SpringOne Platform 2017 Sree Tummidi, Pivotal "In this session we will cover the capabilities of Cloud Foundry’s UAA which make it apt to be used as an identity gateway for both ingress and egress security patterns. We will take a closer look at how UAA’s multi-tenancy can be leveraged to expose it as an Identity Service using the Cloud Foundry service broker pattern. This greatly reduces the burden on the developers looking to secure their apps & microservices running on Cloud Foundry. Finally we will provide an identity vision which includes the use of side-cars like Spring Cloud Gateway and Envoy as lightweight identity proxies, reducing the burden on the App Developers in terms of enabling client side support for identity protocols like OAuth, OpenID Connect and SAML."

1. Cloud Foundry UAA as an Identity
Gateway
Sree Tummidi - Sr. Manager Product Management - Pivotal
@sreetummidi
1

2. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/ 2
Sree Tummidi
Sr Manager, Product Management
A decade of experience in Enterprise Security
Started out as Software Engineer
Product Manager for CloudFoundry UAA & Pivotal Single Sign-On
Twitter: @sreetummidi

3. Identity Protocols

4. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Enterprise Application Security
Establish the “Who” - Authentication (User)
Establish the “What” - Authorization (Access)
4

5. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Enterprise Identity Management
5
enterprise.com
partner.com
cloud.com
LDAP SAML/OIDC

6. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Identity Federation
Exchange of Identity Information across domains
• SAML 2.0
• XML over HTTP(s)
• OpenID Connect 1.0
• JSON over HTTP(s)
• Identity Information
• Attributes aka Claims : email, phone number, address, group memberships
6

7. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Enterprise API Security Needs
• Establish the “Who” and “What” - on the User’s Behalf
• Establish the “Who” and “What” - on the Applications Behalf
7

8. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OAuth 2.0 API Security
• Delegated Authorization Protocol (On behalf of )
• Access on behalf of User
• Access on behalf of Application
• Actors
•User aka Resource Owner
•Application aka Client
•API aka Resource Server
•Authorization Server
8

9. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Bearer Token
9
GET /my/data HTTP/1.1
Host: uaa.domain.com
Authorization: bearer a2df43cf

10. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
JWT - JSON Web Token
10

11. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OAuth Authorization Code Flow
11
Resource
Server
11
Access Application
Give me Permission / Approval
Authenticate & Grant Authorization
Send Authorization Code
Exchange code with client
credentials for token
Resource Owner Application
Authorization
Server
Send Token
Access protected resource
Send resource
Access
Control

12. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OAuth Client Credentials Flow
12
Authorization
Server Resource
Server
Authenticate with Client
Credentials
Send Token
Access protected resource
(with token)
12
Application
Send resource
Access Control
12

13. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OpenID Connect 1.0
13

14. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OpenID Connect Flow - Simple
14
Load Application
Request Login
Authenticate
User
Identity ProviderApplication
Send Authorization Code
Exchange code with client
credentials for ID Token
Send ID Token
Request ID Token

15. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OpenID Connect Flow - Hybrid
15
Load Application
Request Login/Authorize
Authenticate & Grant Authorization
Request ID + Access Token
User Identity Provider RSApplication
Send Authorization Code
Exchange code with client
credentials for ID + AT
Send ID + AT
Exchange AT for Protected Resource

16. Cloud Foundry UAA

17. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Cloud Foundry UAA
17
UAA
Management Plane
IDPRP
LDAP
REST
Application/ APIExternal User Store

18. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
UAA Basic Concepts
• Users : Internal or External (LDAP, SAML, OpenID Connect)
• Permissions
• Groups associated with Users
• Groups associated with Applications
• On User’s Behalf - As Scopes
• On Application’s Behalf - As Authorities
• External Group Mappings
• Derive UAA Group from External Groups
• LDAP, SAML, OpenID Connect
• External User Attributes
• LDAP, SAML, OpenID Connect
• In ID_Token and /UserInfo
18

19. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
UAA as an OAuth Authorization Server
• All 4 Grant Types Supported
• Refresh Token Grant Supported
• Token Format : JWT and Opaque
• Token Introspection End-Point
• Token Revocation
• Signing Key Rotation
• Client Secret Rotation
19

20. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Token Exchange - External IDP
• Use case
• Mix of legacy and greenfield Apps/APIs OR ecosystem of multiple IDPs
• Legacy API expects SAML assertion from an external IDP
• Greenfield API expects OAuth token from UAA
• Flow
• External IDP registers an OAuth client
• grant_type = “urn:ietf:params:oauth:grant-type:saml2-bearer” or “urn:ietf:params:oauth:grant-
type:jwt-bearer”
• Scopes -> Relevant scopes needed in access token
• Request UAA Access Token
• Pass client id and secret
• JWT or SAML assertion
• Response = UAA access token
20

21. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Token Exchange - Microservices
• Use case
• User authorization performed on the edge
• Call-stack of multiple APIs
• Principle of Least Privilege
• Each API receives only limited scopes relevant to itself
• Flow
• Register an OAuth client corresponding to an API client
• grant_type = “urn:ietf:params:oauth:grant-type:jwt-bearer”
• Scopes -> Relevant scopes needed in access token
• Request UAA Access Token
• Pass client id and secret
• JWT access token
• Response = UAA access token with limited scopes
21

22. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
UAA Multi-tenancy
22
• UAA default identity zone for CF platform security
• UAA identity zone per environment (Dev, Pre-Prod, Prod)
• Internal facing vs external facing apps
• Any other tenancy boundary !
UAA VM
https://login.{system-domain}
https://identityzone1.login.{system-
domain}
https://identityzone2.login.{system-
Users
Groups
OAuth Clients
Identity Providers
Group Memberships
Group Mappings
Default Zone
Users
Groups
OAuth Clients
Identity Providers
Group Memberships
Group Mappings
IdentityZone1 IdentityZone2
UAA DB
UAA VM
UAA VM
UAA VM
Users
Groups
OAuth Clients
Identity Providers
Group Memberships
Group Mappings

23. Pivotal Single Sign-On Service

24. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
SSO Service at a glance
24
UAA SSO Service
Tenant
Management
App/API Security
Configuration
• Tenant Lifecycle
• Identity Provider On-Boarding
• Permission Mappings
• OpenID Connect Client Configuration
• OAuth Client Configuration
• OAuth Resource Configuration
SSO Cloud Connector

25. The Future - Identity Gateway

26. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Goals
• Language agnostic support
• Spring/Java, .Net, Node, JS, Ruby, Python etc.
• Zero touch experience for App Developers
• Security for Apps and Micro Services
• Support for Hybrid Environments
• On Premise and Cloud Apps
26

27. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Use cases
• Secure Web Applications with Enterprise Identity Provider
• Via OpenID Connect
• Session Management
• Secure APIs/Microservices with OAuth 2.0
• Secure APP to API communication
• Secure API to API Communication
• Hybrid Environments - Token Exchange
• Invoke Legacy APIs
• Invoke APIs in other clouds (Google, AWS, Azure)
27

28. Unless otherwise indicated, these slides are © 2013-2017 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Reference Architecture
28
UAA SSO
Service
Outbound
$ OAuth Client
$ OpenID Connect Client
$ Token Exchange
Envoy
Diego Containers
Inbound
$ OAuth Client
$ OpenID Connect Client
$ OAuth Resource Server

29. Questions?