From a6f15d94c21a9933798d3f4804f5cf6c347b13f7 Mon Sep 17 00:00:00 2001 From: Tani <111664369+taniwha3@users.noreply.github.com> Date: Sat, 10 Sep 2022 23:55:28 -0700 Subject: [PATCH 1/3] [Proposal 005] Node Authorization Signed-off-by: Tani <111664369+taniwha3@users.noreply.github.com> --- accepted/005-node-authentication.md | 71 +++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 accepted/005-node-authentication.md diff --git a/accepted/005-node-authentication.md b/accepted/005-node-authentication.md new file mode 100644 index 0000000..897ee8c --- /dev/null +++ b/accepted/005-node-authentication.md @@ -0,0 +1,71 @@ +# Design / Feature + +*TODO for the document:* +* *analyse and select default policy engine.* +* *analyse policy engines available in rust.* + +This feature will allow an administrative user to authenticate with the node. + +#### Scope +This document only covers node authorization. Application authorization is out +of scope for this proposal. + +#### Policy Engine +[Proposal 002](/accepted/002.md) provides the aurae daemon with an SSH authenticated +user based upon SSH Certificates. The selected authentication provides identity +and communication channel encryption. + +Authorization consumes the identity provided by Proposal 002. When the user +connects, the user identity is authenticated directly from the connection. Upon +initial connection, the identity is sent to an authorization plugin. + +The authorization engine receives a message with the identity, action, and +parameters. The authorization engine returns a decision. Aurae Daemon is +responsible for enforcing the decision. + +A default policy engine will be installed when no other authorization engine +has been installed. + +Authorization decisions default to deny. + +Not installing a policy engine causes all requests to be denied. + +### Policy Engine Selection + +**TODO** + +#### Workflow: + +```mermaid +sequenceDiagram +client-->>auraed: Connect via ssh +auraed-->>policy engine: id, action, parameters +policy engine-->>auraed: decision +note over auraed: enforce +auraed-->>client: status +``` + +### Outcomes + +The outcomes of adding support for policy engines are: + +* auraed will be capable of handling arbitrary scenarios based upon the connecting client. +* policies may be written in languages designed to deal with policy. +* changes to the policy do not require a recompilation of auraed. +* policy can be centralized for multiple auraed. + +### Goals + + - Aurae Daemon will integrate with an authentication policy engine. + +### Decisions + + - The project will use a policy engine plugin to implement the policy. + - TODO: select the policy engine plugin. + +### Notes + +### Authors + + - [@kris-nova](https://github.com/kris-nova) + - [@tani](https://github.com/taniwha3) From a78d437cca648b643df6b44b4b436e96551d2954 Mon Sep 17 00:00:00 2001 From: Tani <111664369+taniwha3@users.noreply.github.com> Date: Sun, 11 Sep 2022 12:37:30 -0700 Subject: [PATCH 2/3] [Proposal 005] Setting default policy engine to custom rust impl Signed-off-by: Tani <111664369+taniwha3@users.noreply.github.com> --- accepted/005-node-authentication.md | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/accepted/005-node-authentication.md b/accepted/005-node-authentication.md index 897ee8c..ace1385 100644 --- a/accepted/005-node-authentication.md +++ b/accepted/005-node-authentication.md @@ -1,8 +1,5 @@ # Design / Feature -*TODO for the document:* -* *analyse and select default policy engine.* -* *analyse policy engines available in rust.* This feature will allow an administrative user to authenticate with the node. @@ -11,9 +8,9 @@ This document only covers node authorization. Application authorization is out of scope for this proposal. #### Policy Engine -[Proposal 002](/accepted/002.md) provides the aurae daemon with an SSH authenticated -user based upon SSH Certificates. The selected authentication provides identity -and communication channel encryption. +[Proposal 002](/accepted/002.md) provides the aurae daemon with an SSH +authenticated user based upon SSH Certificates. The selected authentication +provides identity and communication channel encryption. Authorization consumes the identity provided by Proposal 002. When the user connects, the user identity is authenticated directly from the connection. Upon @@ -23,16 +20,15 @@ The authorization engine receives a message with the identity, action, and parameters. The authorization engine returns a decision. Aurae Daemon is responsible for enforcing the decision. -A default policy engine will be installed when no other authorization engine -has been installed. +A simple default policy engine written in rust will be installed when no other +authorization engine has been installed. Users may choose to implement their +own policy engine by implementing the relevant trait. Authorization decisions default to deny. Not installing a policy engine causes all requests to be denied. -### Policy Engine Selection - -**TODO** +#### Default Implement #### Workflow: @@ -49,7 +45,8 @@ auraed-->>client: status The outcomes of adding support for policy engines are: -* auraed will be capable of handling arbitrary scenarios based upon the connecting client. +* auraed will be capable of handling arbitrary scenarios based upon the + connecting client. * policies may be written in languages designed to deal with policy. * changes to the policy do not require a recompilation of auraed. * policy can be centralized for multiple auraed. From b950ee839e22017ec98ddc1d99dab4c3a76d6c74 Mon Sep 17 00:00:00 2001 From: Tani <111664369+taniwha3@users.noreply.github.com> Date: Sun, 11 Sep 2022 12:50:15 -0700 Subject: [PATCH 3/3] [Proposal 005] Clarifying the proposal, and giving context in notes Signed-off-by: Tani <111664369+taniwha3@users.noreply.github.com> --- accepted/005-node-authentication.md | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/accepted/005-node-authentication.md b/accepted/005-node-authentication.md index ace1385..dc28b0f 100644 --- a/accepted/005-node-authentication.md +++ b/accepted/005-node-authentication.md @@ -20,6 +20,8 @@ The authorization engine receives a message with the identity, action, and parameters. The authorization engine returns a decision. Aurae Daemon is responsible for enforcing the decision. +Authorization decisions are sent to the observability module. + A simple default policy engine written in rust will be installed when no other authorization engine has been installed. Users may choose to implement their own policy engine by implementing the relevant trait. @@ -45,23 +47,30 @@ auraed-->>client: status The outcomes of adding support for policy engines are: -* auraed will be capable of handling arbitrary scenarios based upon the + - auraed will be capable of handling arbitrary scenarios based upon the connecting client. -* policies may be written in languages designed to deal with policy. -* changes to the policy do not require a recompilation of auraed. -* policy can be centralized for multiple auraed. + - policies may be written in languages designed to deal with policy. + - changes to the policy do not require a recompilation of auraed. + - policy can be centralized for multiple auraed. ### Goals - - Aurae Daemon will integrate with an authentication policy engine. + - Aurae Daemon will allow policy engines to be installed. + - Aurae Daemon will produce a single simple policy plugin. ### Decisions - - The project will use a policy engine plugin to implement the policy. - - TODO: select the policy engine plugin. + - The project will support policy engine plugins. + - The project will only implement a simple policy plugin in rust. ### Notes + - The only authorization system that will be implemented in auraed is the + rust implementation. However, this model allows for other organizations + to plugin their own authorization modules to support their own patterns. + See [Zanzibar: Google’s Consistent, Global Authorization System](https://research.google/pubs/pub48190/) + for an example. + ### Authors - [@kris-nova](https://github.com/kris-nova)