Designing an Authorization System: a Dialogue in Five Scenes

This posting’s setting is a blatant ripoff of perhaps the best technology overview document ever written (on Kerberos):

Designing an Authentication System: a Dialogue in Four Scenes

Abstract

This dialogue provides a fictitious account of the design of an open-source authorization system called “Haros”. As the dialogue progresses, the characters Athena and Euripides discover the problems inherent in applications using common authorization systems.

When they finish designing the system, Athena changes the system’s name to “Apache Fortress“, the name, coincidentally enough, of the authorization system that was designed and implemented at Apache’s “Directory Project“.

Contents

  • Dramatis Personae
  • Scene I
  • Scene II
  • Scene III
  • Scene IV
  • Scene V

Dramatis Personae

Athena a newly promoted director of IT security and a people person.
Euripides a longtime programmer specializing in security and reigning curmudgeon.

Scene I

A cubicle area. Euripides is working on a project rollout, for a new financial system.  Athena’s walking the floor with several other executives.  She finds Euripides in the farthest corner, away from the elevator.  All of the windows are covered and the lighting is muted.

Euripides: [clearing an old pizza box from the stained guest chair] Hey stranger!  Haven’t seen you in a while.  How’s life as a corporate bigwig?

Athena’s in distress but trying to conceal it.  Before the promotion, she and Euripides worked on several projects together, the most successful, a Kerberos authentication system.  Despite his gruff exterior, she’s learned to trust his candid viewpoint, particularly on security.

Athena:    [gingerly sitting down] Not so great Rip.  Our common security authorization system totally sucks.  It’s tightly bound to the application data model and can’t be reused. It’s impossible to separate the security policy data from the business data.  We’re going to have to build yet another authorization system for this new banking project you’re working on.

Euripides: [munching on a donut] Why are you telling me?  I’m just a programmer.

Athena:    [rolling her eyes] If only there was a way to externalize security policy so that it doesn’t taint the business model. That way we could have a common fine-grained authorization system that works across every application, on every system.

Euripides: [licking his fingers] We’ve been asking for one of those for as long as I’ve been here.  It’ll happen when Hades freezes over.  Here, have a donut, you’ll feel better.

Athena:     [cringing] No thanks.  I think it’s time to ask the Gods.  Maybe, this has already been solved and we can save my team the odyssey of creating a new one.

Euripides: [eating another donut] Good luck [muttering under his breath] you’re going to need it.

Athena:     What’s that?

Euripides: Oh uh yeah, tell ’em we need better authorization tools down here.

Athena:     [walking briskly away] You better believe it.

Scene II

Euripides’ cubicle, the next morning where he periodically spaces out while reading email.  Every so often, he’ll respond with a cryptic and/or sarcastic one-liner. A strong proponent of a style of discourse known as ‘cartoon-speak’, points are added for comedic effect.  Athena knocks on the cube wall startlingly him into the present.

Athena:     [excitedly] I found the answer to our entrenched authorization problem!

Euripides: [yawning and scratching] Isn’t that wonderful.  [feigning interest] That sure didn’t take very long.

Euripides moves a brown paper bag that’s oozing some kind of liquid from the guest chair to the floor and motions for her to have a seat.  She pretends not to notice the bag has something that looks like feathers sticking out of its top and that there’s a funny smell in the air.  Is there something still moving around in it?  She can’t be sure.

Athena:    [with a crinkled nose, electing to stand] As it turns out this problem has been studied for a very long time, like for ages.  Almost as long as you’ve been a programmer, not quite.

Euripides: [perking up slightly] Is that so?

Athena:    Right, there’s a research deity called NIST and they have many priests who sit in an ivory tower handing down directives for those of us living in the ‘real world’.

Euripides: I hate it when that happens.

Athena:    I know right?  So, the model I found is called Role-Based Access Control, and it’s governed by a specification from another powerful deity, ANSI, called INCITS 359.

Euripides: [sarcastically] That’s a real catchy name.

Athena:    We’ll just call it RBAC for short.

Euripides: RBAC, isn’t that what our Linux systems have… with those Group thingies?  We have to add ourselves to them, for root and what not.

Athena:    Not exactly.  There’s a bit more to it than that.

