The OWASP Foundation guarding your applications Koen Vanderloock

Koen Vanderloock? 9 years experience as Java developer The last 3 years working on Cegeka Leader of the Security Competence Cegeka SIMBA founder

3 Identification Authentication Authorization Manager users & rights User Access Management (UAM) Security Integration Module for Business Applications

Why another UAM Tool ? Large Java Project 5 years of agile development 2 week releases 4 applications 8 big customers Secured by Sun Access Manager 4

Why another UAM Tool ? Problems with Sun Access Manager Configuration nightmare No clue what’s going on Management of users/rights disaster 5

Create it ourself ? 6 Other UAM vendors ?

Why another UAM Tool ? 7 Other UAM vendors CA Siteminder OpenSSO = AM JOSSO

Why another UAM Tool ? 8 Create it ourself Use it for each Java project Make it customizable See what’s going on Easy management

What can SIMBA do ? Authentication Single Sign-On Role Based Access Control Authorization Session Management User Management 9

Authentication 10 RMI/HTTP WS/HTTP 10 SIMBA filter SIMBA Enabled Your applications SIMBA Authentication Service Authentication Service Webservices Entry Point Webservices Entry Point Authentication Chain Authentication Chain WS Login Chain WS Login Chain SIMBA WS Handler

SIMBA Enabled Single Sign-On 11 SIMBA filter SIMBA Manager Your applications … … SSO Token stored in cookie

Role Based Access Control 12

RBAC in SIMBA 13 Policy (Permission) Role 1..* URL RuleResource Rule 1..*

Example RBAC 14 Visitor URL Rule: Access Zoo Resource Rule: View animals READ Resource Rule: Feeding READ

Example RBAC 15 URL Rule: Access Zoo Resource Rule: View animals READ Resource Rule: Feeding WRITE Groundkeeper

Authorization 16 RMI/HTTP 16 Your application (SIMBA Enabled) Your service SIMBA Authorization Service Security aspect / Delegate URL Rule Check Resource Rule Check (READ, WRITE access)

Session management 17 Overview user sessions Auto expire sessions Manually terminate sessions

User management Overview of users, roles, policies Relations between concept Creation of user & adding correct rights Set user inactive Unblock user Reset password to the default 18

SIMBA advantages It’s easy Chains It’s lightweight Caching Audit logging User overview Centralized / distributed deployment 19

SIMBA is easy, but …

Simba framework Simba-specific- your project Your application Customized for your application

Choose your armor

Command and Chains Webservice entrance Webpage entrance

Authentication chain Command and Chains Validate Parameters User Active Jaas Login Account Blocked Password Expired Create Session Session chain Enter Application Is Credential ? Check Session Check Client IP Logout URL Rule Check Incoming request

Command and Chains The first request

Command and Chains The login request

Command and Chains The logged-in request

Webservice chain Command and Chains Validate Parameters User Active Jaas Login … … Your security check CommandChain Collection of commands Mostly entry point Security check

It’s lightweight Your own chains = only what you need Deploy it on your application server Extra features as SAML, E-ID, biometrics, … = extra jars

Caching Server 1 Simba service Simba manager Simba service Simba manager Server 2 SIMBA Topic 1. Refresh cache 2. Publish event3. Clean cache

Audit logging Each Command: success / error Each authorization request Integrity check (HMAC – SHA1) Archiving job

Give me an overview !

One big tiger,… Application DB Server 1 Server 2 SIMBA Service Manager Application

or a pack ? Application Application DB Server 1 Server 2 SIMBA Service Manager SIMBA Service Manager

Distributed deployment Multiple instances of your security Security doesn’t go down You can always access the manager You don’t lose your security session Advantages

Future SIMBA’s 37 SAML support E-ID support Advanced RBAC (hierarchy, contraints,…) SIMBA Filter (Request parameters, Request headers,X509 certificates) Manager: add/remove roles, policies Documentation: SIMBA Threat model Release about every 6 months

Interested ? 38 More information: OWASP SIMBA Project simbasecurity.org Mail to

Questions ? 39 Thanks to: