Securing the Perimeter around Your Microservices Wojciech Lesniak - PowerPoint PPT Presentation

Securing the Perimeter around Your Microservices Wojciech Lesniak AUTHOR @voit3k

Module Overview Basic Certificates Tokens, JWT Oauth2, OpenID authentication Connect

Identity provider Microservices API Gateway

Challenges with Edge Security

External API consumers

Type of API Consumer Human (User) Non-human (Service or system)

Authentication / Authorization Authe uthenti nticati tion Autho uthoriza zati tion The process of identifying who the The process of identifying what the consumer is. consumer can do.

Principal of Least Privilege Every user or service consumer has the bare minimum privileges which are essential to perform their tasks.

Principal of Least Privilege Limits the blast radius of any compromise to your system.

Type of API Consumer Human (User) Non-human (Service or system)

Human Users Client Victoria Microservice /victoria

Delegation Problem Can you trust that the client is in-fact acting on behalf of the user and has their consent to do so?

User Clients Proprietary data User data

Delegated Access Authenticate user (resource owner) Get their consent to authorize client access to their resources

Delegated Authorization Victoria Withdraw Delegate Joe

API Gateway: Exposing Your API Securely

Transition to Microservices PORT : 80 PORT : 8080 PORT : 8081 REST HTML REST REST Portfolio Pricing Session Data Data Access Access in-process Support Portfolio PORT : 8082 Pricing Account REST Support Data Access Data Access

Clients Microservices PORT : 8080 REST Portfolio Data PORT : 8081 Access REST Pricing Data Access PORT : 8082 REST Support Data Access

Clients Microservices PORT : 8080 REST API Gateway Portfolio Data PORT : 8081 Access REST Pricing Data Access PORT : 8082 Audit logs REST QOS checks Support Throttling Data DOS prevention Access

Development team can focus more on business requirements rather then non- functional security requirements.

Single Responsibility Principal Each microservice should perform one function and do it well.

Benefits of an API Gateway Avoids the need for shared libraries making our architecture polyglot.

Defensive Structures

Basic- username / password Static API key Client id and client secret OpenID connect SAML Fingerprinting Certificates

Clients API Gateway Firewall API Gateway API Gateway API Gateway MITM

Considering Basic Authentication

Basic Authentication Base64 encoded username:password dXNlcm5hbWU6cGFzc3dvcmQK He Heade der na name me Va Value Authorization Basic dXNlcm5hbWU6cGFzc3dvcmQK

Why Basic Is Not Suitable for Microservices Authentication is more complex then just a username and password, requiring 2 Factor or Multifactor. For persistent login the credentials would have to be stored on the client. In a distributed system, credentials are exposed to multiple services. Delegation can only be done by requesting the users credentials.

Authenticating Clients with Certificates

Clients Microservices PORT : 8080 REST Firewall Portfolio Data API Gateway PORT : 8081 Access REST Pricing Data Access PORT : 8082 REST Support Data Access MITM

At minimum TLS 1.2 or higher

Certificate Authority API Gateway Client mTLS Public / private key, signed by CA Public / private key, signed by CA

Transport Layer Security (TLS) Certificate issuers by CA CA public key, verify server

Challenges with mTLS Does not solve the delegated access or the confused deputy problem. You have to maintain a Public Key Infrastructure and your Certificate Authority. Key provisioning, bootstrapping, and rotation, and invalidating keys can be challenging as the number of clients and services increases.

Introducing Tokens

Clients STS Firewall Authenticate Microservices Portfolio Introspection Support API Gateway Pricing Get resource

Opaque Tokens – by Reference Id:1234567 1234567 Name: Victoria Email: Identity Provider vic@email.com

Bearer T oken A security token with the property that any party in possession of the token (a "bearer") can use the token in the same way that any other party with possession can.

Benefits of Tokens Microservices are never exposed to the users or clients password. “Single responsibility Principal” your microservices development teams don’t need to focus on non-functional security requirements. Tokens can be used to provide delegated authorization.

