Account Management System

Details about the architecture and function of the Account Management System

Transcript

1. Account Management System James Crowley
2. AMS: What Does it Do? • Password synchronization • Password reset • Password expiration
3. Shouldn't that be 'Password Management System'? • Originally designed for alumni opt-in (gmail) • Manages account access • Could add more features in the future
4. AMS in Two Pieces - Front End • Standalone web application • Authenticates to AD ◦ Or google for gmail-only accounts • Provides functionality to user ◦ Password change/sync ◦ Password reset options ◦ Password reset
5. AMS in Two Pieces - Front End AMS AD Google (AMS DB)
6. Front End - Note About Accounts • No such thing as an AMS 'account' ◦ Database entry used to record info ▪ reset options ▪ expiration ◦ If not present when user first logs in, one will be created at that time
7. AMS in Two Pieces - Back End • Various actions, initiated through several different interfaces (AMS, it-tools, cron) ◦ Performs password sync ◦ Issues and verifies reset codes ◦ Sends password expiration notices ◦ Enforces password expiration
8. AMS in Two Pieces - Back End AMS Back End Netware GWDM3 AD SunAdmi n Google (AMS DB) it-tools cron AMS Front End mailhub twilio
9. Password Sync • Active Directory is considered authority ◦ If pass can't be synced to AD, we will not sync to other servers • Everytime the user provides their password ◦ Validate against other servers ◦ Attempt to resync upon failure
10. Password Policy • Minimum eight characters • 10,000 password blacklist (most are too short anyway) • Entropy rating to encourage reasonably strong passwords
11. What Do We Send? • Plaintext to AD, GWDM3, Netware (ssl) • Sha1 hash to Google • Blowfish hash to Sun Admin
12. What Do We Store? • Blowfish hash, random salt, 1024 rounds ◦ This is how we prevent passwords from being re- used ◦ This also allows us to re-sync to Sun Admin without user intervention
13. No Re-Sync for Normal Accounts. • Would require storing plaintext and/or weakly hashed passwords • Can only resync when user provides plaintext
14. Password Reset • Send code to alternate email or SMS ◦ Random shuffle of lowercase letters - (a,e,i,o,u,y,l), first 5 characters ◦ Code valid for 12 minutes, with a 2 minute penalty for each failed attempt ◦ Also limit codes sent to 4 per hour
15. Password Reset • Also support challenge questions ◦ Somewhat hidden (intentionally) to dissuade users from using this option ◦ It's working (only 10 have set up questions)
16. Password Expiration • Enforced for active students, staff, faculty • Expiration every ◦ 185 days for user-initiated changes ◦ 35 days for newly created users ◦ 13 days for password resets • Email warnings at 14, 7, and 2 days • Expirations are enforced by pushing randomized pass to all servers
17. Stats Users in new system 3240 (57%) Set up password recovery option 1517 (27%) Set up password recovery questions 10
18. Questions?