Recommended
More Related Content
What's hot
What's hot (20)
Similar to BYOIDaaS - Automating IAM Infrastructure & Operations
Similar to BYOIDaaS - Automating IAM Infrastructure & Operations (20)
Recently uploaded
Recently uploaded (20)
BYOIDaaS - Automating IAM Infrastructure & Operations
- 1. BYOIDaaS: Automating IAM Infrastructure & Operations European Identity & Cloud Conference 2019 May 15, 2019 Jon Lehtinen @jonlehtinen REUTERS / Yves Herman REUTERS / Yves Herman
- 2. 2
- 3. 3
- 4. 4 Separation Identity Governance Directory Services Network Single Sign-on PKI MFA PAM Datacenters
- 5. 5
- 6. 6
- 7. 7 Thomson Reuter’s internal landscape • ~35,000 workers • ~4000 apps • Large user populations on most continents • Access from anywhere • Datacenter exit • Cloud strategy REUTERS / Jose Miguel Gomez
- 8. 8 Current state Multiple usernames • t212360886 • domaint212360886 • jon.lehtinen • 212360886 • jon.lehtinen@tr.com Multiple logon experiences Proprietary authentication protocols
- 9. 9 Desired state • OpenID connect • SAML • OAuth
- 10. 10 Multifactor as an extension of SSO
- 11. 11 Build, buy, or cloudify? On-prem Cloud-hosted IDaaS Self-service Strategically aligned Globally available Operational effort
- 12. 12 BYO… IDaaS? Host OS Host Hardware Hypervisor Guest OS App Guest OS App VM1 VM2 Host OS Host Hardware Container Engine App Container App Container Virtual Machines ContainersNative Cloud Services
- 13. 13 The First Day -8 Months Remain- Dawn of
- 14. 14 Anatomy of a dockerfile FROM image:version RUN some commands && install –y things WORKDIR /opt COPY java.tar.gz /opt ADD pingfederate.zip /opt RUN unzip pingfederate.zip RUN tar –xf java.tar.gz USER pingfed:pingfed ENTRYPOINT [“/usr/bin/startup.sh”] Base image OS prep Work directory Binaries Commands User & Group Process to Launch
- 15. 15 Birth of a docker image FROM image:version RUN some commands && install –y things WORKDIR /opt COPY java.tar.gz /opt ADD pingfederate.zip /opt RUN unzip pingfederate.zip RUN tar –xf java.tar.gz USER pingfed:pingfed ENTRYPOINT [“/usr/bin/startup.sh”] docker build docker image
- 16. 16 Networking & node considerations pfadmin:latest pfengine:latest 7600 7601 7700 9999 9031 Internet Docker Swarm Admin
- 17. 17 AWS ECS clusters & networking • awsvpc – 169.254.x.x – Difficult to map internal/external network interfaces – Precluded Fargate • host – Pass-though IP from EC2 host to container – Must create and manage EC2 ECS cluster – Size ECS task to EC2 instance
- 18. 18 VPC networking security ECS Hosts = SG-2222222 Admin ALB = SG-4444444 Engine ALB = SG-7777777 From To Port SG-4444444 SG-2222222 9999 SG-7777777 SG-2222222 9031 SG-2222222 SG-2222222 7600 SG-2222222 SG-2222222 7601 SG-2222222 SG-2222222 7700
- 19. 19 Security groups don’t work across peered VPCs
- 20. 20 Whitelist VPC CIDR range Type Protocol Port Source Custom TCP 7600 3.3.4.0/27 Custom TCP 7601 3.3.4.0/27 Custom TCP 7700 3.3.4.0/27 Custom TCP 7600 3.3.3.0/27 Custom TCP 7601 3.3.3.0/27 Custom TCP 7700 3.3.3.0/27 Type Protocol Port Source Custom TCP 7600 3.3.3.0/27 Custom TCP 7601 3.3.3.0/27 Custom TCP 7700 3.3.3.0/27 Custom TCP 7600 3.3.4.0/27 Custom TCP 7601 3.3.4.0/27 Custom TCP 7700 3.3.4.0/27
- 21. 21 Defense in depth AWS Access Controls AWS Environment Security Docker Image Hardening Application Access Controls Infrastructure Design Application Hardening Attacker ”The Goods”
- 23. 23 La persistencia de la memoria
- 24. 24 Logs SOC/CIRT stdout stdout aws s3 cp aws s3 cp adminnode_use2_ip-3-3-3-3 enginenode_use2_ip-3-3-3-4 enginenode_use2_ip-3-3-3-5 enginenode_use2_ip-3-3-3-6 enginenode_euw4_ip-3-3-4-3 enginenode_euw4_ip-3-3-4-4 enginenode_euw4_ip-3-3-4-5 enginenode_apsw3_ip-3-3-5-3 enginenode_apsw3_ip-3-3-5-4 enginenode_apsw3_ip-3-3-5-5
- 26. 26 Persistent data stores Connections stored as this ID string based on connection DNS name
- 27. 27 “What is SSO doing to mitigate their dependency on DNS?” –Some clueless, but well-meaning person who was just trying really, really hard during an outage call, February 2014
- 28. 28 Route 53 aliases Connection string remains constant based on Route53 alias
- 29. 29 Bridging enterprise DNS and AWS Route53 ssoadmin.tr.com sso.tr.com a369876-esso-adminalb-28364637-us-east- 2.elb.amazonaws.com:443 a369876-esso-enginealb-183674563-us-east- 2.elb.amazonaws.com:443 ssoadmin-prod.trawsenv.int.aws.tr.com sso-prod.trawsenv.int.aws.tr.com
- 31. 31 Location-aware routing & regional sub-clusters
- 32. 32 Hey dawg, I heard you liked Route53
- 33. 33 Auto-scaling
- 34. 34 High availability & disaster recovery
- 35. 35 Operational support • Dashboard shows service is up • Check the test apps • Can you get a token using curl? • Attach proof or L2 will reject the ticket
- 37. 37 100% infrastructure as code
- 38. 38 One codebase to rule them all create.py dockerfile esso_all_env.yaml
- 40. 40 Continuous integration, continuous deployment
- 41. 41 Product upgrades Diff the new version Update impacted files Repackage files Update “PFVERSION” in create.py
- 42. 42 Challenges • Trial and error, limited cloud/development knowledge • Endless tinkering – refinements continue (now under change control) to this day • Operational handoff is more difficult • Kubernetes for transportability REUTERS / Carlos Jasso
- 44. 44 I think so. On-prem Cloud-hosted IDaaS BYOIDaaS Self-service Strategic Globally available Operational effort Cost
- 45. 45 Total cost of ownership • Saves $1.2mm per year over existing TR SSO & MFA systems • $2.2mm less per year compared to retail commercial enterprise IDaaS • $700,000 less per year compared to “best & final” rate commercial enterprise IDaaS REUTERS / Dado Ruvic
Editor's Notes
- So IDaaS seems like the right tool for the job here? I agree.
- IDaaS is the easy way out, and one we were looking into. Retail cost for IDaaS for our org was $2.5mm, negotiated price ~1.2mm/yr. Whatever I did not spend on licensing costs I could spend on burst resources to migrate the app portfolio in 2019/2020, so I wanted to see if I could do it cheaper.
- 5) Began researching containers, cloud services. Did lots of iterative work containerizing an on-prem IDP tool.
- IDaaS is the easy way out, and one we were looking into. Retail cost for IDaaS for our org was $2.5mm, negotiated price ~1.2mm/yr. Whatever I did not spend on licensing costs I could spend on burst resources to migrate the app portfolio in 2019/2020, so I wanted to see if I could do it cheaper.