See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/250310860

A Closer Look at Authentication and Authorization Mechanisms for Web-based

Applications

Conference Paper · January 2012

CITATIONS READS

7 8,034

2 authors:

Sharil Tumin Sylvia Encheva

Trimensity Tech Høgskulen på Vestlandet
140 PUBLICATIONS 157 CITATIONS 351 PUBLICATIONS 893 CITATIONS

SEE PROFILE SEE PROFILE

All content following this page was uploaded by Sylvia Encheva on 30 May 2014.

The user has requested enhancement of the downloaded file.

 Recent Researches in Applied Information Science

A Closer Look at Authentication and Authorization Mechanisms

for Web-based Applications
SHARIL TUMIN SYLVIA ENCHEVA
University of Bergen Stord/Haugesund University College
IT Dept Faculty of Technology, Business and Maritime Sciences
P.O. Box 7800, 5020 Bergen Bjørnsonsg. 45, 5528 Haugesund
NORWAY NORWAY
[email protected] [email protected]

Abstract: Authentication is a process by which you provide proofs that you are who you claim to be. Authoriza-
tion is granting you valid permissions. Everyone is familiar with authentication i.e. login process but not so with
authorization. Web-based applications introduced the needs for more understanding of these two processes to both
users and implementors. Security data are managed into two related categorizations; authoritative and operational.
To provide flexible and efficient administration, accounts, groups and resources data are managed distributively
following organizational structures and are based on delegation of rights and responsibilities. To optimize opera-
tion, security data are duplicated into directory server to be used by Web-based applications.

Key–Words: Authentication, authorization, access control, security management, security implementations

1 Introduction can be described by a triplet [I, , ’] where I is the

validated identity,  is a non empty set of allowable
We the users need to authenticate ourself every time operations, and ’ is a non empty set of resources.
we initiate interaction with a computer system and are
then given permissions dependent on our authoriza- Permissions are real time attributes for control-
tion data, either automatically or by providing some ling users’ access and operations to protected re-
extra authorization credentials depending on the op- sources. Authorization data is much more involved
erational security policies governing the protected re- than the authentication data. To provide real time
sources of the organizations and enterprises we belong user’s permissions, authorization processes need to be
to. assisted by groups and groups memberships coupled
Basically, an authentication process is a way by with resource owners and resource groups. Manage-
which you provide proofs to a system, that you are in ment of authorization data is necessarily delegated to
fact, who you claimed to be, by presenting a valid cre- different managers closely related to organizational
dential. At its simplest form this credential is a pair of structure and resource ownership.
user identification and password. A user identification Authentication and authorization are explicitly
(U) is a unique string of characters or digits directly defined in any operating system for example, Linux,
related to a user entity whether it is a human, a thing or Windows, and MacOS. Different DBMS (database
a program. A password (P) is a secret phrase known management system) manage authentication and au-
only to the user and not directly known to the system, thorization differently, some are more involved and
but directly related to the user identification. Thus, to complicated than others. Whatever methods being
be authenticated I, a user needs to provide a valid pair used, the bottom line is; authentication - identifies
of [U,P]. valid users and authorization - provides correct per-
Authentication is not authorization, but to be au- missions of access and operations on protected re-
thorized you need to be authenticated first, since per- sources, in another word, Scontrolling Q = [I, , ’]
missions mandate three attributes conditions of 1) at any one time, where i=1...n = ‘U represents all
who, 2) what and 3) which, within a user’s work ses- permissions granted to a particular user U.
sion in relation to I with a system. A permission (Q) More and more enterprise critical applications

