AuthZ control

Scenario

In this scenario we will check if a user is allowed to access a resource even though authentication was successful. To do this we use an authenticator process AuthController.

In this use case will will check an LDAP attribute called carLicense for values. If value is correct then the user will get access to application otherwise not.

Notes regarding this Use Case

Here are some information about what is the core of this use case. The key configuration parts, see config.json at the bottom of this use case, are

• Line 122-138 We use a chain, first we authenticate the user. Then we verify if the user should have access to the application

• Line 139-161 This is the first part of the chain where we authenticate the user. If that fails, no authorization is necessary.

• Line 162-179 If authentication was successful, then we move to the second part in the chain. In this case the authenticator AuthController. This authenticator runs a pipe and depending on the result from the pipe, act accordingly on the return data.

• Line 237-301 This is the pipe executed from the AuthController authenticator. We will use the valve FlowFail and verify item data to check if the Pipe should fail. If the Pipe fails the AuthController will act on that.

Prerequisite

• This use case assumes that you have good knowledge of the product in question.

• Fortified ID WEB installed and configured

• LDAP directory. Location to were the users are authenticated. The example code is configured using an Active Directory. We are using mail attribute when authenticating the Active Directory user.

• Create three users in your Active Directory that you can login with. See following example with attribute

• Active Directory user 1

  • displayName: Emma Clarke

  • sAMAccountName: emmac

  • mail: [e-mail] (for example)

  • carLicense: you_can_access (1 value)

• Active Directory user 2

  • displayName: Bobby Clarke

  • sAMAccountName: bobbyc

  • mail: [e-mail] (for example)

  • carLicense: (no values)

• Active Directory user 3

  • displayName: Sara Clarke

  • sAMAccountName: sarac

  • mail: [e-mail] (for example)

  • carLicense: you_can_access, aws (2 values)

• Fortified ID Portal installed and configured

Note. All configuration and testing is done on the scenario server.

Basic configuration of Fortified ID Web and Portal

Install and prepare configuration

1. Download and install Fortified ID Web and Fortified ID Portal

   1. To install Integrity Web and Integrity Portal, see documentation and installation.

2. Add files and folders from ZIP-file to Fortified ID Web and Fortified ID Portal.

   1. Download the USE_CASE.zip.
3. Replace the customer folders for your installations with the ones from the zip-file. Note. This use case was initially done on a Windows server, if you run Container/Docker or Linux you might have to changes something to work in your environments like file paths e.g..

4. Open the globals.json in both customer folders and update to match your environment.

5. Start services

   1. Start Fortified ID WEB

   2. Start Fortified ID Portal

Test the configuration

Verify services are started

• Verify Fortified ID WEB is started

• Verify Fortified ID Portal is started

Login to Fortified ID Portal using Fortified ID WEB as IdP

You will login as the three different users.

First we login in as Emma Clarke

Note. Emma has the right authorization to access the Portal site since she has the value "you_can_access" in carLicense.

1. Open a browser.

2. First we will login as Emma Clarke.

3. Browse to https://localhost:8445/portal

   1. This is the address to Fortified ID Portal acting as a SAML SP

4. Click Username & Password (LDAP), you should now see
5. Login as [e-mail].

6. She should now be redirected to Portal, the application she intended to access.

   1. This is because she has the value "you_can_access" in carLicense

7. Logout from Portal

Secondly we login in as Bobby Clarke

Note. Bobby does not have the right authorization to access the Portal site since he is missing the value "you_can_access" in carLicense. He will be redirected to the site we have configured.

1. Open a browser.

2. First we will login as Bobby Clarke.

3. Browse to https://localhost:8445/portal

   1. This is the address to Fortified ID Portal acting as a SAML SP

4. Click Username & Password (LDAP), you should now see
5. Login as [e-mail]

6. User should now be redirected to specified url since value is incorrect, and is redirected to the Swedish newspaper dn.se.

