OWASP TOP 1
https://owasp.org/Top10/
Broken Access Control
Slide 15
Slide 15 text
In the beginning…
RBAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
if (user.role === "admin")) {
// delete customer
// return 204
} else {
// return 403
}
select role from users
where userId == {uid};
Slide 16
Slide 16 text
In the beginning…
RBAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
if (user.role === "admin")) {
// delete customer
// return 204
} else {
// return 403
}
select role from users
where userId == {uid};
Slide 17
Slide 17 text
In the beginning…
RBAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
if (user.role === "admin")) {
// delete customer
// return 204
} else {
// return 403
}
select role from users
where userId == {uid};
Slide 18
Slide 18 text
In the beginning…
RBAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
if (user.role === "admin")) {
// delete customer
// return 204
} else {
// return 403
}
select role from users
where userId == {uid};
Slide 19
Slide 19 text
In the beginning…
RBAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
if (user.role === "admin")) {
// delete customer
// return 204
} else {
// return 403
}
select role from users
where userId == {uid};
Slide 20
Slide 20 text
Finer Grained Authorization
Slide 21
Slide 21 text
I want to use attributes from subject and object…
ABAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && !customer.subscribed)) {
// delete customer
// return 204
} else {
// return 403
}
select department from users
where id == {uid};
select subscribed from customers
where id == {cid};
Slide 22
Slide 22 text
I want to use attributes from subject and object…
ABAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && !customer.subscribed)) {
// delete customer
// return 204
} else {
// return 403
}
select department from users
where id == {uid};
select subscribed from customers
where id == {cid};
Slide 23
Slide 23 text
I want to use attributes from subject and object…
ABAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && !customer.subscribed)) {
// delete customer
// return 204
} else {
// return 403
}
select department from users
where id == {uid};
select subscribed from customers
where id == {cid};
Slide 24
Slide 24 text
I want to use attributes from subject and object…
ABAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && !customer.subscribed)) {
// delete customer
// return 204
} else {
// return 403
}
select department from users
where id == {uid};
select subscribed from customers
where id == {cid};
Slide 25
Slide 25 text
I want to use attributes from subject and object…
ABAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && !customer.subscribed)) {
// delete customer
// return 204
} else {
// return 403
}
select department from users
where id == {uid};
select subscribed from customers
where id == {cid};
Slide 26
Slide 26 text
I want to use attributes from subject and object…
ABAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && !customer.subscribed)) {
// delete customer
// return 204
} else {
// return 403
}
select department from users
where id == {uid};
select subscribed from customers
where id == {cid};
Slide 27
Slide 27 text
I want to know who did what…
DELETE /customers/{id}
// log: cookie.userId requesting authz to delete customer
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && customer.unsubscribed)) {
// log: cookie.userId authorized to delete customer
// delete customer
// return 204
} else {
// log: cookie.userId unauthorized to delete customer
// return 403
}
select department from users
where id == {uid};
select unsubscribed from customers
where id == {cid};
Slide 28
Slide 28 text
I want to know who did what…
DELETE /customers/{id}
// log: cookie.userId requesting authz to delete customer
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && customer.unsubscribed)) {
// log: cookie.userId authorized to delete customer
// delete customer
// return 204
} else {
// log: cookie.userId unauthorized to delete customer
// return 403
}
select department from users
where id == {uid};
select unsubscribed from customers
where id == {cid};
Slide 29
Slide 29 text
I want to know who did what…
DELETE /customers/{id}
// log: cookie.userId requesting authz to delete customer
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && customer.unsubscribed)) {
// log: cookie.userId authorized to delete customer
// delete customer
// return 204
} else {
// log: cookie.userId unauthorized to delete customer
// return 403
}
select department from users
where id == {uid};
select unsubscribed from customers
where id == {cid};
Slide 30
Slide 30 text
I want it to be reliable and fast…
DELETE /customers/{id}
// log: cookie.userId requesting authz to delete customer
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && customer.unsubscribed)) {
// log: cookie.userId authorized to delete customer
// delete customer
// return 204
} else {
// log: cookie.userId unauthorized to delete customer
// return 403
}
select department from users
where id == {uid};
select unsubscribed from customers
where id == {cid};
Example Architecture
3. get user and
customer data
2. can user
delete customer?
1. can user
delete customer?
Manage Policies
PAP
Policy
Decision
Point
Policy
Information
Point
6. delete customer
5. user is
authorized
Policy Repository
Customer
Service
4. evaluate policy
Slide 40
Slide 40 text
Advantages
• Easier to understand what authorization logic applies
• Authorization change management is simpler than having it in code
• Auditing is implemented outside of business logic
Slide 41
Slide 41 text
Disadvantages
• Requires operating more components
Slide 42
Slide 42 text
Disadvantages
• Requires operating more components
• Does not handle storage of authz data
• 👉 latency + reliability + scale
• 👉 collaboration scenarios
•
Slide 43
Slide 43 text
Approach #2: "Zanzibar"
Slide 44
Slide 44 text
Zanzibar
Not this one…
Slide 45
Slide 45 text
Google Zanzibar
https://research.google/pubs/pub48190/
For others to use
(disclaimer: I work on Project "Sandcastle")
Project "Sandcastle"
Slide 51
Slide 51 text
DEMO
Slide 52
Slide 52 text
Architecture
Sandcastle in "PDP Mode"
2. check(user, delete, customer)
1. can user
delete customer?
Customer Service
PDP
Sandcastle
4. delete customer
3. user is authorized
nginx
Slide 53
Slide 53 text
Enforcement
Slide 54
Slide 54 text
Advantages
• Auditing is part of "aaS"
• Authorization change management is simpler than having it in code
• Easier to understand what authorization logic applies
• Multi-region and operated by someone else
Slide 55
Slide 55 text
Disadvantages
• Many things are a relationship, but not everything (e.g. time of day)
Slide 56
Slide 56 text
Approach #3: Combined
Slide 57
Slide 57 text
Architecture
Sandcastle in "PIP Mode"
4. check(user,
delete, customer)
2. can user
delete customer?
1. can user
delete customer?
Manage Policies
Distribute Policies
PAP
PDP
PIP
Sandcastle
6. delete customer
5. user is authorized
Policy Repository
3. evaluate policy
Slide 58
Slide 58 text
Final Thoughts
Slide 59
Slide 59 text
Resources
Slide 60
Slide 60 text
Project “Sandcastle"
Dev Community Preview Waitlist
shorturl.at/hkouS