Konrad Zemek, Łukasz Opioła, Michał Wrzeszcz, Renata G. Słota, Łukasz Dutka, Jacek Kitowski ACC Cyfronet AGH Department of Computer Science, AGH - UST CGW 2015 Kraków, Poland, October 26-28, 2015 Delegation of authority in distributed data access system

AAIs in distributed systems - challenges onedata – a global data access system Autonomous entites in onedata Popular technologies in AAI Macaroons – better than cookies Macaroons in onedata Conclusions Agenda

AAIs in distributed systems: challenges Services can be autonomous components User identity and privileges must be verified Some operations require delegation User credentials must be passed in a secure manner AuthN – AuthenticatioN AuthZ – AuthoriZation

onedata Global data access Virtualizes access to files Easy data sharing Cooperation support HPC support Unifies heterogeneous storages into single data space Highly distributed

Autonomous entities in onedata NO TRUST No trust between providers Share file Access file Need for delegation TRUST

Popular technologies in AAI Certificates (Globus, X.509) Depending on user awareness Revocation handling may be problematic SAML (Security Assertion Markup Language) Complicated and heavyweight High maintenance (in big systems) Web cookies Carry too much authority No delegation mechanism

„Macaroons are better than cookies!” The answer to onedata needs – macaroons (by Google): Bearer tokens Contextual confinement of authority (caveats) Caveats cannot be removed and cannot increase authority Limitable lifespan Third party caveats Safe delegation of authority Serializable for easy passing

3. Native client authorization macaroon Macaroons in onedata 1. Authentication macaroon 2. Provider authorization macaroon

Macaroons in onedata 1. Authentication macaroon Proof of user’s identity and presence (active session) Short lived Issued by identity service (Global Registry, GR) 3. Native client authorization macaroon 2. Provider authorization macaroon

Macaroons in onedata 2. Provider authorization macaroon Long lived Allows interacting with GR on behalf of the user Contains a 3rd party caveat – needs authentication macaroon 3. Native client authorization macaroon 1. Authentication macaroon

3. Native client authorization macaroon Long lived Given to the user, confidential Does not require authentication but limited authority Allows read-only access to some GR metadata Authority delegated by further confinement Macaroons in onedata 1. Authentication macaroon 2. Provider authorization macaroon

Macaroons vs autonomous entities in onedata NO TRUST Share file Access file TRUST AuthN AuthZ

Conclusions Macaroons in onedata ensure: High security (macaroons are cryptographically strong) Ease of use and transparency to the users Simpler authorization system Fine-grained permissions Low storage and computational overheads

Thank you onedata homepage: