Apache Airavata Security Manager Authentication & Authorization - - PowerPoint PPT Presentation

▶
apache airavata security manager
SMART_READER_LITE
LIVE PREVIEW

Apache Airavata Security Manager Authentication & Authorization - - PowerPoint PPT Presentation

Nov 18, 2023 350 likes •697 views

Apache Airavata Security Manager Authentication & Authorization Im Implementation for a Multi- Tenant e-Science Framework Supun Nakandala, Hasini Gunasinghe, Suresh Marru and Marlon Pierce Science Gateways Research Center Indiana

slide-1
SLIDE 1

Apache Airavata Security Manager

Authentication & Authorization Im Implementation for a Multi- Tenant e-Science Framework

Supun Nakandala, Hasini Gunasinghe, Suresh Marru and Marlon Pierce

Science Gateways Research Center Indiana University

slide-2
SLIDE 2

Outline

  • Introduction
  • Problem Definition
  • Solution Overview
  • Solution in Detail
  • Implementation Details
  • Conclusions

IEEE eScience 2016 2/33

slide-3
SLIDE 3

In Introduction

  • Solving identity management challenges in multi-tenanted

eScience middleware that needs to support multiple diverse virtual organizations.

  • Implementation

is based

  • n

Apache Airavata Science Gateways middleware. But the concepts are equally applicable to other similar systems too.

IEEE eScience 2016 3/33

slide-4
SLIDE 4

In Introduction – What are Scie ience Gateways?

  • A Science Gateway is a community-developed set of tools,

applications, and data that are integrated via a portal or a suite of applications, usually in a graphical user interface, that is further customized to meet the needs of a specific

  • community. (XSEDE)

IEEE eScience 2016 4/33

slide-5
SLIDE 5

What are these customized requirements ?

Gateways share many of these requirements!

IEEE eScience 2016 5/33

slide-6
SLIDE 6

Apache Air iravata

IEEE eScience 2016 6/33

slide-7
SLIDE 7

Outline

  • Introduction
  • Problem Definition
  • Solution Overview
  • Solution in Detail
  • Implementation Details
  • Conclusions

IEEE eScience 2016 7/33

slide-8
SLIDE 8

Problem Definition

  • Previously
  • Security model was based on the trust relationship between

gateway software and Airavata middleware by restricting access to the Airavata API only from pre-validated web-based gateway clients.

  • Mutual trust between the gateways and Airavata server was

established using TLS mutual authentication and enforcing firewall commands.

  • End users who interacted with Airavata API through gateways were
  • nly authenticated and authorized at the gateway level, and no

validation was done at the Airavata API level. Hence no explicit user notion in Airavata.

IEEE eScience 2016 8/33

slide-9
SLIDE 9

Problem Definition (Continued…)

  • Previous

approach was reviewed by the Center for Trustworthy Scientific Cyberinfrastructure and was determined to be operationally acceptable [1].

  • However,
  • This approach does not scale to a large number of gateways.
  • It does not address the issue of securing native client (desktop and

mobile) access to the Airavata API.

  • It does not enable a uniform approach to user-level tracking of API

calls.

  • Not satisfying from the architectural point of view.

[1] - R. Heiland, J. Basney, and V. Welch, “Suggested security practices for SciGaP: A preliminary report,” http://hdl.handle.net/2022/20811.

IEEE eScience 2016 9/33

slide-10
SLIDE 10

So why can’t we implement identity management in Airavata ?

  • Three different identity management scenarios that

needs to be considered

  • Scenario 1 - The gateway client does not have a user store and

would like to depend on Airavata to provide user management features.

  • Scenario 2 - The gateway has a user store and in-house identity

management mechanisms.

  • Scenario 3 - The gateway does not have a dedicated user store but

authenticates users into the gateway using some federated identity provider.

IEEE eScience 2016 10/33

slide-11
SLIDE 11

Formal Problem Defin inition

  • How to provide a unified identity management solution

that can meet the standard security requirements for the above three usecases and be able to seamlessly adopted by all types of gateways including web based and native (desktop and mobile) clients

IEEE eScience 2016 11/33

slide-12
SLIDE 12

Outline

  • Introduction
  • Problem Definition
  • Solution Overview
  • Solution in Detail
  • Implementation Details
  • Conclusions

IEEE eScience 2016 12/33

slide-13
SLIDE 13

Solution Overview

  • We use standard security protocols and standards in our design.
  • OAuth 2.0 based authorization delegation for the user

authenticated at the gateway.

  • OAuth access tokens are generated by a separate dedicated

authorization server.

  • We map specific OAuth grant types for our requirements.
  • OpenID-Connect which runs on top of OAuth 2.0 for user

authentication.

  • Role based fine grained customized authorization is done using

XACML.

IEEE eScience 2016 13/33

slide-14
SLIDE 14

Hig igh le level l Solution

IEEE eScience 2016 14/33

slide-15
SLIDE 15

Hig igh le level l Solution

  • Only the user authentication and access token retrieval will

change for each use case scenario.

