Что нам стоит ААА построить?
Oleksii Petrov
Skelia Ukraine / ETWater
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3883667/title-slide.png)
Who am I?
System Architect
Team Lead
PHP Developer
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/2879939/Events_-_3661__3_.png)
Find me on
@alexhelkar
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/2879899/Twitter_logo_blue.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/2879921/skype-icon-logo-62E333BBBA-seeklogo.com.gif)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/2879904/Octocat.png)
alexhelkar
https://github.com/alexhelkar
Identification
Authentication
Authorization
Accounting
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3838882/donkeyshrek.jpg)
Domain
I-A-A-A
Identification
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3873944/i-am-groot-2-i-groot.jpg.jpg)
Identification
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3839599/Coffee-bike.jpg)
Coffee Shops
Coffee Shop: Workflow
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3839619/Canvas_1.png)
Killer Feature
As a
Coffee shop owner
In order to
Give a discounts to returning customers
I want to
Earn more money
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3839649/lambda-architecture-2-800.jpg)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3839660/TALL_-_Black_on_Transparent__1_.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3839667/800px-Cassandra_logo.svg.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3839673/spark-logo-trademark.png)
Coffee Shop:
Discounts Solution
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3839690/Canvas_4.png)
Coffee Shop:
Discounts Solution
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3839697/Canvas_5.png)
Stateless
Coffeeshop
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3839775/Canvas_8.png)
HTTP Cookies (1996)
Cookies: Subsequent Request
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3839785/Canvas_9.png)
Cookies: Embedding data
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3840051/Canvas_11.png)
Where the data lives?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3889031/Canvas_14.png)
Adding Security
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887778/Canvas_15.png)
Adding Security
Subsequent Requests
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887786/Canvas_16.png)
Is that still secure?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887798/Canvas_18.png)
How to protect yourself?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887809/Canvas_19.png)
What if?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3840409/lizard.jpg)
What if?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887836/Canvas_20.png)
Hooray!
We invented Sessions...
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887848/Canvas_21.png)
Now, state is our problem
Now, state is our problem
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887854/Canvas_22.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887857/Canvas_23.png)
Scale: Step 1
Scale: Step 1
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887862/Canvas_24.png)
Scale: Step 2
Shared Cache
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887864/Canvas_25.png)
Scale: Step 2
Scaling the system
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887870/Canvas_26.png)
Scale: Step 3
Distributed Cache
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887871/Canvas_27.png)
Scale: Step 3
Eventual Consistency
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887874/Canvas_28.png)
Scale: Step 4
Sticky Session
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887876/Canvas_29.png)
The Web has changed
(2008)
REST
RIA
SPA
AJAX
![](http://mimimi.tv/wp-content/uploads/2016/03/rukokrylye-zhivnost-mimimi-1536056.jpeg)
![](http://img.playground.ru/images/0/2/poker-face.jpg)
MVC
![](https://hsto.org/getpro/habr/post_images/20f/46b/b6b/20f46bb6becc659da37abe6b7c2481e7.png)
![](https://s.w.org/about/images/logos/wordpress-logo-notext-rgb.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3887961/Joomla-3D-Vertical-logo-light-background-en.png)
![](http://investigacionframework-ustavuad.info/wp-content/uploads/2017/03/zend-500x420.png)
![](http://twodayweb.ru/wp-content/uploads/2016/02/ci-logo.png)
![](http://www.lnwebworks.com/sites/default/files/cakephp.png)
Stateless REST
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3889000/Canvas_31.png)
State Awareness
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3889004/Canvas_32.png)
Plugable storages
We are not asked to save server's state anymore
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3889031/Canvas_14.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3889046/Canvas_33.png)
Easy to scale
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3888079/Canvas_30.png)
What about Identification?
Let's design a Token
ID Token Requirements
Self-contained
Expiration Date
URL-safe
Secure
ID Token Design: Self-contained
{ "exp": "1497052800", "name": "John Doe", "admin": true }
Data
Base64(Data)
ew0KICAiZXhwIjogIjE0OTcwNTI4MDAiLA0KICAibmFtZSI6ICJKb2huIERvZSIsDQogICJhZG1pbiI6IHRydWUNCn0=
{ "alg": "HS256" }
Meta
Passphrase
my-secret-passphrase
ID Token Design: Security
Base64(Data)
ew0KICAiZXhwIjogIjE0OTcwNTI4MDAiLA0KICAibmFtZSI6ICJKb2huIERvZSIsDQogICJhZG1pbiI6IHRydWUNCn0=
ew0KICAiYWxnIjogIkhTMjU2Ig0KfQ==
Base64(Meta)
ID Token Design: Security
HMACSHA256( Base64(Meta).Base64(Data), "my-secret-passphrase" )
d0Ao0wmaXL_X3uxLPL8K58DJvyq7vjbrFJFg85mrMe4
SIGNATURE
Base64(Meta).
