![Page 1: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/1.jpg)
April 15, 2015
RBAC Enable Your Java Web AppsUsing Apache Directory and Fortress
Shawn McKinney – SYMAS Corporation
RBAC Enable Your Java Web AppsUsing Apache Directory and Fortress
Shawn McKinney – SYMAS Corporation
![Page 2: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/2.jpg)
Introduction
• Systems Architect @
• Committer @ OpenLDAP & Apache Directory Projects
![Page 3: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/3.jpg)
AgendaI. Project OverviewII. ComponentsIII. StandardsIV. FutureV. DemoVI.BenchmarksVII.Wrap-up
![Page 4: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/4.jpg)
I. Project Overview I. Project Overview
![Page 5: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/5.jpg)
Project Description● High Performance Identity and Access Management
• Permission-based Access Control Model (RBAC)
• Four Components:• Core• Realm• Web• Rest
![Page 6: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/6.jpg)
Project Features• Highly Performant
• ANSI INCITS 359
• Multitenant data and object model
• Audit Trail (OpenLDAP only)
• LDAPv3 Portable
![Page 7: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/7.jpg)
Project History● Core & Realm released in '11 to OpenLDAP Project
• Rest component in '12 to OpenLDAP
• Web component in '13 to OpenLDAP
• Moved all to Apache Directory project in '14
![Page 8: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/8.jpg)
Project History22 Releases
http://mvnrepository.com/artifact/us.joshuatreesoftwarehttp://mvnrepository.com/artifact/org.openldap
![Page 9: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/9.jpg)
Project HistoryDownloads
![Page 10: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/10.jpg)
II. Components II. Components
![Page 11: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/11.jpg)
Inventory of Components● Accelerator – LDAPv3 Extended
● Core – APIs
● Realm – Policy Enforcement
● Web – HTML Server
● Rest – XML Server
accelerator9 k
core74 k
realm2 k
web18 k
rest5 k
108 k SLOC
![Page 12: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/12.jpg)
Fortress Core• Identity and Access Management SDK
• Communicates LDAPv3 protocol but has switch for REST
• Extensive Tests (one-to-one)
https://git-wip-us.apache.org/repos/asf/directory-fortress-core.git
![Page 13: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/13.jpg)
Fortress Core Depends On
• Mostly other Apache components like• Commons• CXF• Directory
• With some help from• Javax• Jgrapht• ehcache
![Page 14: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/14.jpg)
Core System Architecture
Fortress Core
Java App #2
HTTP/S
Fortress
LDAP
HTTP
Applications
Legend
Java
VM
All apis work with standard LDAPv3 protocolsLDAP/S
LDAP/S
OpenLDAP
LDAP/S
Apache DS
Java
VM
Na
tive
OR
![Page 15: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/15.jpg)
Fortress Realm• Policy enforcement and audit for java EE containers
• Simple deployment
• Uses context.xml for Tomcat integration
• Shares security session with the app
https://git-wip-us.apache.org/repos/asf/directory-fortress-realm.git
![Page 16: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/16.jpg)
Fortress Rest• HTTP Rest Server
• Uses Apache CXF
• Uses Fortress Core APIs and Domain model
• Secured with Fortress Realm
https://git-wip-us.apache.org/repos/asf/directory-fortress-enmasse.git
![Page 17: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/17.jpg)
Rest System Architecture
Java App
HTTP/S
HTTP/S
Fortress
LDAP
HTTP
Applications
Legend
Java
VM
Fortress Core
Fortress Rest
HTTP/S
Java
VM
REST
Other App
HTTP/S
HTTP/S
An
y Pla
tfor m
LDAP/S
OpenLDAP
LDAP/S
Apache DS
Java
VM
LDAP/SIntegrate with 3rd party rest lib or Fortress Core to connect with Fortress Rest
Fortress Core
Na
tive
OR
![Page 18: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/18.jpg)
Fortress Web• Administrative UI
• Uses Apache Wicket Framework
• Uses Fortress Core apis
• Secured with Fortress Realm
https://git-wip-us.apache.org/repos/asf/directory-fortress-commander.git
![Page 19: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/19.jpg)
Web System Architecture
Fortress Core
Fortress Web
HTTP/S
LDAP/S HTTP/S
LDAP/S
Apache DS
Fortress
LDAP
HTTP
Legend
Fortress Core
Fortress Rest
Java
VM
Java
VM
Java
VM
Option to use either HTTP or LDAPv3protocol
HTTP/S
LDAP/S
Administrator
LDAP/S
OpenLDAP Na
tive
OR
![Page 20: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/20.jpg)
Fortress Accelerator• Implements RBAC System Manager Functional Specs
• Policy Decision Point inside OpenLDAP
• Session state and audit trail inside OpenLDAP (LMDB)
• Communicates with LDAPv3 extended protocols
• Built for performance
![Page 21: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/21.jpg)
Accelerator System Architecture
OpenLDAP
Fortress Core
Java App #2
HTTP/S
Fortress
LDAP
HTTP
Applications
Legend
LDAP/S Extended
Other App
HTTP/S
LDAP/SExtended
Java
VM
An
y Pla
tfor m
RBACpolicy enforcement may use extended ldap protocolsto enhance performance
RBAC policy decisionpoint(PDP)
RBAC Accelerator
Accel Client