Euripides: Like what?

Athena:     There are Users of course.  And Groups, but they don’t call them that, rather they’re called Roles.

Euripides: Like for dinner?

Athena:     Very funny.  Roles are how Users are assigned to Permissions.  Permissions are a combination of Resources and Operations.

Euripides: Sounds simple enough.  Is that it?

Athena:     Not quite.  There’s also an entity called a Session.  That’s where Roles go after the User logs in.  One or more of their assigned Roles are then activated into the Session.

Euripides: [smirking] Kind of like dinner rolls only they’re not done yet, so we have to put them in the oven?  Seems like a waste of time.  Why not just let the people eat ’em uncooked?

Athena:     [scowling but with patience] This is keeping with the principle of least privilege.  The User is given the minimum authority to complete her meal, err tasks.  Think about when someone goes on vacation or perhaps on a maternity leave.  Do they need to be active in the system then?

Euripides: No, I suppose not.  [hopefully] Is that it?

Athena:    There’s more to it.  What we’ve described so far is known as RBAC0.  The absolute minimum that an application must do in order to be compliant.  Many times that’s all that’s needed.

Euripides: [sighing] What else is there?

Athena:    Well I’m still digging, let’s talk later.

Euripides: [relieved] Sounds good.

Scene III

The next morning, Athena catches Euripides at the Starbucks kiosk inside their business plaza. He’s waiting on coffee, listening to Spotify and pretends not to see her.  She taps him on the shoulder, forcing him to acknowledge her.

The two then grab their coffees, head to the condiment bar pouring in lots of creamer to mask the bitterness, before tucking themselves into a nearby booth.

Euripides: [audibly slurping] Well that didn’t take very long.

Athena:    [wincing] Got it all figured out.  Do you want to hear the rest of the story?

Euripides: Do I have a choice?

Athena:    Very funny.  Don’t make me place a hex on your dog.  Where were we?  Oh yeah, going over the various facets of the RBAC specification.

Euripides: I’m on the edge of my seat here.

Athena:    [clears throat] RBAC1 is for Hierarchical Roles.  That is we place inheritance relationships between Roles.

Euripides: Kind of like they’re in a family?

Athena:    Sort of.  Think about when it comes time to assign the Roles to Users, sometimes referred to as ‘Role engineering’.  It’s a pretty tricky task as you might imagine.  There are many levels of access.  A Role can be a kind of module, and linked to others via inheritance.  Perhaps Engineers need to also inherit all of the permissions that a normal User gets, plus everything that is normal for them.

Euripides: [caffeine kicking in] I see.  It saves the trouble of having to constantly update all of the Roles anytime the Permissions change for a particular use case.  Say we don’t want Users to be able to log into System X, we don’t have to change every Role, we only need to change the one.  The others will realize the change automatically via inheritance.  Also, the security administrator doesn’t have to understand that an Engineer is also a User.  They just assign them the one, and that includes the other.

Athena:    Very good.  You really are more than just a programmer.  But wait, there’s more.  RBAC2 is Static Separation of Duties.  This is where we establish mutual exclusion constraints between assigned Roles.

Euripides: Say what?

Athena:    It’s not all that complicated.  Basically, we can define sets of Roles and establish a cardinality between them.  That is out of this entire set, only so many can be assigned to a given User.

Euripides: Why would we do that?

Athena:     Think about conflicts of interests that arise in everyday scenarios.  For example, we don’t want the person writing checks also approving them.

Euripides: Why not?

Athena:     Well then they could write themselves checks, approve and then deposit into their bank accounts, illegally.

Euripides: That makes sense.

Athena:    There’s also RBAC3, Dynamic Separation of Duties.  It’s basically the same concept only with activated Roles not assigned.

Euripides: Oh, here we’re back to the Session right?  One can be assigned the ‘check writer’ and ‘check approver’ Roles but can never activate them together into a Session.  There’s a toxic relationship there.

Athena:    Very good.  You’re getting the hang of this Rip.

Euripides:  [brushing off the compliment] It’s pretty straightforward.  Ok, what else?

Athena:     That’s pretty much it.  Now, I go in front of the architecture review board and try to sell my idea of using RBAC authorization inside our business apps.  Hopefully we can stop building new authorization utilities every time we build a new app.

