New Data Source Kerberos / OAuth On the Wire · 2020. 1. 6. · about all the different types of...
Transcript of New Data Source Kerberos / OAuth On the Wire · 2020. 1. 6. · about all the different types of...
Welcome
Data Source Kerberos / oAuth On the WireExplaining Kerberos Constrained Delegation with Protocol Transition and Oauth for Data Source Single Sign On
John Kew
Manager / Connectivity
Tableau
1 8 B I - 11 3
Speaker Name (if needed)
Job Title
Company / Org Name
Explaining Kerberos Constrained Delegation with Protocol Transition And oAuth
for Data Source Single Sign On
via anything but KerberosEveryone dreams of SSO
Agenda
Server settings
SQL Server impersonation
User filters and data source filters
Run as user
oAuth connections
Enable Kerberos delegation
User Filters and Data Source Filters
Run as User
Oauth (and SAML)
Why Kerberos?
Two-Factor Auth
Trust
Constrained Delegation
Introducing Bagel DB
Bageld—Bagel Database of the Future
/* Bageld - A system for the organization,storage, and retrieval of Bagel information
John V. KewAssignment 2CPEx317 w/ Dr. NicoWinter, 2002
This program sets up a decision tree for theorganization of bagel information. Theprogram will use a database file in the localdirectory called "bagels.db" - If this filedoes not exist, it will create it so that bagel information can be added.
Files:bageld.cbageld.hstring.cstring.h
Compilation: Use cmake
Usage:./bageld [bagel database] [optional: kerberos keytab]
Without a database, the program will firstask you for a bagel type. Then begin fillingthe database with Caleb bagels, Monkey bagels,and Toast bagels.
All answers are of "yes", "no", [Bagel Name], ora question about a bagel.
*/
Bageld—Bagel Database of the Future
Bagels + Kerberos = Enterprise
Single Hop Kerberos with Bagel DB
Casting Call
Narrator: John Kew
Alice the Bagel Database: Jason Burns
Microsoft Bob the Active Directory Server: <INSERT YOU>
Eve the Bagel Database Client: <INSERT YOU>
Narrator: A bagel shop. Alice the Bagel Database
is happily responding to requests from customers
about all the different types of bagels. But Alice
doesn’t just trust anyone…
Microsoft Bob ( to Alice): You have your service key right?
Without it I can’t vouch for anyone wanting to access
your bagel database.
Alice: Yeah; totally, my Domain Administrator set me up
for Kerberos Authentication. I’ll trust the people you trust.
(Eve walks into the bagel shop)
Single Hop Kerberos: The Setup
Review: Who Knows What?
Client (Eve) knows her password (Often in keytab)
Database Service (Alice) knows her password (Often in keytab)
Active Directory / KDC knows everything (Often in LDAP)
Authentication Service: Getting a Ticket Granting Ticket (TGT)
Eve: Hey Bob; you know me right? Here’s my username
Authentication Service: Getting a Ticket Granting Ticket (TGT)
Microsoft Bob: Yeah; the username is legit; here’s a secret
message containing a special decoder ring that only you can use.
We will use that as our shared decoder ring for future messages.
Keep that around, at least for 24 hours. That little key is as good
as my word; but if you are who you say you are only you should be
able to read this.
Authentication Service: Getting a Ticket Granting Ticket (TGT)
Authentication Service Login (Client Side)
Login.scala//////////////////////////////////////////////////////////////////////////////////// Authenticate against the KDC using JAAS.def login(username: String, password: String) = {val loginCtx: LoginContext = new LoginContext(configName,
new LoginCallbackHandler(username, password))loginCtx.login()this.subject = loginCtx.getSubject()
}
jaas.confdirect.SingleHopBageldClient {com.sun.security.auth.module.Krb5LoginModule requireduseTicketCache=true
};
Authentication Service Login (Client Side)
Requesting a Service Ticket: Getting a Service Ticket
Eve: Thanks Bob; you know I was thinking of starting a transaction with
Alice the Bagel Database; you think you could give me a service ticket
which I can use to start a transaction? Here is that request encrypted with
our cool little decoder ring.
Requesting a Service Ticket: Getting a Service Ticket
Microsoft Bob: Sure thing; but this ticket is encrypted with Alice’s
secret decoder ring. She’s the only one who can read it.
Now leave me alone, it’s patch Tuesday and I need some TLC.
Requesting a Service Ticket: Getting a Service Ticket
Requesting a Service Ticket (Client Side)
KerberosClient.scala////////////////////////////////////////////////////////////////////////////////////////////////// Configure our request for the service TGTprintln("initializing security context " + subject + " for service " + servicePrincipalName)val gssServerName: GSSName = manager.createName(servicePrincipalName, KRB5_PRINCIPAL_NAME_OID)val context:GSSContext = manager.createContext(gssServerName, KRB5_NAME_OID, null,
GSSContext.DEFAULT_LIFETIME)
val token: Array[Byte] = new Array[Byte](0)// This is a one pass context initialisation.context.requestMutualAuth(false)context.requestCredDeleg(true)context.requestAnonymity(false)
////////////////////////////////////////////////////////////////////////////////////////////////// Initialize the security context; this is the part that actually // gets the service session setup from the TGSval ticket = context.initSecContext(token, 0, token.length)
Wireshark: Authenticating to the Database
Eve (to Alice): Hello Bagel Database.
