DATAOPS.BARCELONA SIMPLIFYING IDENTITY MANAGEMENT WITH SSO TOOLS

Transcription

1 SIMPLIFYING IDENTITY MANAGEMENT WITH SSO TOOLS

2 WHO AM I & WHAT DO WE DO? Pol Jane - Senior DevOps Engineer DevOps IoT Big Data Software Development Migrations Automation Cost Optimization

3 WE RE WOLDWIDE! London Barcelona Buenos Aires (HQ) Las Vegas

4 TODAY S JOURNEY How to manage Identities Centralized authentication Introducing the 2FA/MFA MFA types On premises IdP vs SaaS IdP Managing identities: AWS + roles & permissions Challenging apps/services Tech stuff: The SAML 2.0 AuthProxy stack Looking further

5 HOW TO MANAGE IDENTITIES? User Group(s) Application/Service

6 HOW TO MANAGE IDENTITIES? User Group(s) LDAP/AD Application/Service

7 HOW TO MANAGE IDENTITIES? User Group(s) LDAP/AD Application/Service Branch offices

8 HOW TO MANAGE IDENTITIES? User Group(s) LDAP/AD Application/Service External Services VPN Branch offices

9 I DARE YOU TO UPDATE A USER ATTRIBUTE

10 JOB FOR NON TECHIE PEOPLE?

11 CENTRALIZED AUTHENTICATION SSO? User Group(s) Application/Service External Apps Branch offices Single Source of Truth - IdP

12 CENTRALIZED AUTHENTICATION The traditional way Usually or authentication stacks are just a simple Active Directory or an LDAP with more or less complexity where our users authenticate with their access credentials. 1. Can I log in? 2. Let me check User 4. Login Success APP/Service 3.OK AD/LDAP

13 CENTRALIZED AUTHENTICATION II How SSO (Single Sign On) Works? + IdP SSO means that a user can access to multiple resources by using the same access credentials. -> Life is too short to remember dozens of passwords. -> Systems dept. is probably sick of resetting your passwords. -> All the access credentials are stored into a centralized point. So we need resiliency, fault tolerance and hight availability 24/7.

14 CENTRALIZED AUTHENTICATION II What if we delegate this task to 3rd party? Do we really want to maintain one more complex/delicate stack? LDIF syntax, manage attributes, update, patch

15 INTRODUCING THE MULTI FACTOR AUTHENTICATION - MFA How SSO (Single Sign On) Works? SSO means that a user can access to múltiple resources by using the same access credentials. Even from a security point of view this is concerning, but there s a way to secure this scenario: 2FA/MFA 1. Can I log in? 2. Let me ask to IdP User 6. Login APP/Service 5. MFA OK IdP User s Phone 4. It s me! :) 3. OK! Let me. Check if that s true (MFA)

16 INTRODUCING THE MULTI FACTOR AUTHENTICATION - MFA 2FA vs MFA? What s the difference? Multi-factor authentication (MFA) is: a method of computer access control in which a user is only granted access after successfully presenting several separate pieces of evidence to an authentication mechanism. Typically at least two of the following categories: * Knowledge (something they know) * Possession (something they have) * Inherence (something they are). 2FA is a subset of that. Just a type of MFA.

17 MULTI FACTOR AUTHENTICATION TYPES RSA Key

18 MULTI FACTOR AUTHENTICATION TYPES YubiKey

19 MULTI FACTOR AUTHENTICATION TYPES SMS (old+not encrypted)

20 MULTI FACTOR AUTHENTICATION TYPES Phone Call (answer a question/voice recon)

21 MULTI FACTOR AUTHENTICATION TYPES Tokenizer mobile app ( Google auth / others )

22 MULTI FACTOR AUTHENTICATION TYPES Smartphone Push Notification :)

23 IDENTITY PROVIDERS [IDP S] How to choose an IdP? Test everything, compare and decide. Apps/Services list with compatibility 2.0 IdP on premises o SaaS IdP? >> IdP s has a vast list of already supported applications and services. >> Copy & Paste XML Metadata More info:

24 CENTRALIZED AUTHENTICATION WITH SAAS IDP More security & resilient By using an IdP, adapted to our needs and providing us with at least one more security layer. (2FA/MFA) >> Protected & encrypted user credentials. >> Hight availability >> Attack protection Endless possibilities Our IdP can provide us with several different features and services like MAC filtering for portable devices. Easy&Fast migration We don t have to take care of take care of the authentication mechanisms and the stack as part of the infrastructure, we just delegate this to a third party. Also we have 24/7 support! * Of course depending on provider and contract type.

25 THE IDEAL SCENARIO What we want: All the company users can los in to different apps and services using a single access credentials. >> More security layers. >> GDPR compliance >> Easy to use/manage >> Bulk Import/Export >> Absolute tracking - API >> Easy migration >> Compatible with our infrastructure

26 VISTA DE USUARIO Users just need to access to a web console and click on the app/service they want to log in. Or just using a web browser plugin

27 ADMINISTRATOR VIEW The web console let us manage everything in an easy way

28 ADMINISTRATOR VIEW Attribute mapping

29 ADMINISTRATOR VIEW Just with some clicks we can assign different roles/permissions to users or groups Event logs: Visibility & complete tracking.

30 EXAMPLE: USERS, GROUPS, PERMISSIONS & ROLES IN AWS Role & permission assignments in users/groups DEV AWS Account A EC2_Read_Only EC2_Admin STG AWS Account B S3_Read_Only S3_Admin PRO AWS Account C RDS_Read_Only RDS_Admin Users can have access to one or more roles in different environments: A,B,C Administrators can choose between a list of roles in all the preconfigured AWS accounts.

31 CHALLENGING APPS/SERVICES What to do with those apps which are not SAML compatible? App/Service SAML 2.0 OpenID AuthProxy CUSTOM APP

32 CHALLENGING APPS/SERVICES SAML 2.0 Support No SAML 2.0 Support

33 THE SAML 2.0 AUTHPROXY STACK Reverse proxying with Apache2 + some modules mod_auth_mellon: SAML 2.0 auth mod_proxy: reverse proxying mod_authz_user: authorization capabilities

34 THE SAML 2.0 AUTHPROXY STACK

35 MORE PERSPECTIVE (API CONSUMING OR DELEGATE AGAIN)

36 MORE PERSPECTIVE (API CONSUMING OR DELEGATE AGAIN)

37 MORE PERSPECTIVE (API CONSUMING OR DELEGATE AGAIN)

38 MORE PERSPECTIVE (API CONSUMING OR DELEGATE AGAIN)

39 QUESTIONS? THANKS FOR WATCHING!