Base64(Data).
SIGNATURE
eyJhbGciOiJIUzI1NiJ9.eyJleHAiOiIxNDk3MDUyODAwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.d0Ao0wmaXL_X3uxLPL8K58DJvyq7vjbrFJFg85mrMe4
Hooray!
We invented a
JWT Tokens...
Workflow
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3892811/Canvas_35.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3892814/Canvas_37.png)
HMAC
RSA
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3892815/Canvas_38.png)
A Unicorn?
Real Life Example
Token
![](https://upload.wikimedia.org/wikipedia/commons/4/41/Kiew_Metro_Jeton.jpg)
Authentication Server
![](http://thekievtimes.ua/wp-content/uploads/2014/09/%D0%BA%D0%B0%D1%81%D1%81%D1%8B-%D0%BA%D0%B8%D0%B5%D0%B2%D1%81%D0%BA%D0%BE%D0%B3%D0%BE-%D0%BC%D0%B5%D1%82%D1%80%D0%BE.jpg)
Resourse Server
![](https://gs-img.112.ua/original/2016/10/11/264388.jpg)
The Platform
Issues?
Invalidate a single
Token
Change a JWT Secret Key
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3894047/Kiew_Metro_Jeton.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3894049/____________________________.png)
Create a Blacklist
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3894075/Canvas_40.png)
Shared Cache
Create a Blacklist
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3894076/Canvas_39.png)
Distributed Cache
Short TTL
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3894047/Kiew_Metro_Jeton.png)
Really?
JWT Benefits?
Store on a client?
Session/Local storage could be a security issue
Easier to use?
NO! It's not! Session management is you problem
More secure?
Same as signed cookie. You can sign anything you want
JWT Benefits?
Built-in expiration?
Expiration could be used in ANY server-side implementation
Easier to use?
NO! It's not! Session management is you problem
More secure?
Same as signed cookie. You can sign anything you want
JWT Benefits?
Data goes stale
Any data you put in token will live until expiration date
Tokens invalidation
Impossible to resolve this issue and remain stateless
JUST A TOKEN FORMAT!
JWT just a format for a token as many others out there
How Metro solves their problem?
![](http://kiev.moygorod.ua/img/other/kiev_metro_infotext_images_4.jpg)
+ Blacklist
+ Local cache
on station
+ Eventual
Consistency
+ Central server
https://habrahabr.ru/post/141213/
What to use?
OAuth2
Authentication framework
Bearer Tokens
State stored on a servers
JWT
Could be premature. Hard to keep stateless. (Remember Metro?). Useful in scoped env.
Could migrate later, because clients do not matter
Let's talk microservices
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3894205/microservices.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3894237/poliklinika.jpg)
Real Life Microservices
API Gateway
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3894241/u_11ee0f597da48cc6e08a593cadd4da13_800.jpg)
Microservices
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3894244/medical-doctor-specialist_318-61706.jpg)
Otolaryngologist
Service
Neurologist
Service
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3894248/27715-200.png)
Surgeon
Service
Doctor's Appointment
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3894286/Canvas_41.png)
Do you really think that programmers invented microservices?
API Gateway
(pattern)
Common things...