Euripides: Good luck.

Athena:    Why do you keep saying that?

Scene IV

After not hearing from Athena for a week, and no sign of her on slack, Euripides gets worried, and tracks her GPS location on Google to a courtyard inside their business campus, overlooking a large pond.  He finds her slumped over a park bench by the shoreline, in obvious despair.  A flotilla of turtles nearby, observing the scene somberly.

Euripides: Whoa!  Look alive there sailor!

The turtles scatter.

Athena:    [Lifting her head up] I was eaten alive by the board.

Euripides: How so?

Athena:    They hated my idea.  Told me they already understood RBAC, and it’s stupid.

Euripides: Why do they say that?

Athena:     They called it quaint and said it hasn’t worked in the ‘real world’ for a long time.

Euripides: Did you tell them the NIST Gods control the real world?

Athena:     [tearfully] Yes, but they didn’t believe me.  They said that fine-grained authorization is nearly impossible to externalize because it’s tightly bound to the application’s business rules.  For an RBAC system to compensate, too many Roles would be needed causing explosions, making a huge mess of our datacenter.

Euripides: What in hades are you talking about?

Athena:     I’m talking about ‘Role explosion’ and it happens any time context is introduced into an RBAC policy.

Euripides: Context… like attributes and such?

Athena:     Yes, like in our banking scenario we have an attribute associated with the location of the financial institution, or branch.  There are over 1,000 separate locations today and our business plan calls for 10X that over the next few years.  How do we specify that someone can be a Teller in one location and not in another?

Euripides: That’s easy.  Just create Roles with the location as part of the name.  Say Teller-North123 and Washer-South456.

Athena:    That’s what I told them too.  But they said the number of Roles gets multiplied by the number of locations.  So if we have two Roles: Teller and Money Washer, and 1,000 locations, we end up with over 2,000 Roles to manage!

Euripides: Ay yi yi I see the problem.

Athena:    The architects say the only way to fix it is to join the policy entities, i.e. User, Role, and Perm, with the Bank’s data, that includes its locations.  This is hopeless because every application must have its own policy engine, one that understands its particular data model.

Euripides: Sounds like we’re back to square one.  Now what?

Athena:     Well, they’re talking about this new kind of authorization system called Attribute-Based Access Control, or ABAC.  It downplays the Role.  Everything is just an attribute, that can then get linked with a User at runtime.

Euripides: I mean, isn’t that just an Access Control List?

Athena:     Well yeah, but there’s more, like dynamic policies.  In ABAC, policies are expressions in which the various linked attributes are combined with the traditional security entities like Roles and Resources.   Let’s say that I have a policy where the ‘Teller’ Role is still required to gain access to a cash drawer at a financial institution.  We can also link additional attributes, like location.  These attributes can come from anywhere.  Something from the runtime environment, like location, time, IP address, platform, temperature of processors.  Attributes also come from the the application domain.  Things like hair color, favorite type of beer, how many donuts eaten yearly, literally anything under the helios.

Euripides: [rubbing his belly] That sounds loosey-goosey to me and again we still have our security data tightly bound to the application data.

Athena:    You haven’t even heard the worst of it yet.  The most popular ABAC systems use XML to transmit the data between their intermediaries.

Euripides: [retracting in horror] That’s bloody awful.

Athena:    [despondently] If only there was a way to combine RBAC and ABAC.  We could keep our common security data model and policy engine and combine a few attributes, like location, as needed.

Euripides: Holy Toledo, is that even allowed by the NIST Gods?

Athena:    I don’t know but I’m going to find out.

Euripides: Good luck.

Athena:     Stop saying that.

Scene V

The following week at Euripides cubicle.  Athena knocks, startling Euripides from a mid-afternoon siesta.

Euripides: [groggy and regretful of a third IPA during lunch] There you are.  How’s it going today… have you found a solution to your exploding Roles?

Athena:    [grinning] I sure did, and the architecture board has approved my plan for externalizing authorization.

Euripides: Wuff.  How’d you manage to pull that off?

