage Client APP I'm Fred, show me my photos Resource Owner Token API Resource Server DB AUTH Authorization Server Token Store

30 Delegation Standards SAML 1.0, 2.0 XML back channel Need key exchange cryptography Spring Security SAML, Service Provider = Resource Server only OAuth 1.0a plain text back channel Nonce and request token cryptography Spring Security OAuth (consumer and provider) OAuth 2 JSON (plus optional custom formats) no back channel in spec (but need token services in practice) clear text (need SSL), plus extensions Spring Security OAuth (consumer and provider)

31 OAuth2 Client /app GET /api/photos Authorization: Bearer FDSHGK78JH356G Resource Server /api authenticated: 200 OK... unauthenticated: 401 Unauthorized WWW-Authenticate: Bearer realm= /auth

32 OAuth2 Acquiring an Access Token Grant Types Password Authorization Code Refresh Token Implicit Client Credentials Others allowed as extensions, e.g. SAML assertion

33 OAuth2 Grant Type: Password Resource Server /api GET /auth/token?response_type=password&username=...&... Authorization: Basic asdsdfggghf= Authorization Server /auth Token Endpoint Client credentials 200 OK { access_token : JAHDGFJH78IOUY, token_type : bearer, expires_in : 3600 }

34 OAuth2: Grant Type Password

35 OAuth2 Grant Type: Authorization Code Client /app GET /auth/authorize?response_type=authorization_code&... Authorization: Basic asdsdfggghf= Authorization Server /auth Authorization Endpoint 302 Found Location: /app/photos?code=dfjhg

36 OAuth2 Grant Type: Authorization Code Resource Server /api GET /auth/token?grant_type=authorization_code&code=...&... Authorization: Basic asdsdfggghf= Authorization Server /auth Token Endpoint 200 OK { access_token : JAHDGFJH78IOUY, token_type : bearer, expires_in : 3600 }

37 OAuth2 Grant Type: Authorization Code????

38 OAuth2 Grant Type: Authorization Code, Explicit Authorization???? The spec doesn't say how this happens, just that it does, e.g:

39 OAuth2: More Detail and Options Grant type Password native apps, fixed authentication Authorization Code webapps with browser redirects Refresh Token optional for tokens issued with Auth Code Implicit script clients in webapps, native apps Client Credentials service peers Other, e.g. SAML Token type Bearer Other, e.g. MAC Scope Arbitrary string. Signifies something to Resource Server about which resources are available. C.f. audience in SAML. State

40 Spring Security OAuth: Resource Server /api <sec:http...>... <sec:custom-filter ref="oauth2servicefilter" before="exception_translation_filter" /> </sec:http> <oauth:provider id="oauth2servicefilter" token-services-ref="tokenservices"> <oauth:resource-server resource-id="api" /> </oauth:provider>

41 Spring Security OAuth: Authorization Server /auth <sec:http>... <sec:custom-filter ref="oauth2servicefilter" after="exception_translation_filter" /> </sec:http> <oauth:provider id="oauth2servicefilter" token-services-ref="tokenservices"> <oauth:authorization-server client-details-service-ref="clientdetails"> <oauth:authorization-code /> <oauth:implicit /> <oauth:refresh-token /> <oauth:client-credentials /> <oauth:password /> </oauth:authorization-server> </oauth:provider> <oauth:client-details-service id="clientdetails"> <oauth:client clientid="app" authorizedgranttypes="password,authorization_code,refresh_token" scope="read_photos" authorities="role_guest" /> </oauth:client-details-service>

42 Spring Security OAuth: Client /app <sec:http>... <sec:custom-filter ref="oauth2clientfilter" after="exception_translation_filter"/> </sec:http> <oauth:client id="oauth2clientfilter" token-services-ref="oauth2tokenservices" /> <bean class="apiresttemplate" class="org...oauth2.client.oauth2resttemplate"> <constructor-arg ref="api" /> </bean> <oauth:resource id="api" type="authorization_code" clientid="app" accesstokenuri="${accesstokenuri}" userauthorizationuri="${userauthorizationuri}" scope="read_photos" /> N.B. Spring Social has client support as well (similar approach, convergence will come later)

43 OpenID Connect Similar to OpenID in the role that it plays, but not in any other way related Uses OAuth2 as a protocol for attribute exchange Google, Salesforce, etc. behind spec OAuth2 endpoints: /authorize /token OpenID endpoints are OAuth2 protected resources: /userinfo /check_id Clients obtain access token with scope=openid OAuth /token endpoint includes id token in response as well as access token Responses in JSON or JWT (=encrypted JSON) Not implemented in Spring project (yet), SECOAUTH or SEC

44 OpenID Connect: Token Acquisition Resource Server /api GET /auth/token?grant_type=authorization_code&code=...&... Authorization: Basic asdsdfggghf= Authorization Server /auth Token Endpoint 200 OK { access_token : JAHDGFJH78IOUY, token_type : bearer, expires_in : 3600, scope : openid, id_token : LKJADSFKHJG8723E }

45 OpenID Connect: User Info Resource Server /api GET /auth/userinfo Authorization: Bearer JAHDGFJH78IOUY Authorization Server /auth User Info Endpoint 200 OK { user_id : dsyer, name : Dave Syer, dsyer@vmware.com,... }

46 SCIM Simple Cloud Identity Management Plain test / JSON standard for provisioning identity systems Standard endpoints /Users query user accounts /User CRUD operations on users /Groups CRUD operations on groups An OAuth2 authorization service might implement SCIM Not implemented (yet) in Spring

47 Spring Security: Project Organization Luke Taylor (VMW), Robert Winch Ryan Heaton, Dave Syer (VMW), Spring Security OAuth Spring Security Core just released Stable, mature Web LDAP OpenID... Spring Extensions: Security OAuth1a OAuth2 Oauth2 spec not yet final External lead M5 release in pipeline Keith Donald (VMW), Craig Walls (VMW) Spring Social just released Consumer for wellknown providers Vladimir Schaefer, Mike Wiesner (VMW) SAML Kerberos not yet released Partly external, low-activity

48 CloudFoundry IDM Client Admin Console I'm Fred, show me my apps Resource Owner Token CloudController Resource Server Access Decision Collab Spaces Token Services UAA Authorization Server: OAuth2, OpenID Connect, SCIM

49 CloudFoundry IDM Client VMC I'm Fred, show me my apps Resource Owner Token CloudController Resource Server Access Decision Collab Spaces Token Services UAA Authorization Server: OAuth2, OpenID Connect, SCIM

50 Links SECOAUTH: OpenId4J: OpenID Connect: OAuth2: SCIM: SES (SAML and Kerberos): Demos:

51 Overview What is Identity Management? Is it anything to do with Security? Some existing and emerging standards Relevant features of Spring Security and other Spring projects Common use cases Demo of prototype IDM system