1 of 26

Uros Stevanovic, Marcus Hardt

AARC AHM, Abingdon, UK

FEUDAL + oidc-agent

Distributed non-web access with OIDC

18-21.03.2019

SA1

Karlsruhe Institute of Technology

Authentication and Authorisation for Research and Collaboration

https://aarc-project.eu

2 of 26

“User deployment”

  • User “creation” 🡪 Account provisioning
    • Creating/assigning a user account on the Service side
    • E.g. name, group, home folder

​

  • Deploying a credential for a user
    • SSH
    • Password
    • Tokens
  • CLI + API access

​

​

2

https://aarc-project.eu

3 of 26

“User deployment”

  • User “creation” 🡪 Account provisioning
    • Creating/assigning a user account on the Service side
    • E.g. name, group, home folder

​

  • Deploying a credential for a user
    • SSH
    • Password
    • Tokens
  • CLI + API access

​

​

3

TTS service

(existing solutions)

https://aarc-project.eu

4 of 26

“User deployment”

  • User “creation” 🡪 Account provisioning
    • Creating/assigning a user account on the Service side
    • E.g. name, group, home folder

​

  • Deploying a credential for a user
    • SSH
    • Password
    • Tokens
  • CLI + API access

​

​

4

https://aarc-project.eu

5 of 26

“User deployment”

  • User “creation” 🡪 Account provisioning
    • Creating/assigning a user account on the Service side
    • E.g. name, group, home folder

​

  • Deploying a credential for a user
    • SSH
    • Password
    • Tokens
  • CLI + API access

​

​

5

Federated User Credential Deployment Portal (FEUDAL)

oidc-agent

https://aarc-project.eu

6 of 26

AARC BPA

6

https://aarc-project.eu

7 of 26

AARC BPA

7

FEUDAL

oidc-agent

https://aarc-project.eu

8 of 26

FEUDAL requirements

  • Web Portal
  • Deployment
    • Federated user authentication
    • Credentials: SSH public keys
    • Fault tolerant
    • Fast response time
  • Services
    • Distributed
    • Services can be hosted at multiple sites
    • Sites can host multiple services
  • At the sites:
    • Interface with all possible User Management Systems (within reason)
    • Customisable by the local Administrator
    • Easy integration
    • Management of no incoming connections
  • Secure

8

https://aarc-project.eu

9 of 26

FEUDAL architecture

  • Distributed:
    • FEUDAL clients
    • Every site hosts one or more clients
    • The clients execute the deployments

Central elements:

  • Web portal
    • User interface
  • FEUDAL backend + database
    • Sends messages to the clients
    • Stores user information and credentials

9

https://aarc-project.eu

10 of 26

Architecture

10

https://aarc-project.eu

11 of 26

Architecture

11

  • Interface to SP-IdP-Proxy: OpenID Connect
  • Backend: Django/Python
    • Inbuilt administration frontend
    • Simplifies usage of Database
  • Django REST Framework
  • Clients: Go (others supported)
    • Static linking
  • Webpage: Angular/Typescript

https://aarc-project.eu

12 of 26

Architecture

12

  • Interface to SP-IdP-Proxy: OpenID Connect
  • Backend: Django/Python
    • Inbuilt administration frontend
    • Simplifies usage of Database
  • Django REST Framework
  • Clients: Go (others supported)
  • Webpage: Angular/Typescript

https://aarc-project.eu

13 of 26

Messaging

  • JSON
  • Backend → Client:
    • identifier
    • action ∈ { “deploy”, “remove” }
    • service
    • SSH public key
    • user info (from OpenID Connect)
    • group memberships (from Unity)
  • Backend ← Client: Acknowledgement
    • identifier

13

https://aarc-project.eu

14 of 26

Messaging

  • Publish Subscribe
  • Quick transmission (close to network latency)
  • Only outgoing connections at the clients
  • Dedicated message broker: RabbitMQ
    • Delegated authentication of clients
    • Inbuilt message routing

14

https://aarc-project.eu

15 of 26

oidc-agent

  • Tools to manage OIDC tokens on command line
    • obtain tokens (access, refresh)
    • “pass on” to needed apps
    • register with OP
  • Motivation: CLI and API access with OIDC
    • Non-web especially
  • Guiding pattern: ssh-agent
    • Support for “forwarding”
  • Deployment scenario:
    • One or more per user

​

  • App, not a service!
    • All data (including personal) are under direct user’s control
    • Stored only locally! (encrypted)

​

15

https://aarc-project.eu

16 of 26

oidc-agent architecture

  • oidc-agent (net)
    • Daemon that handles OIDC tokens and communication
    • Tool to register the client with an OIDC provider
    • Use several flows and dynamic client registration to register the client
  • oidc-gen (disk-rw)
    • User frontend for initiating new account creation
    • Store encrypted OIDC data (RefreshToken, ClientID, ClientSecret)
  • oidc-add (disk-r)
    • Tool to decrypt / load / remove OIDC data and pass to agent
  • oidc-token
    • Tool to obtain AccessToken

16

https://aarc-project.eu

17 of 26

oidc-agent architecture

17

https://aarc-project.eu

18 of 26

oidc-agent usage

  • Once in a lifetime:
    • oidc-gen <name>
      • For now: ask OIDC-P admin to enable refresh tokens for the password flow
    • oidc-gen –f <file> <name>
      • Use password flow to get RefreshToken
  • After reboot:
    • eval `oidc-agent`
  • Each time you need a new token:
    • oidc-token <name>

​

18

https://aarc-project.eu

19 of 26

Security features

  • Privilege separation:
    • oidc-add and oidc-gen
      • Only access to local disk and oidc-agent (via IPC), no network required
    • oidc-agent
      • The only component with network access, disk access only required for ca-bundle
    • oidc-token
      • Only IPC communication
  • Decrypted credentials only in RAM
    • All disk-stored credential are crypted using libsodium
    • Use own free() method to wipe memory when deallocating

​

19

https://aarc-project.eu

20 of 26

DEMO

20

https://aarc-project.eu

21 of 26

DEMO

21

Local

machine

Remote VM(s) (USA)

KIT SSH

service

ssh-forwarding

oidc-agent forwarding

ssh

deploy key

https://aarc-project.eu

22 of 26

Summary

FEUDAL provides:

  • Account provisioning
  • Deploying credentials
  • Key FEUDAL features:
    • Realtime deployment: Instant feedback for users
    • Asynchronous deployment: Retransmission of information (if sites are offline)
    • “Discovery” deployments: "new" sites/resources (in a “VO”) automatically receive info
    • Full sites control integration: system admins provides “mechanisms/call-outs” for user management
    • FEUDAL transmits “unmodified” user information

oidc-agent:

  • CLI and API token management (oidc client)
  • Secure (privilege separation, encrypted local storage, TLS, etc.)

​

22

https://aarc-project.eu

23 of 26

Links

​

23

https://aarc-project.eu

24 of 26

uros.stevanovic@kit.edu

​

Thank you

Any Questions?

© GÉANT on behalf of the AARC project.

The work leading to these results has received funding from the European Union’s Horizon 2020 research and innovation programme under Grant Agreement No. 730941 (AARC2).

https://aarc-project.eu

https://aarc-project.eu

25 of 26

Messaging

25

Clients receive only messages for the services of their site.

https://aarc-project.eu

26 of 26

Messaging

Clients manually fetch messages

  • On startup
    • Missed deployments
  • Per interval (e.g. 30 minutes)
    • Result: Unacknowledged deployments are retried

26

https://aarc-project.eu