Athena:     It was surprisingly easy.  First, there’s nothing in RBAC that says that attributes aren’t allowed.  So from a standards perspective we’re in the clear and the NIST Gods can’t hex our offspring.

Euripides: [nervously looking at a framed portrait of a dog on the cubicle wall] Oh, yeah, that’s good.  Did the NIST high priests tell you how?

Athena:    They gave me some ideas.  There’s the user-role activation phase… back to our Banking example… remember the two Roles and 1,000 locations?

Euripides: [groaning] Like it was yesterday.

Athena:    As we learned earlier, in RBAC, assigned Roles must be activated into the Session before a particular User can perform operations on the Role’s corresponding resources.

Euripides realizing he’s famished, snatches a cookie wedged against a burger from a day-old takeout box on his desk, almost takes a bite, thinks better of it, (trying to be nice) offers it to Athena, who vigorously shakes her head and frowns.  He then shrugs and begins eating it, a bit of ketchup hanging from one side dropping onto his shirt.

Euripides: [talking with his mouth full] How could I forget?

Athena:     [disgusted] Anyway, we can add a constraint during activation to detect whether the Role being activated matches location.  For example, only activate the Teller Role for Curly when he’s at the North branch.

Euripides: [takes a swig from a two-liter of mountain dew and burps with evident gusto] ‘scuse me.  That’s the policy but how is it enforced?

Athena:     Could … you …

Euripides: Wha?

Athena:     [waving her hands] ew! Just … never mind.  We’re making the constrained Roles special to the system.  The policy engine has to know when activating any Role, that it might have a dynamic constraint placed upon it.  Here, a property associated with the Role’s name will do quite well.

[clears a tiny space on the cluttered whiteboard and begins drawing]:

Role: Teller:locale

Role: Washer:locale

Euripides: This covers how the authorization system knows when to check for a dynamic constraint, but where will the actual attribute values be stored?

Athena:    On the User’s entity of course.  With RBAC, there is already a User-Role assignment that is bound to the User entity.  We simply need to place a couple of delineated properties on that assignment. For example the Role assignment looks like this:

[draws on whiteboard]:

User: Curly

Role Assignment: Teller:locale:North123

Role Assignment: Washer:locale:South456

Euripides: We’re still missing a piece here.  How does the authorization system get the current valid values of a dynamic constraint?  For our scenario, which locale they’re in?

Athena:    It just pushes that into the runtime context…

[draws on whiteboard]:

Session session = createSession("Curly", "locale:North123");

Euripides: Ah!  Now, when the runtime activates Curly’s Roles, it knows that they’re special and will compare the value of the constraint pushed into the API with that stored on the User-Role assignment.  Here, Curly will be a Teller because we’re in the North, right?

Athena:     That’s right. There really is more to you than your curmudgeonly demeanor suggests.

Euripides: [reflectively, with a bit of ketchup still on his shirt] Yep.  Sometime’s it’s hard for me to be humble.  What’d the board have to say?

Athena:    [handing him a napkin] What could they?  We’re pushing into the financial system as we speak.  The Bank is happy because now we’re not spending a bunch of money on a new ABAC system.  We just made a couple tweaks to our old RBAC system and everyone’s happy.

Euripides: The Gods must be pleased, maybe we’ll finally get raises.

Athena:    Don’t push your luck.

Confessions of a Middle-Aged Coder Turned Gravel Grinder

Slides from my ApacheCon talk yesterday:

confessions-middle-aged-coder-turned-gravel-grinder-aceu-2019-v1

Some words about Gerrit Gorter… writer, professional, musician, husband, father and friend.

I just learned his treatment (for a disease I shall not grace by naming) has been discontinued.  He has listened to my stories, encouraged the continued pursuit (of silly things like riding gravel), and to never lose the childlike curiosity to try new things.  This talk was for him.

The Dirty Kanza Effect

It happens every year.  The Dirty Kanza entices me with the idea that it can be mastered.  This year will be the year I have that perfect ride.  If only my plan is executed flawlessly, if my training holds up, if I can continue to hydrate and eat like I practiced.  This will be the year I get to return to Emporia in time to enjoy that beer at the finish with my friends and family.

