UNSOLVED
Authentication and authorization
Hi Community,
someone got infos on this ?
Authentication and authorization on Isilon interfaces within a Microsoft Active Directory kerberized infrastructure
smb,nfs:
When the Kerberos PAC is used to authorize users in order to create the Isilon users based access-token to gain access to filesystem resources, is there any extra LDAP query required ?
SSH,Rest(https):
After presenting the user credentials to the interface (base64 encoded credentials on https interface | user@domain + password on ssh interface) how is the authentication and authorization process handled ?
The Isilon RBAC privileges are configured to be granted to Microsoft Active Directory security groups. The user which is using the interfaces is member of this security groups.
Is it necessary for the Isilon system to perform a LDAP query for authentication and/or authorization in order to build the isilon user based access-token to gain access to the Isilon RBAC privileges ?
Right now i can see ldaps queries on my tcpdump but i dont know what they are used for.
isi_for_array -n tcpdump -i port 389 or port 636
/sebastian
hi rs,
thx.
As i can see in the sec config guide page 63/64 PAC is one way the create the access token. kerberos provides a PAC with all the user memberships. If the isilon creates the token based on the PAC there is no need for LDAP quieres.
Should i see a LDAP query every time a user connects to the SMB interface ?
As SSH/HTTPS is not kerberized on the isilon, should i see a LDAP query every time a admin connects to the interface ?
What is the lifetime of a isilon access-token ?
Thx in advance.
/Sebastian
russ_stevenson
17 Posts
2914
1
Posted July 25th, 2018 12:00
Even when using PAC's some additional LDAP queries to AD will be made as some information is not stored in the PAC, one example is if you are using AD+rfc2307 - UID/GID are not in the PAC but other exists, Isilon also will attempt to lookup all ID's in all providers, so this is likely what you are seeing with the LDAP traffic to the DC's. The token represents your entire persona based on all known information the cluster knows being looked up against all configured auth providers.
We still will attempt to look up all users in all providers, and this can be affected by the order of the Auth Providers in the Access Zone even when not using krb based auth for ssh & HTTP.
Auth Cache is configurable, but it is also affected by other factors, protocols in use, the load on the cluster, amount of connections, users etc.. the cache does have a finite size and items are aged out also in a least recently used approach. It is not uncommon to see lookups to LDAP frequently even with cache, predicting when and when not lookups occur based on last lookup/cache is extremely difficult based on all the variables in play.
# isi auth settings mapping view
GID Range Enabled: Yes
GID Range Min: 1000000
GID Range Max: 2000000
UID Range Enabled: Yes
UID Range Min: 1000000
UID Range Max: 2000000
Cache Entry Expiry: 4H
Tokens can also be flushed manually if needed.
rs
hi rs,
thx you for make things clear.
We still will attempt to look up all users in all providers, and this can be affected by the order of the Auth Providers in the Access Zone even when not using krb based auth for ssh & HTTP. if you attempt to lookup all users in all providers, which provider is used the lookup the cached information for a user (token)?
if a user token is found the token is used for authorization witch no futher lookup in other providers ?
Background info:
Imagine a situation with two AD-Domains in seperate forrests (Ressource and Account) with a one-way trust.
The ressource domain is trusting the account domain.
The computeraccount of the isilon cluster in the ressource domain.
Access to all ressources on the cluster (filesystem and RBAC) is controlled with domain local groups with the foreign user principles in it.
LDAP communication from the ressource to the account domain is blocked.
As long a SMB is used i see no problem. The provided PAC is used to authorize the user. The queries you mentiond for informations not provided in the PAC are not necessary for the filesystem access in a windows only enviroment.
But what´s about SSH and HTTP ?
Is the isilon able to handle foreign principles in case of a LDAP query in the ressource domain ?
/Sebastian
russ_stevenson
17 Posts
2914
0
Posted July 23rd, 2018 14:00
The short answer is yes, the AD provider will also make LDAP/LDAPS's call to AD to obtain user info when a user connects post authentication.
Active Directory is in effect a Kerberos & LDAP server, the authentication is handled by the Kerberos components in AD, but it also acts as the Directory Service. In order for Isilon to build the user access token, it uses the AD provider as an Identity Provider to supply all of the AD users relevant security identifiers(groups) from the AD Directory via LDAP.
Authentication is handled by Kerberos
Identity Management by LDAP = user access token
Authorization is the user access token evaluated against the granted RBAC roles/privs or File Permissions
Kerberos will only ever provide authentication, all Identity Management is handled outside of Kerberos. (local, AD, LDAP, NIS).
Lots of good info here: EMC Isilon Multiprotocol Concepts Series
rs