How I Built an Access Management System Using Apache Directory Fortress Shawn McKinney Nov 18, 2016 ApacheCon EU, Seville Session Objectives  Learn about some access management specifications  Take an unflinching look at an open source project named Apache Directory Fortress ApacheCon EU, Seville 2016 2 Introductions Shawn McKinney • Software Architect • PMC Apache Directory Project • Engineering Team 3 Agenda We’ve got options: 1. What it does (specs & requirements) 2. How it works (design) 3. How it built (implementation) 4. What can it do (demos) Pick any three ApacheCon EU, Seville 2016 4 Demo Menu 1. Learn about some – Basic integration - RBAC0 - wicket-sample – Intermediate - RBAC1 - role-engineering-sample – Advanced - RBAC2 & 3 - apache-fortress-demo 2. Testing on – Fortress Web - manual or selenium – “ ” Rest - junit – “ ” Console - ad-hoc – “ ” Command Line Interface - sys-admin stuff 3. Have fun with – Multi-tenancy & / or Benchmarking - setting up, running, verifying ApacheCon EU, Seville 2016 5 Cut to the Chase The recipe for any successful technology project: Mix well: • Well defined set of functional specifications • Understanding of the non-functional requirements • Usage of common platform elements • Practice accepted development methodologies ApacheCon EU, Seville 2016 6 Specs & Requirements What do we Build? Image from: http://www.cockpitseeker.com/aircraft/ ApacheCon EU, Seville 2016 7 System Requirements • Policy Enforcement APIs – Works on multiple platforms • Authentication – Works within various protocols, i.e. SAML, OpenID Connect • Authorization – Fine-grained and standards-based • Audit Trail – Centralized and queryable • Administration – Manage policy lifecycle • Service-based SLA – Security, performance, and reliability ApacheCon EU, Seville 2016 8 Why Use Functional Specifications? • Don’t have to (repeatedly) explain yourself. • Saves the trouble (and risk) of deciding what. • Instead focus on how. • Satisfies req’s didn’t know about (yet). ApacheCon EU, Seville 2016 9 Which Functional Specifications • Protocols Must Be Standards-Based: – Role-Based Access Control - ANSI INCITS 359 – Attribute-Based Access Control (ABAC) – IETF Password Policies (Draft) – ARBAC02 Delegated Administration Model ApacheCon EU, Seville 2016 10