Notes - MCS
Identification, Authentication and Authorization
Notes - MCS
Identification, Authentication and Authorization
  • Identification, Authentication and Authorization
  • Access Control Models
    • Access types
    • Least privilege principle
    • Access control models
      • Access control kinds
    • Access control kinds
    • Separation of duties
    • Segregation of duties
    • Information flow models
    • Multilevel security
    • Windows mandatory integrity control
    • Clark-Wilson Integrity Model
  • OAuth 2.0 Authorization Framework
    • Goal
    • Roles (RFC 6749)
    • Communication endpoints
    • Application (client)
    • OAuth tokens
    • OAuth flows
      • Code flow
      • Implicit flow
      • Resource owner password flow
      • Client credentials flow
    • Proof Key for Code Exchange (PKCE, RFC 7636)
    • Device authorization grant (RFC 8628)
    • Actual protocol flow
  • Linux Security Mechanisms
    • Mechanisms
    • Linux management privileges
    • Privilege Elevation
    • Capabilities
    • Files extended attributes (xattr)
    • File capabilities
    • Capability transfer across exec
    • Control groups (cgroups)
    • Linux Security Modules (LSM)
    • AppArmor
    • Confinement
  • Authentication Protocols
    • Identity attributes
    • Authentication
    • Authentication interactions
    • Authentication of people
      • Biometrics
      • Token-based OTP generators
      • PAP & CHAP (RFC 1334, 1992, RFC 1994, 1996)
      • S/Key (RFC 2289, 1998)
      • GSM
    • Host authentication
    • Service/server authentication
    • TLS (Transport Layer Security, RFC 8446)
    • SSH (Secure Shell, RFC 4251)
    • Single Sign-On (SSO)
    • Authentication metaprotocols
    • Authentication services
    • Key distribution services
  • PAM (Pluggable Authentication Modules)
    • Motivation
    • PAM
    • PAM APIs
    • Orchestration of PAM actions
    • Module invocation
    • Configuration files
    • PAM orchestration files
    • Scenario 1 – Local authentication
    • Scenario 2 – LDAP auth with local backoff
    • Scenario 3 – MS AD auth with local backoff
  • FIDO and FIDO2 framework
    • FIDO (Fast Identity Online) Alliance
    • Universal 2nd Factor (U2F) protocol
    • WebAuthn
    • Client to Authenticator Protocol (CTAP)
    • Passkeys
  • Authentication with Trusted Third Parties / KDCs
    • Shared-key authentication
    • Key Distribution Center (KDC) concept
    • Kerberos
  • Identity Management
    • Digital Identity
    • Identity Manager (IdM)
    • Identity Provider (IdP)
    • Authoritative source
    • Identity claim
    • Approachs
    • Credential
    • Privacy issues
    • Verifiable credential (VC)
    • Self-Sovereign Identity (SSI)
    • Interoperability
    • eIDAS
  • Anonymity and Privacy
    • Privacy
    • IEEE Digital Privacy Model
    • Privacy with computing technology
    • Privacy and companies
    • Privacy and IAA
    • Identification
    • Authentication
    • Anonymity
    • Microdata privacy issues
    • Microdata privacy enhancing
    • L-Diversity
Powered by GitBook
On this page
  • 1. Isolated, or Silo-oriented IdM
  • Per-service IdM
  • Identity attributes are not shared among services
  • 2. Aggregated IdM
  • One IdM for several services
  • Usually explored with a central IdP
  • Services rely on the IdP
  • 3. Federated identity
  • Goal
  • Use case: organizations share identity management
  • Organizations agree on using federated identities
  • 4. Claim-based identity management
  1. Identity Management

Approachs

Last updated 12 months ago

1. Isolated, or Silo-oriented IdM

Per-service IdM

No relation between services in the organization (or world).

Identity attributes are not shared among services

Duplication:

  • Each person would have an identity profile on each service.

  • Each service must ensure proper protection mechanisms.

Not scalable for users, nor user-friendly:

  • Unless you use the same identifiers and authentication credentials.

But possibly better against identity theft!

  • Unless you use the same identifiers and authentication credentials…

Onboarding and Offboarding issues:

  • Need to provision/remove/disable identities across all services.

2. Aggregated IdM

One IdM for several services

A single profile for each entity:

  • Each profile contains the union of all attributes required by all services.

  • More efficient management, onboarding and offboarding.

Each service uses only the attributes it needs.

Usually explored with a central IdP

To centralize the authentication of profile owners.

To provide assertions with identity claims.

Services rely on the IdP

Relying Parties (RPs).

3. Federated identity

Concept that encompasses a common set of policies, practices and protocols to manage identity across organizations.

Goal

Enable an entity to access a service of an organization with a set of identity claims provided by one or more trustworthy third-party IdMs.

Use case: organizations share identity management

Entity@DomainA accesses system@DomainA and Entity@DomainA accesses system@DomainB.

Organizations agree on using federated identities

Single source of Identities for all Organizations.

Can use an independent IdP or accept users from any participant.

4. Claim-based identity management

Multi-IdP identity claims’ provisioning.

The service provider asks for several identity attributes.

  • As identity claims.

  • And proposes alternative IdMs.

Service client uses one or more IdMs to get all the necessary identity claims.

  • Usually no more than one.