A lot of startups, like the one I work in, use a lot of third-party SAAS services as part of their day-to-day job. Services like Google Apps, AWS, Slack, Salesforce, GitHub, Atlassian Suite, etc. are commonplace. The ITOps teams, however, have to live the nightmare of managing access to all of these different tools and services - especially during onboarding and offboarding. Add to this MIX internal services such as VPN, SSH Servers, internal tools, etc., it becomes almost impossible to handle access control manually. Faced with this very same problems, we created a tool called Concierge. Concierge aims to be the one-stop-shop for all access control related solutions - sync with the HR directory, automatically sync with AD/LDAP and add people to appropriate groups, as well as grant access to various tools and services based on their roles, and provide the ITOps team a holistic view of who has access to what. Concierge also revokes access upon offboarding, role change, or any other event as necessary.

1. BSidesSF 2017
Access Control With
Concierge
Karthik Rangarajan
Security Lead
Addepar

2. Introductions
Who am I?
•Lead Security Engineer at Addepar
•Proponent of the InfraOps framework
•Former cohost of security podcasts
•Dreamer and idealist

3. Introductions
Concierge: Living
the IAM dream
•Motivations for Concierge
•Design considerations
•Implementation details
•Live Recorded Demo!

4. 101 Credentials

5. Tedious Onboarding

6. Painful Offboarding

7. Auditing was a nightmare

8. No Single Source of Truth

9. Is SSO the panacea?

10. “Oh God, AD”

11. Enter Concierge
❖ Sync users automatically with the source of truth
❖ Manage AD users and groups
❖ Manage access to applications depending on role/
department
❖ Centralize SSH access, and other types of temporary access
❖ Provide a centralized location for user access audit
❖ Never, ever RDP into the Windows Server

12. Design Considerations
❖ Extensible
❖ Modular
❖ Provide a RESTful API
❖ Don’t reinvent the wheel

13. A Single Source of Truth
Who works for you?

14. A Single Source of Truth
Who can access your systems?

15. A Single Source of Truth
How do they log in to your systems?

16. Concierge Architecture
Concierge
Sync
Employee
Details
Create new users,
manage groups

17. SSH Access
What if we use Linux servers and SSH access based on
public keys?

18. Never fear, Concierge is here
Concierge
Sync
Employee
Details
Create new users,
manage groups
Manage SSH Access

19. Salt States and AD Groups
Concierge
Upload Public
Key
Retrieve group
memberships, usernames,
public keys
Create/Delete/Update
users based on server role

20. Ephemeral Access

21. Access Services within Concierge

22. Python Metaclasses
DoormanServiceInterface
SSHService CometService AMPProductionService AMPStagingService
Create User
Delete User
List Users
List Access Objects
Needs Approval
Needs Secondary Approval

23. Async Actions with Celery

24. Let’s see how it works!

25. What’s Next
❖ Improve/Rewrite the UI
❖ Tests for both the backend and
frontend
❖ Opensource Concierge

26. We are hiring!
https://addepar.com/careers

27. Make Access Control Great Again!