Na
tive
![Page 22: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/22.jpg)
III. Standards III. Standards
![Page 23: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/23.jpg)
Inventory of Standards• Role-Based Access Control (ANSI RBAC INCITS 359)
• Administrative Role-Based Access Control (ARBAC02)
• IETF Password Policies
• Java EE Security
• LDAPv3
![Page 24: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/24.jpg)
More on RBAC• RBAC0
Users, Roles,
Perms, Sessions
• RBAC1
Hierarchial Roles
• RBAC2
Static Separation
of Duties (SSD)
• RBAC3
Dynamic Separation
of Duties (DSD)
Users Roles Objects Oper-ations User
Assignment PermAssignment
Session Roles
SSD
DSD
RoleHierarchy
http://csrc.nist.gov/groups/SNS/rbac/
![Page 25: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/25.jpg)
More on ARBAC02• Delegated Administration
• Object Model:
AdminRoles, AdminPerms
User Orgs, Perm Orgs
• Functional Model:
Delegated Admin Mgr
Delegated Review Mgr
Delegated Access Mgr
Sessions
Objects Oper-ations User Role
Assign
RolePerm Assign
http://profsandhu.com/journals/tissec/p113-oh.pdf
User Admin Role Assign
AdminRolePerm Assign
Hierarchy
Objects Oper-ations
UserOrgAssign
AdminRolePerm Org Assign
Perm Org Assign
RBAC
ARBAC
Legend
Hie
rarc
hy
Hierarchy
Admin Perm Org Assign
Hierarchy
![Page 26: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/26.jpg)
IV. Future IV. Future
![Page 27: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/27.jpg)
Future Roadmap• IETF RBAC Standardization• Accelerator and Audit for Apache Directory Server• Web Access Management / SSO• Make the REST services really restful• Policy Enforcement Modules for:
• common linux distros• common web framework• other languages like C, Python, Ruby, …
![Page 28: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/28.jpg)
More on IETF Standardization
• Encourage interoperability across directories
• Standard RBAC Object Model (LDAP Schema)
• Standard RBAC Functional Model (LDAPv3 operations)
![Page 29: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/29.jpg)
Future Think
• ANSI RBAC Policy Enhanced
• Attribute-Based Access Control
• XACML
• OAuth 2 & UMA
![Page 30: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/30.jpg)
V. Demo V. Demo
![Page 31: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/31.jpg)
Demo – Web Integration• Wicket Sample Project on Github
fortress core
fortress realm
fortress web
wicket sample
https://github.com/shawnmckinney/wicket-sample
![Page 32: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/32.jpg)
Demo Takeaways• Need policy enforcement points (PEP) for…
• Web frameworks (wicket, spring, …)
• Servlet containers (tomcat, jboss, …)
• Operating systems (fedora, debian, …)
• Cloud based systems (openstack, foundry, …)
![Page 33: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/33.jpg)
VI. Benchmark VI. Benchmark
![Page 34: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/34.jpg)
Benchmark OverviewMeasure the time to perform checkAccess method.
1. OpenLDAP Accelerator, Audit On2. OpenLDAP, Audit On3. OpenLDAP, Audit Of4. ApacheDS, Audit Of
![Page 35: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/35.jpg)
Benchmark ClientMachine Details:• Ubuntu 13.04, 3.8.0-32-generic• Intel® Core™ i7-4702MQ CPU @ 2.20GHz × 8• 16GBOne Machine Process:• Java version 7• Running mvn -Ploadtest-fortress jmeter:jmeter • 25 threads X 50,000 iterations of checkAccess• 1,250,000 total invocations
![Page 36: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/36.jpg)
Benchmark ServerMachine Details:• Ubuntu 14.04• 3.13.0-32-generic• Intel® Core™ i7-4980HQ CPU @ 2.80GHz × 4• 8GB• SSDTwo Machine Processes:● OpenLDAP 2.4.39 (w/LMDB)● ApacheDS 2.0.0-M19 (w/ Mavibot)
![Page 37: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/37.jpg)
Benchmark Results1.OpenLDAP w/ Accelerator, Audit On
● 11,533 TPS, 1 ms avg response2.OpenLDAP, Audit On
● 7,501 TPS, 2 ms avg response3.OpenLDAP, Audit Of
● 16,847 TPS, 0 ms avg response *4.ApacheDS, Audit Of
● 9,555 TPS, 2 ms avg response
* response time < 1 ms can't be measured with current test methods
![Page 38: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/38.jpg)
VII. Wrap-up VII. Wrap-up
![Page 39: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/39.jpg)
More Info1.Apache Fortress Project
● http://directory.apache.org/fortress/2.Apache Fortress End-to-End Security Tutorial
● https://github.com/shawnmckinney/apache-fortress-demo3.The Anatomy of a Secure Web App Using Java EE, Spring
and Apache Directory Fortress● John Field
4.IAM Fortress Blog● https://iamfortress.wordpress.com/
![Page 40: RBAC Enable Your Java Web Apps Using Apache Directory and ... · April 15, 2015 RBAC Enable Your Java Web Apps Using Apache Directory and Fortress Shawn McKinney – SYMAS Corporation](https://reader031.vdocuments.site/reader031/viewer/2022022718/5c4eff9893f3c3143649f9c8/html5/thumbnails/40.jpg)
More on Apache Fortress DemoRequirements Covered
1.Java EE Authentication2.Confidentiality3.Coarse-grained AuthZ
● Java EE● Spring
4.Fine-grained AuthZ
https://github.com/shawnmckinney/apache-fortress-demo