Security Overview
Cloud Application Security Overview:
Authentication and authorization are fundamental concepts in computer security and access control. They are often used together to ensure that only authorized users or entities can access specific resources or perform certain actions. Here's an explanation of each concept:
Authentication:
Authentication is the process of verifying the identity of a user, device, application, or system entity trying to access a resource or perform an action. It ensures that the entity is who it claims to be before granting access. Authentication typically involves presenting credentials, such as a username and password, a smart card, a biometric scan, or a digital certificate, to a trusted authentication system.
Key points about authentication:
Verification of Identity: Authentication verifies the identity of the entity based on the provided credentials or attributes.
Credentials: Credentials are the information or factors used to prove identity. Common examples include something you know (e.g., a password), something you have (e.g., a security token), and something you are (e.g., a fingerprint).
Authentication Methods: Various authentication methods are used, ranging from simple password-based authentication to more secure multi-factor authentication (MFA) methods.
Single Sign-On (SSO): SSO allows users to authenticate once and access multiple resources or applications without re-entering credentials.
Authentication Providers: Authentication can be performed by identity providers (e.g., LDAP, OAuth, SAML) or through custom authentication systems.
Authorization:
Authorization is the process of determining what actions or resources an authenticated entity is allowed to access or perform. It defines the permissions and privileges associated with an authenticated identity. Authorization controls who can do what with specific resources or actions.
Key points about authorization:
Access Control: Authorization controls access to resources based on user roles, permissions, and policies.
Roles and Permissions: Users are often assigned roles (e.g., admin, user, manager), and these roles have associated permissions (e.g., read, write, delete) that dictate what actions they can perform.
Policy-Based: Authorization is often defined through policies, which specify which roles or users can access specific resources and what actions they can take.
Least Privilege Principle: The principle of least privilege (POLP) states that entities should be granted the minimum necessary permissions to perform their tasks, reducing the risk of unauthorized access.
Dynamic Authorization: In some systems, authorization decisions are made dynamically based on contextual factors, such as time of day, location, or user attributes.
In summary, authentication verifies the identity of entities, while authorization controls their access to resources and actions based on their authenticated identity and assigned permissions. Together, these concepts ensure that only legitimate users or entities are granted access to resources and that they can perform only the actions they are authorized to do, enhancing the security and integrity of computer systems and data.
\
Authentication & Authorization Flow:
In this textual representation:
[User] initiates authentication.
The
[approuter]component handles the initial user authentication and acts as a reverse proxy for routing requests to the appropriate destination (user application/service or XSUAA).After successful user authentication, the
[approuter]forwards the request to XSUAA for JWT token issuance.[XSUAA] handles user authentication and issues a JWT token.
[User App/Service] receives the JWT token and uses it for resource access.
The JWT token is then used for resource access within the
[User App/Service]component.The
[Resource Server]validates the JWT token and consults XSUAA for authorization decisions, as before.[XSUAA] evaluates authorization policies and roles and makes an authorization decision.
[Resource Server] grants or denies access based on [XSUAA]'s decision.
After the
[Resource Server]has processed the request and generated a response, it sends the response back to the[User]through the[approuter].The
[approuter]handles the response and forwards it to the[User].
This completes the flow, including the response from the [Resource Server] back to the [User] through the [approuter].
More Details:
Now, Let's understand each and every component in some more detail:
In the context of SAP HANA Cloud and SAP BTP, JWT (JSON Web Tokens) and XSUAA (XS Advanced Authentication and Authorization) are commonly used together to enable authentication and authorization for applications and services. Here's how they work together:
JWT (JSON Web Tokens): JWT is a compact, self-contained token format used for securely transmitting information between parties, typically as a JSON object. JWTs consist of three parts: a header, a payload, and a signature. In the context of SAP BTP, JWTs are often used to represent user identities and claims.
XSUAA (XS Advanced Authentication and Authorization): XSUAA is a component of SAP BTP that provides identity and access management capabilities. It manages user authentication and authorization for applications and services deployed on the platform.
Here's how JWT and XSUAA work together:
User Authentication: When a user tries to access an application or service that is protected by XSUAA, they are redirected to the XSUAA service for authentication. The user provides their credentials (e.g., username and password) or uses a single sign-on (SSO) mechanism if configured.
JWT Issuance: After successful authentication, XSUAA issues a JWT token containing claims about the user, such as their identity, roles, and permissions. These claims are typically included in the payload of the JWT.
JWT Token: The JWT token is digitally signed by XSUAA to ensure its authenticity. The token is then returned to the user's application or service.
Application or Service Access: The user's application or service receives the JWT token. It can then use the claims within the token to make authorization decisions. For example, the application can determine the user's roles and permissions and restrict access to certain resources based on those claims.
Resource Access: When the application or service needs to access protected resources, it includes the JWT token in the request. The resource server can validate the token's signature to ensure its authenticity and check the claims to determine whether the user has the necessary permissions to access the requested resource.
Authorization Decision: XSUAA plays a crucial role in authorization decisions by evaluating the claims in the JWT token and comparing them to the defined authorization policies and roles. It can grant or deny access to specific resources based on these policies.
In summary, JWTs are used as a means of representing user identities and their associated claims (roles, permissions, etc.), while XSUAA handles the authentication process, issues JWT tokens, and provides the authorization framework for applications and services running on SAP BTP. This combination allows for secure user authentication and authorization in SAP HANA Cloud and SAP BTP applications.
Last updated