Alice: I don’t talk to anyone about bagels unless they have a kerberos ticket.
Wireshark: Authenticating to the Database
Eve (to Alice): Here’s my kerberos ticket that I got from our friend, Bob.
I encoded it in Base64; because I know that’s how you like it.
Wireshark: Authenticating to the Database
Alice (inspecting and decoding the service ticket):
Good news; you are not an intruder!
Wireshark: Authenticating to the Database
Accepting a Service Ticket (Database Side)
bageld.c// Convert from base64 to bytessize_t ticketLength;unsigned char *ticket = base64_decode(input, inputLength, &ticketLength);printf("KERBEROS: B64Decoded %u [%s]\n", (unsigned int) ticketLength, ticket);gss_buffer_desc gbuf;gbuf.length = ticketLength;gbuf.value = ticket;gss_ctx_id_t ctx = GSS_C_NO_CONTEXT;maj_stat = gss_accept_sec_context(&min_stat, &ctx, GSS_C_NO_CREDENTIAL,
&gbuf,GSS_C_NO_CHANNEL_BINDINGS,&name,NULL, &outbuf, &gflags, NULL, NULL);
free(ticket);switch (maj_stat) {
case GSS_S_COMPLETE:authorized = 1;gss_buffer_desc dsp_name;dsp_name.length = 0;dsp_name.value = NULL;gss_display_name( &min_stat, name, &dsp_name, GSS_C_NO_OID );printf("KERBEROS: accepting GSS security context for: %s\n", (char *)(dsp_name.value));break;
Review: Tickets and Keys Exchanged
Session key:Used to securely exchange messages between a client and active directory
Ticket granting ticket (TGT): Contains the session key to the client from active directory
Service ticket (TGS): Contains the session key for communication between the client and a service (database). This can only be decrypted by the service
Constrained Delegationwith Protocol Transition
Constrained Delegation with Protocol Transition
Eve: So here’s the problem Bob. I can talk to
Alice no problem, but my friend Fred is allergic
to garlic and cannot set foot inside that bagel
shop. Is there a way for me to ask Alice some
questions but make her think she is talking to
Fred?
Bob: Sure. This is called Kerberos Constrained
Delegation. You probably also want protocol
transition because Fred cannot just forward his
credentials into the Bagel shop.
You need to file a service ticket with my domain
administrator to set this up.
Constrained Delegation with Protocol Transition
Constrained Delegation:“Trust this user for delegation to specified services only”
Protocol Transition:“Use any authentication protocol"
Service for User to Self: S4U2Self
Eve: Bob? Can I get a service ticket for myself
for Fred? I need to be able to make requests
for other services, as if I were Fred.
Bob: Ahh this is called an Service for User
to Self (S4U2Self) call. Yup. Here you go.
Service for User to Self: S4U2Self
Eve: Thanks. Ok. Now that I can make requests
using this service ticket, can I have a service ticket
for Alice on behalf of Fred?
Service for User to Proxy: S4U2Proxy
Service for User to Proxy: S4U2Proxy
Bob: Sure. This is an Service for User to Proxy
(S4U2Proxy) call. Yup yup yup. Here you go…
Eve: Cool. Now I can talk to Alice normally,
and Alice will think I’m Fred.
Connecting to the Database Normally
Impersonation (Client Side)
KerberosClient.scala
// Impersonationval gssImpersonateName: GSSName = manager.createName(impersonateName, GSSName.NT_USER_NAME, KRB5_NAME_OID)
val self:ExtendedGSSCredential = manager.createCredential(null,
GSSCredential.DEFAULT_LIFETIME, KRB5_NAME_OID,
GSSCredential.INITIATE_ONLY).asInstanceOf[ExtendedGSSCredential]println("######### IMPERSONATING: " + gssImpersonateName)self.impersonate(gssImpersonateName).asInstanceOf[ExtendedGSSCredential]
Review: Constrained Delegation w/ Protocol Transition
Constrained Delegation:Ability to delegate communication to a service to an intermediate entity
(Eve, or Tableau Server)
Protocol Transition:Ability to initiate impersonation of a user using a Service For User To Self (S4U2Self) call and an Service For User to Proxy (S4U2Proxy) call without the original user’s password being used to retrieve a Ticket Granting Ticket
Service Ticket (TGS):Contains the session key for communication between the Client and a Service (Database). This can only be decrypted by the Service
Data Source oAuth
Tableau Data Source oAuth Implementations
Legacy oAuth
WDC oAuth
GALOP oAuth
Next* oAuth
oAuth Limitations
Designed for Web Applications
Requires an Accessible Callback Intermediary
Tableau Data Source oAuth Implementations
Thank you!
18BI-113
Contact or CTA info goes here
Connecting to Datasources for Tableau Server on Linux
R E L AT E D S E S S I O N S
Thursday, October 12 | 12:00pm–1:00pm | South—L3—Palm A
Safeguard Your Data: Row Level Security
Thursday, October 12 | 10:30am–11:30am | South—L2—Mandalay Bay G
Help us plan the futurehttps://www.surveymonkey.com/r/tableaudatasurvey
Please complete the
session survey from the
Session Details screen
in your TC18 app