ISBN: 978-1-61804-089-3 100

 Recent Researches in Applied Information Science

provided to users are Web-based. Users interact with identifiable. The identification is done by some com-
the underlying services provided by computer systems bination (one or more) of its attribute values. Different
using Web browsers. The works concerning authenti- data tables in the same database can be joined together
cation and authorization are becoming more impor- under SQL operations [1].
tant than ever before, to both users and developers of A data directory store data in a DIT (Directory
Web-based applications. The general security of the Information Tree) where data are represented in a hi-
underlying and supporting systems for a Web-based erarchical treelike structure uniquely addressable by
application are very much dependent om how the au- DNs (Distinguished Names). Each object identified
thentication and authorization are implemented on the by a DN holds attributes. Each attribute has a name,
application level. type and description, and one or more values. The at-
In this paper we concentrate on the problems and tributes’ names and values are defined by a schema
solutions to authentication and authorization mecha- [2]. There are three levels of search scope in a DIT; 1)
nisms and processes for Web-based applications in re- scope base - the object entry only, 2) scope onelevel -
lations to users, groups, resources authoritative data its immediate decendents only (excluding the object),
management and operational data deployment. In par- and 3) scope subtree - the object and its DIT subtree.
ticular we will be presenting a distributive, delegated Data retrievals can specify a set of attributes to be re-
management model coupled with LDAP (Lightweight trieved, where an empty set means all attributes.
Directory Access Protocol) directory services to be
used as a centralized authentication and authorization
server for all Web-based applications throughout the
2.1 Central Identity Management
enterprise. An IdM (Identity Management) system manages
users’ accounts and groups related data to be used to
identify and authorize users across computer networks
2 Background within an organizational domain and inter-domain
collaborations [3]. It behooves the organization to
Any centralized security implementation must neces- have a central IdM to cater for enterprise wide au-
sarily reflect the underlining organizational structure thentication/authorization mechanisms to all organi-
of an enterprise. A typical structure would be hierar- zational’s Web-based applications.
chical and implemented using a treelike structure. In a In order to be flexible and responsive, the IdM
hierarchical organization, every entity in the organiza- should be deployed with two main conceptual parts;
tion, except the top most one, is subordinate to a single 1) authoritative, and 2) operational, as shown in Fig-
other entity. In an educational organization, a univer- ure 1. The authoritative part implements the admin-
sity is divided into faculties. Under each faculty are istrative functions of the system while the operational
departments and each department is subdivided into supports the LDAP-based authentication and autho-
units. A hierarchical organization naturally supports rization mechanisms for the Web-based applications.
distributive management model through delegation of Given that the organization structure is hierarchi-
rights and responsibilities at each level of the hierar- cal, management rights and responsibilities can be
chy. delegated and distributed at each level of the hierar-
Persistence data are stored in two commonly used chy. Let assume that we have a simple hierarchical
data storage structures; 1) relational database, and 2) structure with maximum depth of three and M000000 is
data directory. These structures are optimized for data the master manager group i.e. members of this group
searching and selecting for different information stor- have all managerial rights. Lower manager groups are
age and retrieval operations. labeled with subscripts in relation to their position in
As to the relational database type, data are stored the organizational tree.
in a collection of relations implemented as data tables. The first two digits signify faculties, the middle
Each data tables are organized as columns of attributes two digits signify departments and the last two digits
and rows of entry to represent a particular objects. signify units. For examples; 1) M110000 is the man-
Applications can access data by submitting queries to ager group for the whole faculty, 2) M112600 is the
insert, select, modify and delete rows of data entries manager group for a department under a faculty, and
using SQL (Structured Query Language). It is neces- 3) M112614 is the manager group for a unit under a
sary for each data row in a data table to be uniquely department.

ISBN: 978-1-61804-089-3 101

 Recent Researches in Applied Information Science

the account. Users’ passwords must never be stored

in clear text by the system. Passwords are normally
stored by the system in cryptographic hash [4] values
as exemplified in Table 1.

Table 1: Cryptographic Hashes Values

Functions Values (Password = 123abc#!)
Crypt SA7QICgO9uVOQ
MD5 cyV9tkiFa6dKZ6h+NRgbvA==
SHA1 iXr77gK7q4bdCRX4zfXqsWeb/rU=
Values (Password = 123abc#!Z)
Crypt SA7QICgO9uVOQ
MD5 UMIjRuU9uCzfKRCy/aAotQ==
SHA1 VIdFcOQS0VErsMXi/RxX5Y2yMPA=

There are three basic mechanism of access control [5]:

