Macaroons and dCache or delegating in a cloudy world Patrick - PowerPoint PPT Presentation

Macaroons and dCache … or delegating in a cloudy world Patrick Fuhrmann Paul Millar Paul Millar On behave of the project team Macaroons and dCache | Taipei | Patrick Fuhrmann, Paul Millar | 15 March 2016 | 1

Macaroons and dCache | Taipei | Patrick Fuhrmann, Paul Millar | 15 March 2016 | 2

AAI … but Thi t lk i This talk is about the second 'A': Authorisation . b t th d 'A' A th i ti Macaroons and dCache | Taipei | Patrick Fuhrmann, Paul Millar | 15 March 2016 | 3

Quick recap: which is which? Credential Authorization Authentication Macaroons and dCache | Taipei | Patrick Fuhrmann, Paul Millar | 15 March 2016 | 4

Authorisation without authentication? How ? How ? Photo by Alan Cleaver (CC-BY) Macaroons and dCache | Taipei | Patrick Fuhrmann, Paul Millar | 15 March 2016 | 5

Photon Science portal use ‐ case U Users U User Web DB Authentication LOGIN Brouser dCache Request Download Request Download http WebDAV WebDAV P Portal t l Redirect R di t Request Download q Storage Pool Stream Data Stream Data Stream Data USER Community Specific Service Stack Data Service Macaroons and dCache | Taipei | Patrick Fuhrmann, Paul Millar | 15 March 2016 | 6

Desired: client downloads directly Users U U User Web DB Authentication LOGIN Brouser Request Download dCache Portal Redirect http p Request Download (How to authorize this request ?) q ( q ) WebDAV Redirect Request Download Storage Pool Stream Data USER Community Specific Service Stack Data Service Macaroons and dCache | Taipei | Patrick Fuhrmann, Paul Millar | 15 March 2016 | 7

Desired: client downloads directly U Users U User Web DB Authentication LOGIN Brouser dCache Request Download Portal Request Token Supply Token T T Redirect http WebDAV T T Request Download q Redirect Request Download Storage Pool Stream Data USER Community Specific Service Stack Data Service Macaroons and dCache | Taipei | Patrick Fuhrmann, Paul Millar | 15 March 2016 | 8

What are bearer tokens? Bearer token is something the user presents with a request so the server will authorise it There's no interaction between the server will authorise it. There s no interaction between client and server. Examples of bearer tokens: Examples of bearer tokens: • HTTP BASIC authn, anything stored as a cookies. Counter ‐ examples: Counter ‐ examples: • X.509 credential, • SAML • SAML, • Kerberos. Macaroons and dCache | Taipei | Patrick Fuhrmann, Paul Millar | 15 March 2016 | 9

Bearer tokens for download authz • Redirection should work without JavaScript , • Simple: embed token in redirection URL. http://webdav.example.org/path/to/file?authz=<TOKEN> htt // bd l / th/t /fil ? th <TOKEN> (There are nicer ways of embedding the token, but the URL is the only thing we can control) • Complete token always sent with the request • Complete token always sent with the request. • What can we do to stop someone stealing this token? • … or make the token useless if they steal it. … or make the token useless if they steal it. Macaroons and dCache | Taipei | Patrick Fuhrmann, Paul Millar | 15 March 2016 | 10

Introducing Macaroons