That’s how it felt last year, and the others.  This year once again, flush with confidence and those first twenty-five miles were a thing of beauty.  A gorgeous sunrise, cool temps, tame roads and we were all smiles.  It’s an illusion.  Every endurance gravel event presents unique, i.e. never before seen, challenges and the DK is no exception.  In ’16 DK was the heat, and the south winds that made it a brutal sufferfest.  DK ’17 brought rains during 3rd leg that wreaked havoc.  DK ’18 had those punishing north winds.

DK ’19 will be remembered as the year of the heat.  To a lesser extent the course itself presented challenges.  For example, the gravel was chunkier, more hills over long sections.  But, for me it was the heat that brought difficulty.  To understand what happens think about when the radiator in your car gets overwhelmed.  Maybe it gets low on water, the fan stops working, or even the thermostat fails.  That’s what happens to me.  I can’t keep my engine cool.

This is when I start consuming more water, which leads to an electrolyte imbalance.  I try to keep up of course, consuming various concoctions but it’s always too little, too late.

Actually cramps around mile 80 seem to be a thing with me and the Kanza.  Happens Every Damn Time.  I now believe that I must have a defective left quad.  Always starts during one of the longer climbs.  Usually late in the morning.  Maybe halfway up when the red lights start to blink and the cramping begins.  This year, I had the antidote. In our DK swag-bags were packets with cramp pills and lotion.  I had these tucked away in my handy chase camelbak and immediately placed a couple tablets beneath my tongue.  As they dissolved I tore open the package and slathered the cramp lotion onto my left thigh and it actually — worked.  Or, I thought it worked.  At least for a while, say 10 miles before the whole process replays itself once again.

A hot engine means a slow, inefficient one and so one has to maintain at a lower capacity, say 75% or even 66%.  That 14mph trot has become a 10mph crawl. If there’s water to be found anywhere along the way by all means STOP.  Keeping the water tanks topped off is one of the things that helps.  But, if there isn’t water, don’t stop.  Don’t stop at the side of the road to sit beneath those lovely shade trees (with all of the others) unless it’s absolutely necessary.

Above all, don’t worry about it.  For example, don’t think like this:

If that hill up ahead continues for what looks like another mile with portions having a grade of more than 15% and we’re into the wind meaning most likely I’m going to have to get off and walk.  Especially because the very coarse-grained rock and ruts make it tricky finding a proper line with all of the riders dismounting and walking…

It’s still twenty miles to the next rest stop.  My stomach isn’t working very well and my energy levels will continue to dissipate making it likely that I’ll need to slow down even more…

Instead, focus on very small details of the ride.  A kind of mediation.  Focus on breathing.  In, out, in out.  Focus on form. Smooth strokes. On things that can be controlled, like cadence.  Focus on other tactics like the line you take.  Little else is more important than that.  Take a bad line, it’s over.  In other words, think about what’s happening NOW.  Let everything else fall to the wayside.

What works for me.  I avoid like the plague the clusters of casualties who gather at the roadside, unless help is needed.  Stop and help the rider from Minnesota find her cell phone. Stop and talk to those in obvious distress, who’ve wrecked, unresolved mechanicals, etc.  Provide water/food to those in need.  That kind of thing.  The positivity of the present.  It’s the culture of gravel.  It’s why we’re out there.  The negativity, replaying all of the bad stuff that’s already happened, or yet to, must be pushed out of the mind.

It’s OK to think about future positives.  That tailwind on the last leg.  That cloud that might dump cooling rains.  The dropping sun means cooler temps.  I ALWAYS get a second wind at sunset.  A secret weapon.  It can be counted on, when the barn is smelled.

My last leg to Emporia from Council Grove was the second most enjoyable part of the ride.  After the smiles on the first leg they returned again for the last.  The roads were tamer.  Fewer hills.  I was able to maintain a decent pace that last 50 and cross the finish line at 1:06am.  Jim Cummins was there to congratulate us.  I made sure to tell him that the new course was AWESOME.  It was in fact perfect and I had the best ride ever, if not a perfect one.

There’s always next year.  That’ll be when I finally master the DK.

 

On Becoming a Member

A couple of days ago, an unexpected message arrived in my inbox, inviting me to become a member of the Apache Software Foundation.