   1. This is because he do NOT has the value "you_can_access" in carLicense

Thirdly we login in as Sara Clarke

Note. Sara has the right authorization to access the site since she has the value in "you_can_access" in carLicense but she also has "aws" as value. In this scenarion a user with value aws should be redirected to, in this case, aws.com. This means that Sara will not be logged in to the Portal site.

1. Open a browser.

2. First we will login as Sara Clarke.

3. Browse to https://localhost:8445/portal

   1. This is the address to Fortified ID Portal acting as a SAML SP

4. Click Username & Password (LDAP), you should now see
5. Login as [e-mail].

6. She should now be redirected to AWS webpage.

   1. This is because she has the value "you_can_access" but also the value "aws". So she is allowed access but instead of being redirected to Portal we redirect her to aws.com

Complete config.json file of Fortified ID WEB

Other configuration and reference files will be found in the ZIP-file you downloaded.

Complete config.json file

{
    "globals": "@include:globals.json",
    "modules": [
        {
            "name": "CefEventModule",
            "config": {}
        },
        {
            "name": "HttpClient",
            "config": {
                "name": "default",
                "idle_timeout_ms": 5000,
                "connect_timeout_ms": 5000
            }
        },
        {
            "name": "LdapClient",
            "enabled": true,
            "instances": 1,
            "config": {
                "name": "${globals.ldap.ldap1.name}",
                "connection": {
                    "host": "${globals.ldap.ldap1.connection.host}",
                    "port": "${globals.ldap.ldap1.connection.port}",
                    "bind_dn": "${globals.ldap.ldap1.connection.bind_dn}",
                    "bind_password": "${globals.ldap.ldap1.connection.bind_password}",
                    "use_ssl": "${globals.ldap.ldap1.connection.use_ssl}",
                    "ssl_trust_all": "${globals.ldap.ldap1.connection.ssl_trust_all}"
                }
            }
        },
        {
            "name": "SAML",
            "config": {
                "metadata_cache": "${globals.saml.idp1.metadata_cache}",
                "http_port": "${globals.http.port}",
                "http_use_ssl": true,
                "http_keystore_ref": {
                    "type": "${globals.keystore.https.ref.type}",
                    "path": "${globals.keystore.https.ref.path}",
                    "password": "${globals.keystore.https.ref.password}"
                },
                "http_keystore_type": "${globals.keystore.https.type}",
                "http_key_alias": "${globals.keystore.https.http_key_alias}",
                "http_key_password": "${globals.keystore.https.http_key_password}",
                "enable_http": true,
                "metadata_template": [
                    {
                        "id": "${globals.saml.idp1.metadata_id}",
                        "metadata_file_path": "${globals.saml.idp1.metadata_file_path}",
                        "sign_ref": [
                            {
                                "keystore": {
                                    "alias": "${globals.keystore.saml.sign_ref_keystore_alias}",
                                    "key_password": "${globals.keystore.saml.sign_ref_keystore_key_password}",
                                    "password": "${globals.keystore.saml.sign_ref_keystore_password}",
                                    "path": "${globals.keystore.saml.sign_ref_keystore_path}"
                                }
                            }
                        ]
                    }
                ],
                "metadata": [
                    {
                        "path": "${globals.file_paths.base_dir}/config/resources_internal/saml/sp_metadata_files/sp_portal.xml"
                    }
                ]
            }
        },
        {
            "name": "AuthN",
            "enabled": true,
            "config": {
                "context_path": "/authn",
                "webroot_dir": "web",
                "http_port": "${globals.http.port}",
                "http_use_ssl": true,
                "http_keystore_ref": {
                    "type": "${globals.keystore.https.ref.type}",
                    "path": "${globals.keystore.https.ref.path}",
                    "password": "${globals.keystore.https.ref.password}"
                },
                "http_keystore_type": "${globals.keystore.https.type}",
                "http_key_alias": "${globals.keystore.https.http_key_alias}",
                "http_key_password": "${globals.keystore.https.http_key_password}",
                "authenticators": [
                    {
                        "id": "auth00",
                        "type": "SAMLIDP",
                        "config": {
                            "context_path": "/saml/authn/chain",
                            "base_path": "/saml/authn",
                            "expiry": "PT1S",
                            "force_re_auth": false,
                            "idp": "${globals.saml.idp1.idp_entityid}",
                            "chain": [
                                {
                                    "id": "validate_authN_and_authZ_chain",
                                    "required": true
                                }
                            ],
                            "assertion_config": [
                                {
                                    "target_sp": [
                                        "*"
                                    ],
                                    "nameid_parameter": "mail",
                                    "auth_context_parameter": "AuthnContextClassRef",
                                    "additional_attribute_parameter": [
                                        "givenName",
                                        "sn",
                                        "mail",
                                        "roles",
                                        "display_name",
                                        "distinguishedName"
                                    ],
                                    "pre_assertion_pipe": "Retrieve_data_for_SAML_response_for_all"
                                }
                            ]
                        }
                    },
                    {
                        "id": "validate_authN_and_authZ_chain",
                        "type": "Chain",
                        "config": {
                            "base_path": "/saml/authn",
