User Authentication using the Client Principle Object Presented By: - - PowerPoint PPT Presentation

▶
user authentication using the client principle object
SMART_READER_LITE
LIVE PREVIEW

User Authentication using the Client Principle Object Presented By: - - PowerPoint PPT Presentation

May 03, 2023 334 likes •700 views

User Authentication using the Client Principle Object Presented By: Chris Longo User Authentication using the Client Principle Object Agenda What is the Client Principal Object? Why is it useful? How do I implement the CP Object?

slide-1
SLIDE 1

User Authentication using the Client Principle Object

Presented By: Chris Longo

User Authentication using the Client Principle Object

slide-2
SLIDE 2

User Authentication using the Client Principle Object

Agenda

  • What is the Client Principal Object?
  • Why is it useful?
  • How do I implement the CP Object?
slide-3
SLIDE 3

User Authentication using the Client Principle Object

Application Context

  • Unique set information associated with a

specific user's application session.

  • UserID, PlantID, Session
  • Effects:
  • Authentication
  • Authorization
  • Query Filtering
  • Conditional Processing
slide-4
SLIDE 4

User Authentication using the Client Principle Object

Stateful App Environment

  • User application sessions are uniquely bound to

a single OpenEdge Client.

  • Context persists on the OpenEdge Client
  • Shared Vars
  • Persistent procedures
  • UserID()
slide-5
SLIDE 5

User Authentication using the Client Principle Object

Stateless App Environment

  • User application sessions share OpenEdge

Clients.

  • User Context must be re-establish with each

OpenEdge Client Interaction.

slide-6
SLIDE 6

User Authentication using the Client Principle Object

What is a Client Principal Object?

  • Dynamic ABL Object
  • Attribute / Methods
  • Maintains a User's Identity
  • UserID / Roles
  • SessionID / Session Expiration
  • Sets effective UserID() for a database.
  • Does not authenticate UserID and Password
slide-7
SLIDE 7

User Authentication using the Client Principle Object

Importance of a CP Object

  • Establish User Context
  • Maintaining a user's identity in a stateless

environment.

  • Used to maintain an identity authenticated

using an external registry other then _User.

  • Application specific user registry
  • LDAP
  • Auditing
slide-8
SLIDE 8

User Authentication using the Client Principle Object

Establishing a User's Identity

  • OpenEdge Client connect to a database:
  • Authenticate using _User table
  • Login.p
  • Provide -U <userid> -P <passwd>
  • Setuserid() UserID() functions provides identity

context for the connected databases.

slide-9
SLIDE 9

User Authentication using the Client Principle Object

Establishing a User's Identity

  • Application Tables / External Registry
  • Application specific code to Authenticate UserID

and Password.

  • May not have and effect on UserID value set for the

the connected database.

  • Use the CP Object to apply an application user's

identity.

slide-10
SLIDE 10

User Authentication using the Client Principle Object

AppServer/Webspeed Agents

  • Client Session Identity is established as an

agent connects to a database.

  • Most likely at startup
  • Agent is shared by many users but the Identity

remains set to the UserID of the process that started the Agents.

slide-11
SLIDE 11

User Authentication using the Client Principle Object

Session Context

  • A User's Identity is part of application session

context.

  • Established between and client and an agent with

each interaction.

  • Need UserID function to recognize session

context.

  • Specifically a user's identity.
slide-12
SLIDE 12

User Authentication using the Client Principle Object

CP Object

  • The CP Object becomes part of a user's

session context.

  • It can be used to set the UserIDs of all

connected databases at run-time

slide-13
SLIDE 13

User Authentication using the Client Principle Object

Steps to Using CP Object

  • Establish an Authentication Domain
  • Create CP Object
  • Assign three key attribute
  • UserID
  • Domain Name
  • SessionID
  • Seal CP Object
  • Domain AccessKey
  • Use It
  • Set UserIDs for connected database
slide-14
SLIDE 14

User Authentication using the Client Principle Object

Authentication Domains relationship with a CP Object

  • Defined internally using the Data Admin Tool
  • Alternately defined externally
  • Provides encrypted key (access-key).
  • Access-key used to seal and validate CP Objects.
slide-15
SLIDE 15

User Authentication using the Client Principle Object

Authentication Domain Setup

slide-16
SLIDE 16

User Authentication using the Client Principle Object

Security Policy

  • An authentication domain must be loaded for a

session.

