Skip to content

Latest commit

 

History

History
119 lines (105 loc) · 5.21 KB

authentication-identities.md

File metadata and controls

119 lines (105 loc) · 5.21 KB
Raw

Authentication Identities

When a user authenticates with CredHub, we must establish an identity based on the provided authentication token or certificate. This identity is used by CredHub for the provision and enforcement of access control and operation logging. The following sections describe the scheme of an identity as well as the values for each component by authentication method.

Identity Scheme

Authentication identities in CredHub must capture the appropriate level of detail to distinguish the type of authentication, scope within the authority (where applicable) and primary identifier. This multi-level scheme prevents collisions between identifiers and disallows a trusted authority of a different type from issuing an identity credential that is managed by a different authority.

Scheme: auth_type:scope/primary_identifier
Example: uaa-user:zone1/2ae1621a-bb35-4bb7-946a-4761d3b16a04

  • auth_type - The auth_type identifies the type of authentication granted. For example, a uaa-user is separated from a uaa-client or mtls-app.
  • scope - Some authentication method, e.g. UAA, provide multi-tenancy in a single server. Between scopes, a user name or other identifier may be duplicated. NOTE: Scopes have not yet been implemented for any authentication types.
  • primary_identifier - This value provides the unique identifier of the authenticated user.

Primary Identifiers

Type: Mutual TLS Client Credentials - Apps

Considerations - The instance guid is the most specific identifier of an application. This identifier is specific to an individual container or instance of a deployed application. The app guid is a common identifier for all instances of an application. To align with the specificity of a service bind request and general expectation of common access between instances, the app guid is used as the primary identifier. The app guid is generated by Cloud Foundry during app creation.
Identity - app guid
Example - mtls-app:fdbeb2d4-b601-4a0d-91e8-7e38dde426f7

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            10:b0:75:a6:94:d9:3f:30:4e:42:69:25:a0:28:9b:0c:20:43:1b:40
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=CredHub CA
        Validity
            Not Before: Mar 22 22:18:16 2017 GMT
            Not After : Mar 23 22:18:16 2017 GMT
        Subject: CN=072cae6e-988d-4738-b03c-aef009d8a4f2, OU=app:fdbeb2d4-b601-4a0d-91e8-7e38dde426f7
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
                    00:b8:d5:13:ea:ae:a7:d6:16:0e:24:75:82:c6:50:
                    ...
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                59:67:83:E0:CF:F7:11:3A:7B:6B:EB:56:2F:77:41:13:BC:79:1E:15
            X509v3 Authority Key Identifier:
                5f:f6:b3:9e:0b:b1:80:34:43:1d:92:4f:bf:a1:b3:5d:c6:a4:94:e5
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE

Type: UAA password Grant

Considerations - The user_id is a unique static guid identifier generated by UAA when a user account is created. The user_name is also static, however, if an account is deleted, a new user may be created with the previous user_name. For this reason, the generated user_id will be used as the primary identifier.
Identity - user_id
Example - uaa-user:2ae1621a-bb35-4bb7-946a-4761d3b16a04

{
  "jti": "d86ca7f2df62293596acd9d600b8519b",
  "sub": "2ae1621a-bc35-41b7-946a-4761d3b16a04",
  "scope": [
    "credhub.write",
    "credhub.read"
  ],
  "client_id": "credhub_cli",
  "cid": "credhub_cli",
  "azp": "credhub_cli",
  "revocable": true,
  "grant_type": "password",
  "user_id": "2ae1621a-bb35-4bb7-946a-4761d3b16a04",
  "origin": "uaa",
  "user_name": "example_user",
  "email": "user@example.com",
  "auth_time": 1484085887,
  "rev_sig": "f7810179",
  "iat": 1484085889,
  "exp": 1484085904,
  "iss": "https://uaa.example.com/oauth/token",
  "zid": "uaa",
  "aud": [
    "credhub_cli"
  ]
}

Type: UAA client_credentials Grant

Considerations - A client_credentials grant does not provide a generated guid in the same way as a password grant. The primary identifier for this grant type is the user-specified client_id. This does not change and is guaranteed to be unique within an identity zone. A client may be deleted and a new client can reuse a previously used client_id. This risk should be understood when managing client_credential grants.
Identity - client_id
Example - uaa-client:director_to_credhub

{
  "jti": "676312df81df4e30bc3f48fedba050fe",
  "sub": "director_to_credhub",
  "authorities": [
    "credhub.read",
    "credhub.write"
  ],
  "scope": [
    "uaa.none"
  ],
  "client_id": "director_to_credhub",
  "cid": "director_to_credhub",
  "azp": "director_to_credhub",
  "grant_type": "client_credentials",
  "rev_sig": "261e9e11",
  "iat": 1491348320,
  "exp": 1491351520,
  "iss": "https://zone1.uaa.example.com/oauth/token",
  "zid": "zone1",
  "aud": [
    "credhub",
    "director_to_credhub"
  ]
}