Simulation of OAuth Message Sequence and Authorization Decisions OpenAz – OAuth 2.0 Simulation of OAuth Message Sequence and Authorization Decisions

What’s real and what’s simulated There is no HTTP, everything is in one JVM. HTTP messages are replaced by method calls between Java objects. There is one Java object for each of the following Oauth entities: Authorization Server Resource Owner Browser Client Application Resource Server

What’s real and what’s simulated (cont) The data elements in the method calls contain the same information that would be in corresponding HTTP msgs The method calls in the authorization server generate PepApi decide() calls, which, using a PepApi Mapper, convert the data elements to Xacml Attributes in a RequestContext. The RequestContext is submitted to the SunXacml PDP. The SunXacml PDP evaluates the RequestContext against XACML PolicySets. Therefore, in theory, if an HTTP Servlet binding were attached to this “Authorization Server”, it could serve as a real prototype for an Authorization Service in a real OAuth environment.

What is the purpose? First is to show how XACML Policy can be used to implement the Authorization Service Decision logic. Second is to show how OpenAz: PepApi can be used with the info in the HTTP requests to make authorization calls to a XACML PDP. Third is to show how the existing OpenAz PepApi/AzApi/SunXacml reference implementation can be used as a starting point to build a real OAuth Authorization Service

How to download, build, and run the simulation First go to OpenAzTutorial javadoc URL: http://openaz.svn.sourceforge.net/viewvc/openaz/test/doc/index.html?tutorial/OpenAzTutorial.html which is OpenAz project javadoc, which has link to project page, where you can download the project. Click on that link. To download the project, click on the “Download GNU Tarball File” and save the file into a directory of your choice referred to as “<TopOfProject>”, where you should now have a file called: openaz.tar.gz Finally: unzip the downloaded file in place so that all files go in <TopOfProject>\openaz\…

How to download, build, and run the simulation (cont) To build: Start a command prompt and execute the following instructions: cd <TopOfProject> cd openaz\test\build ant clean Ant That’s it. It should have built. If not, call technical support 

How to download, build, and run the simulation (cont) To run: First, as a sanity check, run the tutorial by executing the following commands from the cmd prompt from prev slide: cd \Notes\Downloads\OpenAz\V116\openaz\test\bin set baseline=\Notes\Downloads\OpenAz\V116\openaz java -cp .;%baseline%\pep\bin;%baseline%\pdp\bin;%baseline%\azapi\bin;%baseline%\lib\jakarta-commons\commons-logging.jar;%baseline%\pdp\lib\sunxacml.jar tutorial.OpenAzTutorial %baseline%\test\policy\OpenAz-Pseudo-Test-Policy.txt To run the Oauth simulation, all you need to do is execute the following command: java -cp .;%baseline%\pep\bin;%baseline%\pdp\bin;%baseline%\azapi\bin;%baseline%\lib\jakarta-commons\commons-logging.jar;%baseline%\pdp\lib\sunxacml.jar test.OAuthSimulator ..\request\sensitive.xml ..\policy\Test*.xml

Shorthand Xacml PolicySet Diagram of Simulation OAuth-Simulator OaResource-Owner OaClient . Shorthand Xacml PolicySet OaAzServer . OaResource-Server PepApi . AzService . OpenAz PolicyReader SunXacml PDP XacmlPolicyBuilder SunXacml Api Xacml PolicySet

Comments on Diagram The four boxes in upper right represent the Oauth message sequence explained more here: http://openaz.svn.sourceforge.net/viewvc/openaz/test/doc/index.html?test/OAuthSimulator.html The XACML shorthand policies are manually typed using any editor (ex. notepad), and explained more in following slides The OpenAzPolicyReader may be run from cmd prompt and it reads the Xacml shorthand policies and uses the SunXacml Api to build SunXacml Policy objects, and then serializes those objects to Xacml XML, which are official Xacml Policies that can be used by the Sun Xacml PDP.

Xacml Shorthand Policies The Xacml shorthand policies used by the OAuth simulation will be briefly described. The full PolicySet is part of the OpenAz install and may be found in: <TopOfProject>\openaz\test\policy\TestAzApi-OpenAz-OAuth-Pseudo-Policy.txt The OAuth part of this full PolicySet is in the 2nd half of the above file and contained in “PolicySet (PS10,in:PS1)”

Xacml Shorthand (cont) The main OAuth PolicySet contains 3 sub-PolicySets, one for each OAuth endpoint: PolicySet (PS10,in:PS1) ( cb:opo id:OAuth2-TopLevel-PolicySet mlev:1 desc:PS10,in=PS1 ) Target(PolicySet) PolicySet (PS10-1,in:PS10) ( cb:do id:OAuth2-Val-URI-PolicySet mlev:2 desc:PS10-1,in=PS10 ) Target(PolicySet) TR (vl-endpt-uri,"http://az-svr/vl-endpt/" dt:string mtId:str-eq fnId:! issuer:! mbp:f ) PolicySet (PS10-2,in:PS10) ( cb:do id:OAuth2-Az-URI-PolicySet mlev:2 desc:PS10-2,in=PS10 ) Target(PolicySet) TR (az-endpt-uri,"http://az-svr/az-endpt/" dt:string mtId:str-eq fnId:! issuer:! mbp:f ) PolicySet (PS10-3,in:PS10) ( cb:do id:OAuth2-Tk-URI-PolicySet mlev:2 desc:PS10-3,in=PS10 ) Target(PolicySet) TR (tk-endpt-uri,"http://az-svr/tk-endpt/" dt:string mtId:str-eq fnId:! issuer:! mbp:f ) Syntax of params is: ( [<name>:<value>] * ) mlev:n is nesting level of PolicySets

Xacml Shorthand (cont) A typical Policy filters out NotApplicables using attribute comparisons in Target (described next slide): Policy (P10-1-2,in:PS10-1) ( cb:ord-po id:OAuth2-Val-URI-Token-Policy desc:P10-1-2,in=PS10-1 ) Target(Policy) TS (res-svr,"http://res-svr/" dt:string mtId:str-eq fnId:! issuer:! mbp:f ) + (token-present,"true" dt:boolean mtId:boo-eq fnId:! issuer:! mbp:f ) // Note: could have a rule for token not valid and what to return + (token-valid,"true" dt:boolean mtId:boo-eq fnId:! issuer:! mbp:f ) TR (res-id,"oauth-access-token-confirmation" dt:string mtId:str-eq fnId:! issuer:! mbp:f ) TA (act-id,"return-token-confirmation" dt:string mtId:str-eq fnId:! issuer:! mbp:f ) Rules(Policy) Rule ( ef:Permit id:FinalRule ) Target(Rule) Obligations(Policy) Obligation ( fulfillOn:Permit id:ReturnAccessTokenValid ) OA (return-confirmation,"true" dt:boolean mtId:! fnId:! issuer:! mbp:f )

Xacml Shorthand (cont) The following describes Policy in prev slide: There are 3 subject attrs, each of which must meet its specified criteria: The attr named “res-svr” must have value: “http://res-svr/” The attr named “token-present” must be boolean w value “true” The attr named “token-valid” must be boolean w value “true” There is 1 resource attr: The attr named “res-id” must have value : “oauth-access-token-confirmation” There is 1 action attr: The attr named “act-id” must have value: “return-token-confirmation” There is 1 obligation that is returned on a “Permit” with: An attr named “return-confirmation” with a value: “true”