  • Security Policy system handle loads domains

into the Trusted Domain Registry.

  • security-policy:load-domain('dbName')

– Domain Registry Locked Automatically

  • security-policy:register-domain('DomainName, AccessKey)

– security-policy:lock-registeration()

slide-17
SLIDE 17

User Authentication using the Client Principle Object

Create CP Object

CREATE CLIENT-PRINCIPAL hClientPrincipal.

/* Set CP Object Values */ hClientPrincipal:SESSION-ID = BASE64-ENCODE(GENERATE-UUID). hClientPrincipal:USER-ID = pcUserID. hClientPrincipal:DOMAIN-NAME = 'bravepoint.com'. hClientPrincipal:DOMAIN-TYPE = 'Internal'. hClientPrincipal:LOGIN-EXPIRATION-TIMESTAMP = ADD-INTERVAL(NOW, 60, 'seconds'). hClientPrincipal:ROLES = pcRoles. hClientPrincipal:SET-PROPERTY('UserPlant', 'Norcross').

slide-18
SLIDE 18

User Authentication using the Client Principle Object

Authenticate User Identity

IF Identity.IdentityKey <> ENCODE(pcPasswd) THEN DO: /* This will set the state-detail attribute */ hClientPrincipal:AUTHENTICATION-FAILED ('UserName Password authenitication failed.'). pcMessage = 'UserName Password authenitication failed.'. END.

slide-19
SLIDE 19

User Authentication using the Client Principle Object

CP Object State

  • LOGIN-STATE Attribute
  • LOGIN
  • LOGOUT
  • EXPIRED
  • FAILED
  • AUTHENTICATION-FAILED()
  • Used on an unsealed CP Object
  • LOGIN-STATE is set to failed.
  • STATE-DETAIL Attribute is set to the supplied reason.
slide-20
SLIDE 20

User Authentication using the Client Principle Object

Seal CP Object

  • The Domain Access Key was previously defined using the Data

Admin tool or setup manually using register-domain().

hClientPrincipal:SEAL(cDomainAccessKey)

slide-21
SLIDE 21

User Authentication using the Client Principle Object

Set DB Identity

  • SET-DB-CLIENT will set the effective UserID for all

connected databases or those explicitly specified.

SET-DB-CLIENT(hClientPrincipal)

slide-22
SLIDE 22

User Authentication using the Client Principle Object

CP Object Portability

  • CP Object provides methods to import and

export it's values.

  • CP Object exports and imports from a raw data

type.

DEFINE VAR rCP AS RAW NO-UNDO. rCP = hClientPrincipal:EXPORT-PRINCIPAL().

slide-23
SLIDE 23

User Authentication using the Client Principle Object

CP Object and Session Context

  • Alternative #1:
  • Pass the raw CP Object as a parameter back to the

client.

– Client gets full access to all the CP Objects Attributes. – Raw data type might present issue with non ABL clients. – Security threat?

slide-24
SLIDE 24

User Authentication using the Client Principle Object

CP Object and Session Context

  • Alternative #2
  • Store the CP Object in a session context DB Table.

– CPObject.SessionID AS CHARACTER – CPObject.ContextObject AS RAW

  • Pass an encrypted token containing the associated

sessionID back to the client.

– SecureToken is used to reconstitute the CP Object each

time a user interacts with an agent.

