Darin Gordon

PyGotham 2016

Based On

Authentication

Authorization

Session Management

All Through A Common API

Why

?

Security is a High Priority for my Projects

Looking For Support for RBAC policies

  • Scalable
  • Integrates with any kind of application
  • Trusted

Friends don't let Friends Roll their Own

Evolved over more than 10 years of production use, but written in Java

Yosai began a port of Apache Shiro v2 alpha, but took on its own unique identity

Goal of This Presentation

Showcase Few of the Main Features

Use Yosai to Secure a Web Application

  • Authentication
  • Authorization

NOT a talk about web app development

(I will include the app with upcoming release)

Pluggable Security

Web Integration Requires:

  1. Yosai instance accessible throughout the app
  • Using Yosai's threadlocals api
  • Using global registry of web app

2. Yosai hooks into the request/response workflow

Details will be provided with upcoming release!

Demo Project

Goal:  A Real-world, Practical Use of Yosai

Medical Prescription Workflow

- a much more simplified version

Medical Prescription Workflow

Actors

Activities

Security Requirements (Controls)

Physicians, Nurse Practitioners, Patients

  • Writing Prescriptions
  • Requesting Prescription Renewals
  • Approving Rx Renewal Requests
  • Who can use the system
  • How the system is used

Medical Prescription Workflow

Step 1

User logs into the application

Step 2

Role-based nav elements get rendered

Step 3

User navigates, performs activities constrained by authorization policy

User Identification

We need to control WHO

can use the system

Authentication

Verifying that a user is

who it claims to be

Password-based Authentication


current_user = Yosai.get_current_subject()

authc_token = UsernamePasswordToken(username='patient123', 
                                    credentials='pygotham')
try:
    current_user.login(authc_token)

except AuthenticationException:
    ...

Password-based Authentication in a Web Application (Pyramid)

    
    @view_config(route_name='login', renderer='../templates/login.jinja2')
    def login(request):

        login_form = LoginForm(request.POST, context={'request': request})

        if request.method == "POST" and login_form.validate():

            authc_token = UsernamePasswordToken(username=login_form.username.data,
                                                                                         password=login_form.password.data)

            try:
                subject = Yosai.get_current_subject()
                subject.login(authc_token)

                next_url = request.route_url('launchpad')
                return HTTPFound(location=next_url)

            except AuthenticationException:
                request.session.flash('Invalid Login Credentials.')
                return {'login_form': login_form}

        else:
            return {'login_form': login_form}

Secure Access Control

We need to control HOW

the system is used

Authorization

Rules and mechanisms govening who can do what

Terminology

"Do This to That"

A Permission

A Role

(Group of Permissions)

Yosai evaluates roles and permissions to answer questions:

  •  Is the user a member of [any, all] of these roles?
  • Does the user have [any, all] of these permissions?

Yosai Enables

Role Based Access Control

Yosai uses Permissions, which are derived from
 an RBAC data model

Customized RBAC data models can be very powerful!

  • hierarchical
  • scoped
  • enforce least privilege

RBAC Fundamentals

Core RBAC

Hierarchical RBAC

Authorization Policy

(Medical Prescription Workflow)

Nurse Practitioner

Physician

Patient

  • Write Prescriptions
  • Approve Prescription Renewals
  • Write Prescriptions for a particular type of medicine only
  • Request Prescription Renewals

RBAC Data Model Example

(Prescription Writing)

A user may write a prescription for any medicine if the user is a physician

1) Membership of the physician role
2) write-prescription permission assigned to physician role

A user may write a prescription only for a 
particular medicine if the user is a nurse practitioner

1) Membership of the nurse_practitioner role
2) write-prescription-medicineid permission assigned to nurse_practitioner role

Prescription Writing Authorization

Declarative Authz


@requires_permission(['prescription:write'])
@view_config(route_name='write_rx', renderer='../templates/write_rx.jinja2')
def write_rx(request):

    write_rx_form = WriteRXForm(request.POST, context={'request': request})

    if request.method == "POST" and write_rx_form.validate():

        current_user = Yosai.get_current_subject()

        create_rx(current_user, . . . )

        next_url = request.route_url('write_rx')
        return HTTPFound(location=next_url)

    else:

        return {'write_rx_form': write_rx_form}

Declarative Authz


@requires_dynamic_permission(['prescription:write:{medicine}'])
@view_config(route_name='write_rx', renderer='../templates/write_rx.jinja2')
def write_rx(request):

    write_rx_form = WriteRXForm(request.POST, context={'request': request})

    if request.method == "POST" and write_rx_form.validate():

        current_user = Yosai.get_current_subject()

        create_rx(current_user, . . . )

        next_url = request.route_url('write_rx')
        return HTTPFound(location=next_url)

    else:

        return {'write_rx_form': write_rx_form}

Prescription Writing Authorization

Imperative Authz

@view_config(route_name='write_rx', renderer='../templates/write_rx.jinja2')
def write_rx(request):

    write_rx_form = WriteRXForm(request.POST, context={'request': request})

    if request.method == "POST" and write_rx_form.validate():

        current_user = Yosai.get_current_subject()
        
        medicine = request.matchdict['medicine']
        permission = 'prescription:write:' + medicine

        try:
            current_subject.check_permission([permission])
        except AuthorizationException:
            print('Not Permitted')
        else:
            create_rx(current_user, . . . )
               . . . .

Prescription Writing Authorization

... and that's only ONE scenario!

  • Write Prescriptions
  • Approve Prescription Renewals
  • Write Prescriptions for a particular type of medicine only
  • Request Prescription Renewals

Each activity has a unique access control requirement

(but the approach remains the same)

Project Status

First Milestone:  release v0.1  end of March 2016

http://yosaiproject.github.io/yosai

  • Project Web Site
  • pypi release

Next Milestone:  release v0.2  (ETA Sept 2016)

  • Fully functional yosai.web library
    • CSRF and Flash messages in Sessions
  • pyramid_yosai
  • Fully functional demo
  • Some refactoring:  API and serialization

Questions?

Made with Slides.com