                            "chain": [
                                {
                                    "id": "validate_username_password",
                                    "required": true
                                },
                                {
                                    "id": "validate_access_to_resource",
                                    "required": true
                                }
                            ]
                        }
                    },
                    {
                        "id": "validate_username_password",
                        "type": "UserNameAndPassword",
                        "config": {
                            "base_path": "/saml/authn",
                            "webroot_dir": "web/authenticator/username_password",
                            "overlay_dirs": [
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/2_username_password",
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/0_look_and_feel"
                            ],
                            "pipe_id": "Validate_Username_Password",
                            "exports": [
                                {
                                    "name": "used_auth",
                                    "value": "username_password_ldap"
                                },
                                {
                                    "name": "AuthnContextClassRef",
                                    "value": "urn:oasis:names:tc:SAML:2.0:ac:classes:Password"
                                }
                            ]
                        }
                    },
                    {
                        "id": "validate_access_to_resource",
                        "type": "AuthController",
                        "config": {
                            "base_path": "/saml/authn",
                            "pipe_id": "authz_control_validator",
                            "failed_redirect": [
                                {
                                    "pattern": ".*Do not authorize user.*",
                                    "target": "https://www.dn.se"
                                },
                                {
                                    "pattern": ".*Send user to AWS*",
                                    "target": "https://www.aws.com"
                                }
                            ]
                        }
                    }
                ]
            }
        },
        {
            "name": "Pipes",
            "config": {
                "pipes": [
                    {
                        "id": "Validate_Username_Password",
                        "config": {
                            "valves": [
                                {
                                    "name": "DumpRequest",
                                    "config": {
                                        "label": "*** DumpRequest ***"
                                    }
                                },
                                {
                                    "name": "DumpExports",
                                    "config": {
                                        "label": "*** DumpExports ***"
                                    }
                                },
                                {
                                    "name": "LDAPSearch",
                                    "enabled": true,
                                    "config": {
                                        "destination": "${globals.ldap.ldap1.name}",
                                        "base_dn": "${globals.ldap.ldap1.connection.base_dn}",
                                        "scope": "SUB",
                                        "filter": "mail={{{request.identifier}}}",
                                        "attributes": [
                                            {
                                                "name": "mail",
                                                "multivalue": false
                                            }
                                        ]
                                    }
                                },
                                {
                                    "name": "LDAPBind",
                                    "enabled": true,
                                    "config": {
                                        "destination": "${globals.ldap.ldap1.name}",
                                        "dn": "{{{item.id}}}",
                                        "password": "{{{request.password}}}"
                                    }
                                },
                                {
                                    "name": "DumpState",
                                    "config": {
                                        "label": "*** DumpState ***"
                                    }
                                }
                            ]
                        }
                    },
                    {
                        "id": "authz_control_validator",
                        "config": {
                            "valves": [
                                {
                                    "name": "DumpRequest",
                                    "config": {
                                        "label": "*** DumpRequest ***"
                                    }
                                },
                                {
                                    "name": "DumpExports",
                                    "config": {
                                        "label": "*** DumpExports ***"
                                    }
                                },
                                {
                                    "name": "LDAPSearch",
                                    "enabled": true,
                                    "config": {
                                        "destination": "${globals.ldap.ldap1.name}",
                                        "base_dn": "${globals.ldap.ldap1.connection.base_dn}",
                                        "scope": "SUB",
                                        "filter": "(&(mail={{{exports.username}}})(carLicense=you_can_access))",
                                        "attributes": [
                                            {
                                                "name": "sAMAccountName",
                                                "multivalue": false
                                            },
                                            {
                                                "name": "carLicense",
                                                "multivalue": true
                                            }
                                        ]
                                    }
                                },
                                {
                                    "name": "DumpState",
                                    "config": {
                                        "label": "*** DumpState BEFORE flow fail ***"
                                    }
                                },
                                {
                                    "name": "FlowFail",
                                    "exec_if_expr": "items.length != 1",
                                    "config": {
                                        "message": "Do not authorize user!"
                                    }
                                },
                                {
                                    "name": "FlowFail",
                                    "exec_if_expr": "items[0].carLicense.contains('aws')",
                                    "config": {
                                        "message": "Send user to AWS"
                                    }
                                },
                                {
                                    "name": "DumpState",
                                    "config": {
                                        "label": "*** DumpState AFTER flow fail ***"
                                    }
                                }
                            ]
                        }
                    },
                    {
                        "id": "Retrieve_data_for_SAML_response_for_all",
                        "config": {
                            "valves": [
                                {
                                    "name": "DumpRequest",
                                    "config": {
                                        "label": "*** DumpRequest från DumpData Portal****"
                                    }
                                },
                                {
                                    "name": "DumpExports",
                                    "config": {
                                        "label": "*** DumpExports från DumpData Portal****"
                                    }
                                },
                                {
                                    "name": "ExportsPut",
                                    "exec_if_expr": "exports.used_auth == ('username_password_ldap')",
                                    "enabled": true,
                                    "config": {
                                        "name": "LDAP_search_filter",
                                        "value": "mail={{{request.username}}}",
                                        "replace": true
                                    }
                                },
                                {
                                    "name": "LDAPSearch",
                                    "enabled": true,
                                    "config": {
                                        "destination": "${globals.ldap.ldap1.name}",
                                        "base_dn": "${globals.ldap.ldap1.connection.base_dn}",
                                        "scope": "SUB",
                                        "filter": "{{{exports.LDAP_search_filter}}}",
                                        "attributes": [
                                            {
                                                "name": "givenName",
                                                "multivalue": false
                                            },
                                            {
                                                "name": "sn",
                                                "multivalue": false
                                            },
                                            {
                                                "name": "sAMAccountName",
                                                "multivalue": false
                                            },
                                            {
                                                "name": "mail",
                                                "multivalue": false
                                            },
                                            {
                                                "name": "displayName",
                                                "multivalue": false
                                            },
                                            {
                                                "name": "distinguishedName",
                                                "multivalue": false
                                            }
                                        ]
                                    }
                                },
                                {
                                    "name": "ExportsPut",
                                    "enabled": true,
                                    "config": {
                                        "name": "username",
                                        "value": "{{{item.mail}}}",
                                        "replace": true
                                    }
                                },
                                {
                                    "name": "ItemPropertyAdd",
                                    "enabled": true,
                                    "config": {
                                        "name": "display_name",
                                        "value": "{{{item.displayName}}}"
                                    }
                                },
                                {
                                    "name": "DumpExports",
                                    "config": {
                                        "label": "*** DumpExports****"
                                    }
                                },
                                {
                                    "name": "DumpState",
                                    "config": {
                                        "label": "*** DumpState ***"
                                    }
                                }
                            ]
                        }
                    }
                ]
            }
        }
    ]
}