  • Depending on the client type and usage scenario appropriate

OAuth grant type should be used to obtain an access token.

IEEE eScience 2016 15/33

slide-16
SLIDE 16

Outline

  • Introduction
  • Problem Definition
  • Solution Overview
  • Solution in Detail
  • Implementation Details
  • Conclusions

IEEE eScience 2016 16/33

slide-17
SLIDE 17

OAuth 2.0 Grant Types

  • Authorization code grant – Client app is web based (or can spawn

a web browser) (e.g. Web applications) and can maintain a client credential.

  • Implicit grant – Client app is web based (or can spawn a web

browser) but cannot keep it’s credentials secret (e.g. Thick web clients)

  • Resource
  • wner

password grant – User trusts the client application (e.g. Gateway provided desktop clients)

  • Client credential grant – Machine to machine communication. No

user involvement.

  • Refresh code grant – Retrieve new access token when current

token expired

IEEE eScience 2016 17/33

slide-18
SLIDE 18

Scenario 1 – Gateway does not have exis istin ing user management

IEEE eScience 2016 18/33

slide-19
SLIDE 19

Scenario 1 – Gateway does not have exis istin ing user management

IEEE eScience 2016 19/33

  • Authorization Server maintains a user store for the gateway.
  • Gateway will use Airavata SDK to invoke user management
  • perations.
  • Authorization Code, Implicit or Resource Owner Password

can be used to obtain an access token.

slide-20
SLIDE 20

Scenario 2 – Gateway has a user-store and its own in in-house identity management mechanisms

  • Case 1 – Gateway does not share any user information with

Airavata.

  • Case 2 – Gateway is willing to share user identity

information but does not allow Airavata to connect to the gateway’s user store.

  • Case 3 – Gateway is willing to share user identity

information.

IEEE eScience 2016 20/33

slide-21
SLIDE 21

Scenario 2 – Gateway has a user-store and its own in in-house identity management mechanisms

  • Case 1 – Gateway does not share any user information with Airavata

IEEE eScience 2016 21/33

slide-22
SLIDE 22

Scenario 2 – Gateway has a user-store and its own in in-house identity management mechanisms

  • Case 2 – Gateway is willing to share user identity information but

does not allow Airavata to connect to the gateway’s user store

IEEE eScience 2016 22/33

slide-23
SLIDE 23

Scenario 2 – Gateway has a user-store and its own in in-house identity management mechanisms

  • Case 3 – Gateway is willing to share user identity information.

IEEE eScience 2016 23/33

slide-24
SLIDE 24

Scenario 3 – Gateway authenticates users into the gateway using a federated identity provider.

IEEE eScience 2016 24/33

slide-25
SLIDE 25

Scenario 3 – Gateway authenticates users into the gateway using a federated identity provider.

IEEE eScience 2016 25/33

  • Authentication request is forwarded to configured federated identity

provider.

  • If the federated identity provider supports retrieval of user

information a user account is created just-in-time.

slide-26
SLIDE 26

Role le based fine grained user authorization

  • XACML is used to define customized role based API authorization

decisions.

  • Each gateway can have different policy on how they allow their users

to access the API.

IEEE eScience 2016 26/33

slide-27
SLIDE 27

Role le based fine grained user authorization

IEEE eScience 2016 27/33

slide-28
SLIDE 28

Outline

  • Introduction
  • Problem Definition
  • Solution Overview
  • Solution in Detail
  • Implementation Details
  • Conclusions

IEEE eScience 2016 28/33

slide-29
SLIDE 29

Im Implementatio ion Detail ils

  • Most of the features that we use in our solution are based on

standard security protocols.

  • We use WSO2 Identity Server which is an open source (Apache V2

license) identity management system which supports multi-tenancy

  • ut of box and provide most of the required features.
  • We extend the features available in IS in order to support custom user

store and federated authenticator integration.

  • A new component, Security Manager, is added to the Airavata API

which manages the communication with Authorization server and validates user requests.

IEEE eScience 2016 29/33

slide-30
SLIDE 30

Im Implementatio ion Detail ils

  • Additional security validation added some overhead on the overall

Airavata API performance. But caching of authorization decisions improved it a lot.

IEEE eScience 2016 30/33

slide-31
SLIDE 31

Outline

  • Introduction
  • Problem Definition
  • Solution Overview
  • Solution in Detail
  • Implementation Details
  • Conclusions

IEEE eScience 2016 31/33

slide-32
SLIDE 32

Conclusions

  • The most significant advance in gateway architectures over the last

several years is the use of hosted, general purpose gateway platform services.

  • We examined the over the-wire access patterns that exist between a

wide range of gateway clients and multi-tenanted platform services like Apache Airavata.

  • We map these patterns to widely accepted security standards and

protocols and implement a solution that can support all the identified use cases.

IEEE eScience 2016 32/33

slide-33
SLIDE 33

Q & & A Thank You!