Adding Identity Management and Access Control to your Application
•Télécharger en tant que PPTX, PDF•
2 j'aime•795 vues
Adding Identity Management and Access Control to your Application
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à Adding Identity Management and Access Control to your Application
Similaire à Adding Identity Management and Access Control to your Application (20)
Plus de Álvaro Alonso González
Plus de Álvaro Alonso González (18)
Dernier
Dernier (20)
Adding Identity Management and Access Control to your Application
- 1. Adding Identity Management and Access Control to your Application Álvaro Alonso UPM – DIT Security Chapter. FIWARE aalonsog@dit.upm.es, @larsonalonso
- 4. Agenda • FIWARE Lab Accounts – Account types – Creating an account – Upgrading your account • Using FIWARE Lab Cloud Infrastructure • Registering an application – OAuth2 protocol – Application example • Using FIWARE GEs from your application • Securing your backend • Security GEs
- 5. FIWARE Lab Accounts • Basic – Manage organizations – Register applications – Use Cloud if other users authorize him • Trial – Cloud 14 days Trial period – Spain2 region • Community – Cloud during 9 months – Assigned region
- 7. FIWARE Account (Identity Manager) Demo 7
- 8. Using FIWARE Lab Cloud Infrastructure • If you are a Trial or a Community user – Your Cloud organization is “purchaser” of the Cloud application – You can authorize other users in your organization • If you are a Basic user – Upgrade to Trial (if available) – Apply for a Community account – Ask a Trial or Community user to authorize you in his Cloud organization • Developers week… – Request a Trial account in fiware-developers-week@lists.fiware.org
- 9. Using FIWARE Lab Cloud Infrastructure • To authorize another user in your Cloud organization. 1. Access Account Portal and login 2. Switch to your Cloud organization using the "Switch session" option in the dropdown in the left upper corner 3. Go to "Members" in the left side panel 4. Add the user you want to authorize as a member of the org using the "Manage" button 5. Authorize the user inside Cloud Application giving him the role "Member" using the "Authorize" button
- 10. Using FIWARE Lab Cloud Infrastructure Demo
- 11. 11 Account
- 13. OAuth 2.0 13
- 15. Oauth 2.0 Message Flow 15 Web App Account redirect request access-token access-token access-code OAuthLibrary Request user info using access-token
- 16. Oauth 2.0 Libraries • http://oauth.net/2/ – PHP, Cocoa, iOS, Java, Ruby, Javascript, Python. • Example using Node.js – https://github.com/ging/oauth2-example- client 16
- 18. Web Applications and GEs 18 Generic Enabler Account Request+ access-token Oauth2 flows access-token OK + user info (roles) Web App OAuthLibrary access_token
- 19. Web Applications and GEs GET https://GE_URL HTTP/1.1 Host: GE_hostname X-Auth-Token: access_token 19
- 20. Securing your back-end 20 Back-end Apps Account Request+ access-token Web App OauthLibrary PEP Proxy access-token OK + user info (roles) Oauth2 flows access_token
- 21. Securing your back-end • Level 1: Authentication – Check if a user has a FIWARE account • Level 2: Basic Authorization – Checks if a user has permissions to access a resource – HTTP verb + resource path • Level 3: Advanced Authorization – Custom XACML policies
- 22. Level 1: Authentication 22 Back-end Apps Account Request+ access-token Web App OauthLibrary PEP Proxy access-token OK + user info (roles) Oauth2 flows access_token
- 23. Level 2: Basic Authorization 23 Back-end Apps Account Request+ access-token Web App OauthLibrary PEP Proxy access-token OK + user info Oauth2 flows access_token Auth PDP GE roles + verb + path OK
- 24. Level 3: Advanced Authorization 24 Back-end Apps Account Request+ access-token Web App OauthLibrary PEP Proxy extension Oauth2 flows access_token Auth PDP GE access-token OK + user info roles + XACML <Request> OK
- 25. FIWARE PEP Proxy Demo 25
- 26. Security GEs – IdM - KeyRock • Keystone + Horizon +Extensions • APIs – OAuth2 – Keystone v3 – SCIM 2.0 • Source Code – https://github.com/ging/fi-ware-idm • Documentation – http://catalogue.fiware.org/enablers/identity- management-keyrock • FIWARE OAuth2 Demo: – https://github.com/ging/oauth2-example-client 26
- 27. Security GEs – Authorization PDP - AuthZForce • Policy Decision Point • Polici Administration Point • XACML 3.0 • Documentation – http://catalogue.fi-ware.org/enablers/access-control-tha- implementation/documentation 27
- 28. Security GEs – PEP Proxy - Wilma • Policy Enforcement Point • Compatible with OAuth2 and Keystone tokens • Source code: – https://github.com/ging/fi-ware-pep-proxy • Documentation – http://catalogue.fiware.org/enablers/pep-proxy-wilma 28
- 29. Security GEs • Privacy GE • Cyber Sec GE • Trustworthy Factory GE 29
- 30. Adding Identity Management and Access Control to your Application Álvaro Alonso UPM – DIT Security Chapter. FIWARE aalonsog@dit.upm.es, @larsonalonso