SOA3 Authentication Module
Overview
SOA3 Authentication Module provides Authentication as a Service. The module receives Authentication requests from external clients with userid and password, matches received information with data contained in User LDAP and returns the response. The response could be a Security Assertion Markup Language (SAML)[1] assertion containing authentication information and user attributes, if the authentication succeeded, an error message otherwise. The module is compliant with LDAP providing high performance and an high capacity and could be, if required, totally decoupled from the rest of the architecture in order to obtain a zero-dependencies model.
Key features
- Userid/password authentication model
- a personal X509 certificate is not required to users
- RESTful interface
- decouples the module from gCube infrastructure: zero-dependencies model. Anyway the module is also usable as Java Library
- Standard based
- User attributes loaded from LDAP are inserted in a standard SAML Assertion
- High performance
- based on LDAP, which is particularly appropriate for authentication operations
Design
Philosophy
Standard compliance and performance are the most important features of SOA3 Authorization Module. Authentication Module is the entry point of an infrastructure and determines the balance between levels of closure and openness. In particular the concept of closure should be referred to security, i.e. making very difficult (and potentially impossible) to access the infrastructure without valid credentials. The openness should be referred to standard compliance, in authentication case SAML, providing interoperability with other infrastructure. SAML standard is also used for Identity Federation: this means that a SAML compliant authentication module can easily became member of a SAML federation[2]. The high performance are obtained using LDAP for user management. The reference open source implementation, OpenLDAP [3] is optimized to provide high performance even with an high number of entries. Since the authentication module and the user management system potentially can receive a great amount of calls, the performance should be view as one of the first requirements.
Architecture
The coarse grain functionality of the module is:
- to receive REST (encrypted) authentication requests containing userid and parrword
- to return a signed SAML authentication assertion containing authentication information (authenticator id, timestamp and expiration time) and user attributes (at least user role)
The fine grained functionalities are provided by the sub-modules, in particular:
- Authentication Engine uses data loaded from LDAP to decide if received credentials are valid or not
- LDAP Connector access LDAP in read only mode. It is used for userid/password checking and for attribute loading
- Identity Provider associates an 'identity valid inside the infrastructure, to received credentials (if they are valid), in particular:
- Attributes loader loads required user attriubutes
- SAML generator generates a SAML authentication assertion with an id representing the Identity Provider, information about the validity of the authentication and the attributes. This assertion is used as response in case of successful authentication
- Authentication Interfaces are RESTful, for zero-dependencies model, or Java API, for a strict integration as a Java Library
- SAML Consumer reads and interprets received SAML assertion with attributes and/or authentication statements. This sub-module make SOA3 Authentication Module compliant with SAML Identity Federation
Deployment
Authentication Module is the entry point of the infrastructure: every request coming from the external world must be authenticated. This means that the logical deployment of SOA3 Authentication Module, as like as the logical deployment of user LDAP directory, should be performed at infrastructure level.
The Portal refers to Authentication Module to authenticate portal users and each Node calls Authentication Services in order to authenticate requests coming from external infrastructures.
Use Cases
The use cases covered by SOA3 Authentication Module are described in this section.
Well suited Use Cases
The module is conceived to cover two main use cases:
- Authentication of Portal users
- Authentication of service calls coming from external infrastructures
In order to obtain access to infrastructure and VOs resources, a request must contain caller related attributes. These attributes are, in general, the roles associated with the caller, but SOA3 doesn't make any assumption or limitation on the semantic of them. In order to be associated to her attributes, the user must authenticate herself: if the user logs into the portal she inserts userid and password in the form and, if the credentials are valid, obtains the access. The portal has a client which contacts SOA3 Authorization Module sending a message with user credentials and obtaining the SAML assertion which will be used as a token to access internal resources. In the case of direct access to the services, through clients not integrated with the portal, user credentials must be sent inside the call (in a way which depends on the type of call): these credentials are intercepted by target Node and used for Authentication request to obtain the login. If the credentials are valid the Node receives as answer caller attributes by which it is able to evaluate authorization privileges (see SOA3 Authorization Module).
Less well suited Use Cases
The current design supports only Username/password factor authentication, in particular direct X509 certificate authentication is not currently supported. This use case can be currently covered only using the following process flow:
- resource request signed with caller personal certificate is sent to the target Node, which trusts the certificate and send its DN to the SOA3 User Management Module
- SOA3 User Management Module matches the DN with a registered user and answers with her attributes
- a local SAML Assertion producer generates and signs a SAML assertion containing authentication information and attributes and uses it for the authorization
This method is currently implemented for D4Science[4] infrastructure: it gives authentication responsibility to so called edge nodes, which is formally correct, but has the drawback that hedge nodes' signature must be known inside the infrastructure.