After the initial surprise wore off I began to process what it meant.  Obviously, it’s an honor.  But there’s more to it than that.

About five years ago we began having discussions with a colleague, Emmanuel Lécharny, about moving the OpenLDAP Fortress project into the ASF, as a sub-project of the Apache Directory, and that topic is covered here.

Since that time, the typical path of escalating involvement within a particular project was followed.  Contributor->Committer->PMC, …

What I learned during this period of time can’t be catalogued into a single blog post.  Careers are made (and sometimes broken) on transitional paths such as these.  There were challenges, pressures, (personal) shortcomings to be addressed, highs, lows and everything between.

It would take another post to cover all of the people involved, including family, fellow project members (both at ASF and OpenLDAP), business partners, work colleagues and the many other shoulders upon which I stood.  Thankful doesn’t begin to cover the feelings, I’m still processing, trying to make sense of it all.

Now, after having satisfied those original technology goals, it’s time to broaden the perspective to a wider field.  The elements contained within this new field of vision have yet to come into a sharp focus.

What I do know, it will be more of a societal thing than technological.

For example, having a daughter just now starting her career in technology, what will it be like when she enters into the workplace?  Will organizations such as the Apache Software Foundation be inclusive to her (as it was to me) or will there be barriers put in place barring or slowing down entry?

What must change and what do we leave alone?  How do we ensure the essential characteristic of the ASF remains in place while making targeted changes (planting/pruning/weeding) to clear out space for new growth, allowing new opportunities for new segments of society?

These are the types of questions I’m asking myself.  An incredible opportunity to follow a new course alongside an unmistakable concern of not rising to the occasion.

 

Why ApacheCon

It’s the middle of the night, just hours before my return flight home, and can’t sleep.  The tape recorder inside my mind continues to play and won’t stop.  And so, much like my first Apachecon, I choose to write rather than toss and turn.

The theme of this week’s entry is ‘Why ApacheCon’.  I mean, after seven trips, on both sides of the pond, one might expect to grow weary of the routine.  I’m not saying that I don’t like traveling.  It’s just that, well, after almost thirty years as a professional software developer, I’ve had my fair share.

But here’s the deal, it’s not the trip that makes it worthwhile although I’ll admit the venues are always nice.  Certainly Montreal in September is not a bad gig.

It’s the people, and their stories, that make this event special.

A perfect example is Cliff Schmidt, founder of Amplio, who left a lucrative technology career, to pursue a new mission — saving lives in Africa through education via starting a non-profit that supplies battery operated listening devices, i.e. ‘talking books’, to poor rural farmers in Ghana.

DoBbhPxVsAA6wK-

Cliff Schmidt

Another example of Apache members doing good is Myrle Krantz who’s mission is building an open source system for core banking as a platform.  The reason?  To provide a reliable and affordable solution for the world’s 2 billion unbanked, via Apache Fineract.

There’s also Justin McClean, who’s working on an incubating project to provide a real-time operating system featuring a robust and reliable platform to run embedded systems, a.k.a IoT.  The project is Apache Mynewt.  With Mynewt the playing field has been leveled, opening the dedicated hardware market to anyone with a good idea and access to a cheap embedded processor.

Dn_m2T-WkAU8UTS

Justin McClean

And Christopher Dutz who’s striving to break Siemens’ stranglehold on the programmable logic controller market, to offer cost-effective options to gather their data, for small to medium-sized manufacturing facilities.  His incubating project is Apache PLX4J.  This affords small business’ the same capabilities of command and control of their equipment, enabling them to compete with giant corporations

Dn_nTU8XkAEBvxs.jpg large

Christopher Dutz

Or how about Daniel Ruggeri, who’s taken it upon himself to create (and teach) a college-level course on how to introduce a successful open source practice into the enterprise.  This brings more talent in, enabling innovation, across a broader spectrum of companies.

DoBc3i2UwAEkK1C.jpg large

Daniel Ruggeri

What do these people have in common?  Bringing about positive change in the world, via open source projects.

This is why I come to ApacheCon.  It’s not the beautiful venues.  It’s not the education and learning.  It’s not the fun gatherings.  (Although these things are good too of course.)

It’s so that I may be inspired by stories such as these.