– SecureToken is a character string.

slide-25
SLIDE 25

User Authentication using the Client Principle Object

CP Object and Session Context

/* Store the CP Object as part of a user's session context. */

rCP = hClientPrincipal:EXPORT-PRINCIPAL(). DO TRANSACTION: CREATE bCPObject. ASSIGN bCPObject.SessionID = hClientPrincipal:SESSION-ID bCPObject.ContextObject = rCP. END.

slide-26
SLIDE 26

User Authentication using the Client Principle Object

CP Object Identity Authentication

cSessionID = STRING(DECRYPT(BASE64-DECODE(pcSecToken), rEncryptKey))

NO-ERROR. /* Create an empty CP Object. */ CREATE CLIENT-PRINCIPAL hClientPrincipal. /* Find the session context row containing the previosuly saved CP Object Data. */ FIND bCPObject WHERE bCPObject.SessionID = cSessionID NO-LOCK NO-ERROR. IF NOT AVAIL bCPObject THEN UNDO, THROW NEW Progress.Lang.AppError('Unable to authenticate

  • user. Could not find CPObject context.', 104).

/* Load the CP Object. So you left with a CP Object as it existed after you sealed it during createCPObject. */ hClientPrincipal:IMPORT-PRINCIPAL(bCPObject.ContextObject).

slide-27
SLIDE 27

User Authentication using the Client Principle Object

Validate CP Object

  • VALIDATE-SEAL(domainKey)
  • Validates the CPObject's MAC, which was

previously generated via the SEAL().

  • Must supply the DomainKey used to seal the

CPObject.

  • LOGOUT()
  • In validates a sealed CP Object
  • No longer use it to set DB UserIDs
  • Sets the LOGIN-STATE to LOGOUT
slide-28
SLIDE 28

User Authentication using the Client Principle Object

Validate CP Object

hClientPrincipal:IMPORT-PRINCIPAL(bCPObject.ContextObject).

IF NOT hClientPrincipal:VALIDATE-SEAL(cDomainAccessKey) THEN DO: hClientPrincipal:LOGOUT(). UNDO, THROW NEW Progress.Lang.AppError( SUBSTITUTE('CP Object Validation Failed. Login-State = &1', hClientPrincipal:LOGIN-STATE), 105). END.

slide-29
SLIDE 29

User Authentication using the Client Principle Object

Session Expiration

  • SEAL-TIMESTAMP
  • Automatically set.
  • Date and time of when the CP Object was sealed.
  • LOGIN-EXPIRATION-TIMESTAMP
  • Programmatically set to some point in the future.
  • LOGIN-STATE set to 'Expired' if not sealed prior to

the value set in this attribute.

slide-30
SLIDE 30

User Authentication using the Client Principle Object

Session Expiration

/* Check expiration */ IF hClientPrincipal:LOGIN-EXPIRATION-TIMESTAMP < NOW THEN DO: /* This will set the state-detail attribute */ hClientPrincipal:AUTHENTICATION-FAILED ('User Session Expired.'). hClientPrincipal:LOGOUT(). DO TRANSACTION: FIND CURRENT bCPObject EXCLUSIVE-LOCK. prCP = hClientPrincipal:EXPORT-PRINCIPAL(). bCPObject.ContextObject = prCP. END. END.

slide-31
SLIDE 31

User Authentication using the Client Principle Object

Demo App

UI Client asAuthenticate asBroker2

  • -CPObject Table
  • -Domain Registry
slide-32
SLIDE 32

User Authentication using the Client Principle Object

Demo App

UI Client asAuthenticate asBroker2

  • -CPObject Table
  • -Domain Registry

User Creds Validate Identity

slide-33
SLIDE 33

User Authentication using the Client Principle Object

Demo App

UI Client asAuthenticate asBroker2

  • -CPObject Table
  • -Domain Registry

Security Token

slide-34
SLIDE 34

User Authentication using the Client Principle Object

Demo App

UI Client asAuthenticate asBroker2

  • -CPObject Table
  • -Domain Registry

Query DB Send SecToken Authenticate User Execute Request

slide-35
SLIDE 35

User Authentication using the Client Principle Object

Demo App

UI Client asAuthenticate asBroker2

  • -CPObject Table
  • -Domain Registry

App Data

slide-36
SLIDE 36

User Authentication using the Client Principle Object

Questions?