Доклад Вячеслава Михайлова, Solutions Architect в DataArt

1. Security &
Microservices
Speaker Vyacheslav Mikhaylov (vmikhaylov@dataart.com)
IT Talks
1

2. О чем доклад?
• Немного терминологии и истории
• OAuth2 и Open ID Connect – как работает
• IndentityServer/IdentityManager
• Архитектура
• Как использовать
• Примеры
• Безопасное взаимодействие сервисов
2

3. Терминология
• Идентификация
• Аутентификация
• Авторизация
3

4. HTTP Basic Authentication
4

5. HTTP Digest Authentication
5

6. Forms Authentication
6

7. Token Authentication
7

8. Token Authentication
8

9. Thinktecture Identity Server
9
• OpenID Connect and OAuth2
• Авторы
• Dominick Baier
• Brock Allen
• Identity Server
• Identity Manager
• MembershipReboot

10. Features
10
• Authentication as a Service
• Single Sign-on / Sign-out
• Access Control for APIs
• Federation
• Customization everywhere

11. Big picture
11

12. Big picture
12

13. 13

14. Terminology
14
• OpenID Connect Provider (OP) - security token service, identity provider,
authorization server, IP-STS and more.
• Client
• User - human
• Scope
• Identity scopes – openid, profile, email
• Resource scopes – various API
• Authentication/Token Request
• Identity Token
• Access Token

15. Token structure (jwt.io)
15

16. What is Identity Server
16
• Authorization/Authentication
• Token
• UserInfo
• Discovery
• Logout
• Token Revocation
• Token Introspection
• Access Token Validation
• Identity Token Validation

17. Customization
17
• AuthenticationSessionValidator, AuthorizationCodeStore
• ClaimsProvider, ClientPermissionsService
• ClientStore, ConsentService, ConsentStore
• CorsPolicyService, CustomGrantValidators, CustomRequestValidator,
CustomTokenResponseGenerator, CustomTokenValidator
• EventService, ExternalClaimsFilter, LocalizationService, RedirectUriValidator
• RefreshTokenService, RefreshTokenStore, ScopeStore
• SecretParsers, SecretValidators, SigningKeyService
• TokenHandleStore, TokenService, TokenSigningService, UserService
• ViewService

18. Customization
18
• AuthenticationSessionValidator, AuthorizationCodeStore
• ClaimsProvider, ClientPermissionsService
• ClientStore, ConsentService, ConsentStore
• CorsPolicyService, CustomGrantValidators, CustomRequestValidator,
CustomTokenResponseGenerator, CustomTokenValidator
• EventService, ExternalClaimsFilter, LocalizationService, RedirectUriValidator
• RefreshTokenService, RefreshTokenStore, ScopeStore
• SecretParsers, SecretValidators, SigningKeyService
• TokenHandleStore, TokenService, TokenSigningService, UserService
• ViewService

19. Customization
19
• ClientStore
• ScopeStore
• UserService
• ViewService

20. What is Identity Manager
20
• Simple creating users, editing user information (passwords, email,
claims, roles, etc.) and deleting users.
• Replacement for the ASP.NET WebSite Administration tool User
Management

21. What is MembershipReboot
21
• single- or multi-tenant account management
• flexible account storage design (relational/SQL or object/NoSql)
• claims-aware user identities
• support for account registration, email verification, password reset, etc.
• account lockout for multiple failed login attempts (password guessing)
• extensible templating for email notifications
• customizable username, password and email validation
• notification system for account activity and updates (e.g. for auditing)
• account linking with external identity providers (enterprise or social)
• supports certificate based authentication
• proper password storage (via PBKDF2)
• configurable iterations
• defaults to OWASP recommendations for iterations (e.g. 64K in year 2012)
• two factor authentication support via mobile phone SMS messages or client certificates

22. 22
Identity Manager
Identity Server
Membership
Reboot
User Storage
MS SQL
Token Service
Storage
MS SQL
Store Users
Auth Users
Scope/Clients
Storage
MS SQL
Scope/ClientsTokens/Sessions
User
Manage Users
LoginShow Login/Consent

23. Demo
23

24. Identity
Server
24

25. 25
Identity
Server

26. Источники
• https://habrahabr.ru/company/dataart/blog/262817/
• https://identityserver.github.io/Documentation/
• http://openid.net/connect/
• https://tools.ietf.org/html/rfc6749
26

27. Thank you
To be continued…