LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 11-25-2007, 05:47 PM   #1
cbonar
Member
 
Registered: Apr 2004
Location: Paris, FRANCE
Distribution: Kubuntu + Debian
Posts: 53

Rep: Reputation: 15
Post [general] An authorization scheme proposal


Hi

I'm sorry for the length of this message, I post it not only to have my question answered, but also because I think others could be interested.

I'm trying to define a concrete, centralized authorization scheme that can be used with most of the existing applications with a minimum of work and using only free tools.

I've been trying for a few weeks now to build such a system to manage the access to my web applications but I've encountered a lot of difficulties.


Let's start with a few assertions :
  • The system is composed with 'applications', (e.g. : a web music player, a web photo album, ...)
  • Each application has its own set of 'features', which are different for each application (e.g. : listen to music, upload new songs, view photos, download photos as zip, add comment to a photo, ...)
  • Rules to access features are not predictable, but can be split in as many permissions as necessary, that can be given to 'users' to achieve access to the requested feature (e.g. : listen to music, upload music, view photo, downzip photos, comment photo)
  • Each user is unique through the system and independent of any application/feature (so that they can be un/assigned access to any feature)
  • Permissions can be assembled into 'profiles', describing common usage schemes to the features (e.g. listener = listen to music, uploader = listen to music + upload music)

Therefore you can already figure out the procedure to integrate a new application as :
  1. Define applications (obvious most of the time)
  2. Define permissions for each application (not obvious and a complicated task, it has to be done inside each application)
  3. Define profiles for each application
  4. Assign each user a profile (or directly permissions) to give them the right access to the right features

And the database scheme :

Code:
+ users
+ applications
  + profiles
    + permissions
Here some remarks :

I'm using a LDAP server to store all the data ; this inclined me to think the hierarchical way.
However, applications on the current market rarely implement 100% of the LDAP authentication and authorization mecanisms
and I was not able up to now to make a consistent authorization system.

In order to have a consistent database, informations about users (password, name, email, ...) are carried by their entry in the system.
That means each user entry must be present at only one place in the database, in order to avoid duplicate and inaccurate informations.

Rules to access features are not predictable : that means one cannot construct a database with generic permissions.
Each application has its own set of features : this also means it doesn't make sense to separate permissions from their respective applications, and therefore to have a common permissions store for all applications.

Permissions can be assembled into profiles : even if this introduces some cost, this is very important to differentiate profiles from raw permissions.
For instance, let's say one day you add webdav access to upload photos to a web album. You don't want to add this new permission to each user one by one.
Instead you'll want to add the 'webdav upload' permission to the 'photo uploader' profile so all users with this profile will benefit from this new feature.

I think it could be more correct to include one more level : global profiles, that would include application profiles. This would make easier the replacement of an application with another one.
I haven't yet really thought about it so it doesn't appear in the following scheme.

Here's the *symbolic* hierarchical scheme the previous statements lead to :

Code:
+ users
  + me { password:jhdfkj; name:Myself; }
  + afriend { password:jhdfkj; name:Zogo; }
+ applications
  + music { name:Music jukebox; }
    + anonymous { jinzoraPermissions:readOthers; }
    + listener  { jinzoraPermissions:readOwn,readOthers,uploadOwn; }
    + uploader  { jinzoraPermissions:readOwn,readOthers,uploadOwn; }
    + admin     { jinzoraPermissions:readOwn,readOthers,uploadOwn,uploadOthers; }
  + aproject { name:A Java project; }
    + anonymous { tracPermissions:readAll; svnPermissions:read; }
    + developer { tracPermissions:readAll,writeAll; svnPermissions:read,write; }

Since I couldn't achieve yet to make it fit with my LDAP implementation, I started to doubt about this conception of authorization.

Take the example of a project supported by trac and subversion.
Trac is a software that brings to developers a shared space to work on the project.
It includes a wiki, a ticket system, svn access, reports, ...
The sources of the project are put under a subversion repository, to which access is made through the Apache's web server.

Subversion access can be controlled directly from within the web server configuration using mod_authnz_ldap.

Trac also provides a plugin to use LDAP as an authentication and authorization backend.
I was able to use LDAP for the authentication phase (via the web server), but not (yet) for the authorization.

Trac is exactly conforming to the scheme I explained before : it defines a set of permissions like TRAC_ADMIN, WIKI_VIEW, WIKI_CREATE, ...
and allows the creation of profiles (e.g., to create the 'developer' profile : 'trac-admin myrepo permission add myuser developer')


So my question is : what do you think of my authorization scheme ? Is it correct ? Realistic ?
Do you have any other ideas ? Pointers ?

I'd be happy to have your feedback :-)
 
Old 11-26-2007, 02:29 PM   #2
drokmed
Member
 
Registered: Dec 2005
Location: St Petersburg, FL, USA
Posts: 219

Rep: Reputation: 30
Quote:
Originally Posted by cbonar View Post
So my question is : what do you think of my authorization scheme ? Is it correct ? Realistic ?
Do you have any other ideas ? Pointers ?
You just described (quite nicely) the very challenge of integrating all these different applications to work together in a similar fashion. If all the apps were written by the same company, it wouldn't be such an issue.

I've been struggling with this too for years. LDAP is definitely the best solution right now, for the authentication part anyways. The best tool I've been able to find, which is written specifically for integrating all these apps into LDAP is the GOsa project, which is GPL. It's by far the most rebust LDAP system management tool I've found.

https://oss.gonicus.de/labs/gosa/

It can already do most everything you are talking about. It's far from trivial though, you'll be rolling up your sleeves.

They are old school, use mainly their mailing list, which you will want to join if you implement the software. No forum, however, they are in the process of upgrading the web site to add useful documentation (engineers are notorious for putting off writing docs)

Not sure which distros you favor, they write for Debian first, then kinda migrate it over to rpm's. I've added Debian to my list of server distro's, and to be honest, I like it a lot.

Hope this helps
 
  


Reply

Tags
authorization, credentials, ldap, permission, profiles


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Password generation failed for scheme {CRYPT}: scheme not recognized olva Linux - General 0 11-05-2006 12:21 PM
How to modify my .bashrc in general to accomodate running binaries (e.g. SCHEME)? Erik_the_Red Linux - Software 1 08-01-2005 01:23 PM
general partitioning scheme Godsmacker777 Linux - Newbie 4 12-14-2004 10:07 AM


All times are GMT -5. The time now is 10:22 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration