Openid Connect Based Authentication for Host Remote Access
Total Page：16
File Type：pdf, Size：1020Kb
Masaryk University Faculty of Informatics OpenID Connect Based Authentication for Host Remote Access Master’s Thesis Bc. Ondřej Velíšek Brno, Fall 2018 Masaryk University Faculty of Informatics OpenID Connect Based Authentication for Host Remote Access Master’s Thesis Bc. Ondřej Velíšek Brno, Fall 2018 This is where a copy of the official signed thesis assignment and a copy ofthe Statement of an Author is located in the printed version of the document. Declaration Hereby I declare that this paper is my original authorial work, which I have worked out on my own. All sources, references, and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Bc. Ondřej Velíšek Advisor: RNDr. Michal Procházka, Ph.D. i Acknowledgements I would first like to thank my thesis advisor RNDr. Michal Procházka, Ph.D. for his leadership, provided motivation and steering me in the right direction whenever he thought I needed it. Thank you. I would also like to thank the colleagues and backers who sup- ported me. Namely, Anna Schneiderová, Ing. Jaroslav Rozman, Ph.D., Klára Ajašová, Kryštof Michal and Milan Kramárik. I am gratefully indebted to them for their valuable comments on this thesis. Finally, I must express my very profound gratitude to my par- ents for providing me with unfailing support and continuous encour- agement throughout my years of study and through the process of researching and writing this thesis. iii Abstract This thesis proposes three authentication architecture designs using OpenID Connect identity provider in a distributed environment. It fo- cuses on the secure authorization delegation use-case which is demon- strated on the SSH protocol. Each of the architecture designs is evalu- ated regarding security, interoperability, easy adoption and usability and compared with existing authentication methods. Prototypes of each architecture were implemented and tested to verify theoretic statements and feasibility of the proposed designs. iv Keywords OpenID Connect, OAuth 2.0, authentication, authorization, delegation, remote access, ssh, secure shell v Contents Introduction 1 Research Objectives . .1 Text Structure . .2 1 OAuth 2.0 Framework 3 1.1 OAuth 2.0 ...........................3 1.1.1 Authorization Code Flow . .4 1.1.2 Device Code Flow . .6 1.1.3 Best Current Practice for Native Apps . .7 1.1.4 Client Identification . .9 1.1.5 Dynamic Client Registration . .9 1.2 OpenID Connect 1.0 ..................... 10 2 Secure Shell 11 2.1 Pluggable Authentication Interfaces ............. 11 2.1.1 Keyboard Interactive . 11 2.1.2 Generic Security Services API . 12 2.2 SSH Agent .......................... 14 2.2.1 Agent Forwarding . 15 3 Definition of Model Environment 17 3.1 Administrative Units ..................... 17 3.2 Hardware Components .................... 17 3.3 Software Components ..................... 18 3.4 Components Responsibility .................. 19 4 Existing Authentication Methods 21 4.1 Resource owner password flow ................ 21 4.2 Copy-paste method ...................... 21 4.3 OIDC Agent ......................... 22 4.4 Kerberos ............................ 22 4.5 Cyclone PAM ......................... 24 4.6 Guardian Agent ........................ 25 4.7 Conclusion .......................... 26 5 Authorization Code Agent Extension 27 vii 5.1 Motivation .......................... 27 5.2 Environment Setup ...................... 28 5.3 Authorization Process ..................... 29 5.4 Prototype Implementation .................. 30 5.5 Easy Adoption and Interoperability Consideration ...... 30 5.6 Security Consideration .................... 31 5.6.1 Access Gained by Intermediate Client . 31 5.6.2 Centralized Credentials in Agent . 32 5.7 Usability Consideration .................... 32 5.7.1 Initial Setup . 32 5.7.2 Authorization Process . 33 5.8 Conclusion .......................... 33 6 Authentication Architecture Proposals 35 6.1 OAuth2 GSS-API mechanism ................ 35 6.1.1 Environment Setup . 35 6.1.2 Authentication Process . 36 6.1.3 Separated Resource Server Modification . 38 6.1.4 Prototype Implementation . 40 6.1.5 Easy Adoption and Interoperability Consideration 40 6.2 OIDC GSS-API mechanism ................. 41 6.2.1 Environment Setup . 41 6.2.2 Authentication Process . 42 6.2.3 Prototype Implementation . 44 6.2.4 Easy Adoption and Interoperability Consideration 44 6.3 Device Code PAM ....................... 44 6.3.1 Environment Setup . 45 6.3.2 Authentication Process . 46 6.3.3 Prototype Implementation . 47 6.3.4 Easy Adoption and Interoperability Consideration 48 7 Quality Attribute Comparison 49 7.1 Security Consideration .................... 49 7.1.1 Access Gained by Intermediate Client . 49 7.1.2 Access Gained by Remote Server . 51 7.1.3 Conclusion . 53 7.2 Usability Consideration .................... 53 7.2.1 Initial Setup . 54 viii 7.2.2 Authentication Process . 55 7.2.3 Conclusion . 58 8 Conclusion 59 8.1 Research Contributions .................... 59 8.2 Future Work .......................... 60 Bibliography 61 A Content of Attached Archive 67 B Authentication Process Illustration 69 B.1 OAuth2 GSS-API Mechanism ................ 69 B.2 OIDC GSS-API Mechanism ................. 72 B.3 Device Code PAM ....................... 75 ix List of Figures 1.1 Sequence diagram of OAuth2 abstract flow 4 1.2 Sequence diagram of OAuth2 authorization code flow 5 1.3 Sequence diagram of OAuth2 device code flow 6 1.4 Sequence diagram of authorization code flow for native apps 8 2.1 Sequence diagram of PAM authentication method in SSH context 12 2.2 Sequence diagram of simplified GSS-API authentication method in SSH context 13 2.3 Sequence diagram of SSH agent protocol 14 2.4 Component diagram of SSH agent forwarding 15 3.1 Deployment diagram of model architecture 18 3.2 Diagram illustrating relation between OAuth2 roles and software components of model architecture 19 4.1 Sequence diagram of simplified Kerberos authentication process in SSH environment 23 4.2 Sequence diagram of Cyclone PAM authentication process 24 4.3 Sequence diagram of simplified SSH authentication process with Guardian agent 25 5.1 Deployment diagram of OAuth2 agent in model environment 28 5.2 Sequence diagram of OAuth2 agent authorization process 29 6.1 Deployment diagram of OAuth2 GSS-API mechanism in model environment 36 6.2 Sequence diagram of authentication process with OAuth2 GSS-API mechanism 37 6.3 Sequence diagram of authentication process with OAuth2 GSS-API mechanism with separated resource server modification 39 6.4 Deployment diagram of OpenID Connect GSS-API mechanism in model environment 42 xi 6.5 Sequence diagram of authentication process with OpenID Connect GSS-API mechanism 43 6.6 Deployment diagram of Device code PAM in model environment 45 6.7 Sequence diagram of authorization process with Device code PAM 46 B.1 Initial state in authentication process with OAuth2 GSS-API mechanism 69 B.2 IdP selection in authentication process with OAuth2 GSS-API mechanism 70 B.3 Authentication to Google in authentication process with OAuth2 GSS-API mechanism 70 B.4 Consent screen in authentication process with OAuth2 GSS-API mechanism 71 B.5 Successful access to remote machine in authentication process with OAuth2 GSS-API mechanism 71 B.6 Initial state in authentication process with OIDC GSS-API mechanism 72 B.7 IdP selection in authentication process with OIDC GSS-API mechanism 73 B.8 Authentication to Google in authentication process with OIDC GSS-API mechanism 73 B.9 Authorization consent in authentication process with OIDC GSS-API mechanism 74 B.10 Successful access to remote machine in authentication process with OIDC GSS-API mechanism 74 B.11 Initial state in authentication process with Device code PAM 75 B.12 Verification prompt in authentication process with Device code PAM 76 B.13 IdP selection in authentication process with Device code PAM 76 B.14 Authentication to Google state in authentication process with Device code PAM 77 B.15 Authorization consent in authentication process with Device code PAM 77 xii B.16 Successful client authorization in authentication process with Device code PAM 78 B.17 Successful access to remote machine in authentication process with Device code PAM 78 xiii Introduction The Internet has become a standard way how users consume services nowadays. There are many service providers, and users often consume multiple services across various of them. Since many of them were developed independently, they use their own identity management systems. It became a usability and security issue because users had to manage credentials for each provider. Therefore centralized identity providers with a single sign-on1 mechanism were used to mitigate this issue [1]. One of the provided services is a cloud computing [2, 3] which enables a user to instantiate virtual machines and access other services from them. It becomes a challenge to provide a single sign-on mech- anism in such a distributed environment [4]. For example, he/she wants to access storage supplied by one provider from the virtual machine provided by the second one. In this case, the intermediate machine and therefore the cloud infrastructure receives credentials authorizing it to access the final service. Depending on the credential it might be a security issue [5]. I refer to this use-case further as an authorization delegation use-case. Some of the existing authentication methods used in a cloud envi- ronment have already satisfied this use-case. As an example, consider