Identity Provider

Subject – Entity Requesting Access Human Machine Software user like Victoria

Subject Principals Username: victoriaN Username: victoriaN name: Victoria Smith dob: 15/05/1988 Email: vic@send.com Email: vic@send.com Address: 1 Bond st Address: 1 Bond st London London gender: Female gender: Female dob: 15/05/1988 name: Victoria Smith name: Victoria Smith Address: 1 Bond st London gender: Female dob: 15/05/1988

Coupling Application and Identity data API Gateway REST REST Portfolio Support Data Access Data Access Get principal Get principal Get principal sync sync principal principal principal application application

Micros oserv rvices (Ex (Except pt for the or the D Data ta) API Gateway REST REST App data App data Support Portfolio Data Access Data Access Get principal Get principal Get principal principal Monolithic data store

Identity Provider A service that manages the creation, maintenance of identity information for principals.

Authentication as a service (AaaS) Manage and provider single sign in for all users in your applications, systems, and networks centrally.

Clients Identity provider STS Authz Server Firewall Authenticate Microservices Portfolio Verify Support API Gateway Pricing Get resource

Identity Provider Client Victoria Microservices API Gateway /portfolio Portfolio 401 Unauthorized Support Pricing

Relaying Party principal Identity provider LDAP Victoria Client Microservices API Gateway Portfolio /portfolio Support Pricing

Identity Provider Can Become a Bottleneck Identity provider verify

By-value Tokens

By-value Token username: victoria name: Victoria Lesniak Derpartment: reserch

Claims-based identity Claims define what the subject is and is not.

By-value Token Identity provider principal username: victoria name: Victoria Lesniak derpartment: reserch LDAP Signed with providers private key

A signed token without the expiration date is worse than a password.

What format should your by-value token be?

Answer A standard token format.

Different Token Formats Introduce Complexity

Evolution of Security Tokens 1990s 2015 Kerberos JWT Protocol agnostic Protocol specific 2002 SAML Protocol specific

Evolution of Security Tokens 1990s 2015 Kerberos JWT Protocol agnostic Protocol specific 2002 SAML Protocol specific

Evolution of Security Tokens 1990s 2015 Kerberos JWT Protocol agnostic Protocol specific 2002 SAML Protocol specific

JSON Web Token (JWT)

JWT Optional Standard Claims Cla laim im Desc scripti ption jti Unique token identifier iss Issuer – who issued the token sub Subject – Who the claims represent. aud Audience – The recipient the token was meant for. exp Expiration – Until when the token is valid iat Issued at – The time the token was issued.

JWTs can also be encrypted to prevent the content being read by unwanted parties, using the JSON Web Encryption (JWE) specification.

Javascript Object Signing and Encryption (JOSE) JSON Web Token (JWT) (JWS) JSON Web Signature (JWE) JSON Web Encryption (JWA) JSON Web Algorithm

Delegated Authorization with OAuth2

Open Authorization (OAuth2) OAuth2 is an open standard used to allow entities to grant limited access to their resources, without sharing their credentials.

Actors in OAuth Authorization server Resource server Client Issues access token to client protects Resource Owner Protected resource owns

OAuth2 Authorization Code Grant User Client 1. Sign-in Crypto Portfolio Victoria 2. Redirect to auth-server <client id> 7. Forward auth code https/ /auth-server-uri/ 11. /portfolio https/ / crypto-portfolio-redirect-uri /?code=123456&state=987654 Browser client id ?client_id=crypto-portfolio&scope=profile,portfolio&response_type=code secret http POST: &redirect_uri=crypto-portfolio-uri&state=987654 Crypto Portfolio code:123456 would like to access client_id: crypto-portfolio your profile and portfolio data. client_secret: secret Approve Resource Server Authorization server client id secret

Other Grant Types Client credentials

Sign-in with OAuth2

The Reasons for OpenID Connect

OAuth2 is for delegated authorization and not designed for authentication.

User Clients Proprietary data User data