DAC − Discretionary Access Control
MAC − Mandatory Access Control
Figure 1: A Typical IdM Architecture RBAC − Role Based Access Control
A DAC is a credential based access control. A user is
identified by a validation process of user-identification
and user password. Group members can also be vali-
In fact, the subscripts scheme discussed here can dated using group’s password. A user is the owner to
be used to label any type of groups, for example; 1) resources for example all files under the user’s home
U112600 – users belonging to a department, 2) R112614 directory and sub-directories. The user, at her own
– resources belonging to a work unit. It is natural to discretion can change permissions of users including
label groups that reflect the organizational structure. her own self for all resources owned by her. The user
Authoritative data are stored in a relational database can transfer ownership of a resource or group of re-
containing data tables that map these relations. Op- sources to another user. In an operating system, a spe-
erational data stored in a data directory DIT will nat- cial super user practically owns all system resources.
urally follow the organizational tree for data objects This super user is called root user in a Unix system.
that implement organizational security policies. A person authenticated as root has all the permissions
on all resources.
A MAC is often used to control highly sensitive
2.2 Accounts, Groups, Resources and Con- resources. It is centrally managed, enforcing organi-
trols zational security policies in which all resources be-
Web-based applications provide services to users. long to the organization with no possibility of individ-
Users are those registered to the IdM by having users’ ual ownership. Each protected resource is assigned
accounts. A person having an account will at it sim- a security tag depending on what security level the
plest form know a pair of security credential namely, resource was assigned to. A resource with a high
user-identifier (U) and user password (P). An ac- security level can be downgraded after a period of
count is basically an identity of a person or a process time. Users with a specific security level can access
coupled with credential data which provide proof of resources labeled with the same or lower level. The
authenticity. Providing a valid credential will validate management of security levels for both resources and
a person thereby granting access to protected applica- users will follow strict procedural protocols and cen-
tions and permits operations on resources depending trally defined policies.
on user’s roles. A RBAC is an access control based on an indi-
The password is only known to the person owning vidual roles of a particular user. Roles are defined

ISBN: 978-1-61804-089-3 102

 Recent Researches in Applied Information Science

in relation to persons’ work responsibilities and or- name schemes such as the domain name for example
ganizational security policies. Access control based siam.uib.no. Some components type are leaf (external)
on groups and roles could be applied successfully nodes, e.g. uid=edpst,ou=people,dc=uib,dc=no while
within organizations with clear hierarchy of authori- others are internal nodes, e.g. ou=people,dc=uib,dc=no.
ties and separation of duties, for example; 1) hospitals, The name components are case insensitive i.e.
2) banks, and 3) universities. Conceptually, RBAC UID=STU001,OU=People,Dc=uib,dc=NO is treated as
is defined by named sets containing users, resources equal to uid=stu001,ou=people,dc=uib,dc=no.
and operations as shown in Figure 2. Groups and Re- iii. Typed Objects − Data components are specific
sources pools are managed centrally and could be del- collections of data objects. Data objects have types
egated by strict sign-in and sign-offs and procedures defined by object classes, for example People, Orga-
in relation to the organizational hierarchical structure. nizations, and Computers.
iv. Typed Attributes − Data objects are set of data
attributes with specific names and values, for exam-
ple, set of names, telephone number, and given name.
The attributes values are usually encoded as UTF-8
(8-bit Unicode Transformation Format) strings. Some
attributes can contain value with binary data such
as JPEG (Joint Photographic Experts Group) com-
pressed digital pictures format.
v. Directory Operations − These operations are; 1)
read, 2) compare, 3) search, 4) add, 5) delete, and 6)
modify.
Figure 2: RBAC: Memberships, Permissions and Au- vi. Security Models − Individual data component
thorizations can be protected using internal ACL (Access Control
List). Permissions are given to a specific user after
a successful authentication process call LDAP bind.
Public access are given all with anonymous bind i.e.
2.3 LDAP binding without user identification and password.
LDAP (Lightweight Directory Access Protocol) is an
application protocol for accessing information stored
in a simpler version of X.500 directory server imple- 3 Implimentation
mentation. LDAP only supports a subset of the com-
prehensive X.500 directory services specifications. Web browsers, i.e. application clients communicate to
While X.500 supports a multi-servers distributive di- Web-based applications servers using HTTP (Hyper-
rectory configuration, LDAP is only supporting a sin- text Transfer Protocol). Massages, controls and data
gle client-server operation. are send in HTML (HyperText Markup Language),
A directory server implementing LDAP supports XML (Extensible Markup Language), CSS (Cascad-
these data model and core services: ing Style Sheets), JavaScript and binary images.
i. Hierarchical Names − Data components Most Web-based applications provides LDAP au-
are defined in a hierarchical directory with hi- thentication as a standard configuration, however none
erarchical names in contras to a flat directory provide a standard authorization mechanism using
like phone-books. A data component such as LDAP. This is not surprising since authorization is
uid=edpst,ou=people,dc=uib,dc=no represent a user very much dependent on applications, resources and
with user-identifier edpst defined under an organiza- local security policies.
tional components people belong to organization uib As LDAP directory services are modeled after
within a country no. a client-server architectural model; firstly, a central-
ii. Typed Name Components − Named (i.e. address- ized IdM for enterprise user accounts management is
able) data components are typed, for example; UID a prerequisite condition and secondly, all Web-based
(User Identification), CN (Common Name), O (Orga- applications will need to establish working connec-
nization), OU (Oragnizational Unit), C (Country), DC tion with the directory server. There are three ways
(Domain Component). This in contrast to a typeless by which a Web-based application acting as direc-