Rate Limit
Parameters validation
Authorization
Load balancing
Circuit breaker
CORS Headers
IP Restrictions
Usage Limits
Caching
Request Transformer
Response Transformer
How it looks?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895545/Canvas_42.png)
The "Pattern"
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895546/Canvas_43.png)
Not a SPOF
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895547/Canvas_44.png)
Enhance 3rd parties
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895548/Canvas_46.png)
Resell 3rd parties
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895549/Canvas_48.png)
Solutions
![](http://streamdata.io/wp-content/uploads/2015/08/kong-head-272x272.png)
Kong
API Gateway
AWS
API Gateway
Amazon
Mashape
2015
AWS Gateway
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3894624/api-gateway-example.png)
Our case
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895563/Canvas_47.png)
Our case
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895564/Canvas_49.png)
Authorization (V1)
Authenticated Users
Can access only own data
Anonymous Users
Can access only anonymous data by ID
Authorization V2
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895572/Canvas_45.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895574/Canvas_50.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895575/Canvas_51.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895576/Canvas_52.png)
Domain
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895572/Canvas_45.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895574/Canvas_50.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895575/Canvas_51.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895576/Canvas_52.png)
Hierarchy
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895572/Canvas_45.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895574/Canvas_50.png)
Sharing Access
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895572/Canvas_45.png)
Shares Read Access
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895572/Canvas_45.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895574/Canvas_50.png)
Family Access
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895572/Canvas_45.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895572/Canvas_45.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895574/Canvas_50.png)
Company Access
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895572/Canvas_45.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895572/Canvas_45.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895572/Canvas_45.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895572/Canvas_45.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895574/Canvas_50.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895574/Canvas_50.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895574/Canvas_50.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895575/Canvas_51.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/3895575/Canvas_51.png)
Service Accounts
Limited Access to one/multiple companies
Others
Limited Access to one/multiple users
Admin Accounts
Full Access to all accounts
Hierarchical Data
Observations
Users
User Groups
Sharing Concept
Resousrce
{
"name": "User",
"actions": ["User::READ"]
}
Resousrce
{ "name": "User", "actions": ["User::READ"] "actionsToIds":[ "MODIFY": [ "454f99ea0ed23", "ae0381edcb6f6" ] ] }
Resousrce
{ "name": "User", "actions": ["User::READ"] "actionsToIds":[ "MODIFY": [ "454f99ea0ed23", "ae0381edcb6f6" ] ], "children": [ { "name": "Project", "actions": ["Project::REPORTS"] } ] }
User
{
"id": "0e78bce089b43"
}
User
{ "id": "0e78bce089b4" "shared": [ "56a0a8e364ed": [ // Resources list ] ] }
User
{
"id": "0e78bce089b4"
"shared": [
"56a0a8e364ed": [
{
"name": "Project",
"actions": ["Project::REPORTS"] } ] ] }
User
{ "id": "0e78bce089b4" "shared": [ "56a0a8e364ed": [ { "name": "Project",
"actionsToIds": { "Project::REPORTS": [ "80dfd6e7c112" ] } } ] ] }
User
{ "id": "0e78bce089b4" "shared": [ "56a0a8e364ed": [ // Resources list ] ] "usersSharedToMe": [ "8ddc2a735157" ] }
Group
{
"id": "e6443763fa73"
"shared": [
"56a0a8e364ed": [
// Resources list
]
]
"usersSharedToMe": [
"8ddc2a735157"
]
}
Rule of Thumb
Most concrete Authorization Rules should WIN
Collapsing Rules
Collapsing Rules
{ "id": "0e78bce089b4" // USER 1 "shared": [ "56a0a8e364ed": [ // USER 2 { "name": "Project",
"actionsToIds": { "Project::REPORTS": [ // ACTION "80dfd6e7c112" // PROJECT ] } } ] ] }
Collapsing Rules
[
{
"filter": [
"userId": "56a0a8e364ed", // USER 2
"actions": [User::FULL_ACCESS]
]
},
{
"filter": [ "userId": "56a0a8e364ed", // USER 1 "projectId": "80dfd6e7c112", // Resource "actions": [Project::REPORTS] // Action ] } ]
Out of a demo
API Endpoint + Method
Defines scope of ACL rule to be sent
User Groups
ACL Service managing who consist in what group
Resource ID field
Defined in configs
AWS S3 Example
{
"Id": "Policy1487428541537",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1485128492714",
"Action": [
"s3:AbortMultipartUpload",
"s3:CreateBucket",
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::your-bucket/*",
"Principal": "*"
}
]
}
And remember ...
![](http://2.bp.blogspot.com/-RZSaLDdBuTk/T2OP-w4P15I/AAAAAAAABcU/N6ILTDOiyq8/s1600/Dorky%2BDino%2B2.jpg)
There is no Unicorns
out there
Thanks!
Questions?
Find me on
@alexhelkar
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/2879899/Twitter_logo_blue.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/2879921/skype-icon-logo-62E333BBBA-seeklogo.com.gif)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/548786/images/2879904/Octocat.png)
alexhelkar
https://github.com/alexhelkar