ISBN: 978-1-61804-089-3 103

 Recent Researches in Applied Information Science

tory service client can get information from a central- cle RDBMS (relational database management sys-
ize directory server; 1) directly, by using supporting tem) use by the Web-based applications implementing
LDAP client libraries, 2) indirectly via REST (Rep- the self-service and operators management functions.
resentational State Transfer) services from a HTTP Authentication data are synchronized to the operative
server, and 3) indirectly using AJAX (Asynchronous data storage, where each active account will have a
JavaScript and XML) on a Web browser from a HTTP data entry component in the LDAP server.
server that supports AJAX, refer to Figure 1. Normally user credentials are stored in posixAc-
count ldap’s ObjectClass where user identity is stored
in the ‘required’ uid attribute and user password is
3.1 Authentication stored in the ‘may have’userPassword attribute. To
There are two complimentary parts in data manage- provide authentication both attributes must be used.
ment which concern users accounts, credentials, roles The content of the userPassword can be a clear text
and permission, namely 1) authoritative, and 2) oper- password, but this should never be used, instead pass-
ative as shown in Figure 1. Authentication is about word is stored in Crypt or base64 encoded hash values
providing a correct credential during the validation as shown in Table 1. The SHA1 hash function is better
process of login or sign on to a Web-based application. then MD5 and take note that Crypt uses only the first
While user account creation is nothing more than reg- 8 characters. There is no reason not to use the SHA1
istering a person with an user identification and user for storing users passwords in LDAP server.
password. There are many details in the process of A login process is a mapping [U,P]valid 7→
account creation which effect matters concerning; 1) I session , i.e. as long as I session is valid, its holder will
efficiency, and 2) security of an enterprise. have the rights of U. For Web-based application the
With efficiency in mind, these concerns amongst I session is stored as one of the data in session cookies
other matters were implemented: of the Web browser, I session ∈ “.
i.Web-based account application, registration, ap-
proval and creation.
ii. Web-based accounts management based on dis- 3.2 Authorization
tributive rights and responsibility through delegation. An authorization process is granting a set of permis-
iii. Self-service management of editable personal sions ‘U , where each Qi ∈ ‘U can be fully described
data and password change. by a triplet [I, i , ’i ], for examples,
iv. Disallow use of special local alphabetic char- Q1 :[I, {read},{http://form.uib.no}]
acters in password, e.g. Å, å, Æ, æ, Ø, ø which will Q2 :[I, {read, write},{file://store.uib.no/data}]
eventually introduce login problems due to different Q3 :[I, {manage},{dit:ou=it,dc=uib, dc=no}]
type of keyboards. remember that I for a specific session holds the ref-
Security policies implementation is the major un- erence to the validated user and consequently groups
dertaking, a few important deployments are: and roles the user U is a member of. While I changes
i. One person one account policy. No two or more from session to session, the U referred to by a partic-
persons sharing an account. A person only owns one ular I session will always identify the same enterprise
user credential. user. In another word, to be authorized, a user must
ii. Automatic user identifiers will ensure uniqueness be authenticated first.
and protection against trivial mapping of user name to HTTP is a stateless protocol [6]. In order for a
user identification, e.g. the system will assign “Peter web server to know in what state a web client (web
White” an identifier “pew028” instead of “peter”. bowser) is currently in, the web client needs to send
iii. Enforce a strong password policies, e.g. more state data back to the web server each time a new re-
than 10 characters long, mix upper case, lower case, quest is made by the web client. The state data are
digits and non-alphanumeric. stored in web cookies. A web cookie has name and
iv. Enforce password aging and password recycle value pair and these attributes; 1) domain, 2) path, 3)
policies. expiration time, 4) secure flag, and 5) httponly flag. A
v. Implement automatic account expiration and web cookie and its attributes must not be longer than
deletion based on publicly accessible documented 4095 bytes [7].
policies. All authenticated to a Web-based application
The authoritative data are stored in an Ora- users have session data stored in cookies. There are

ISBN: 978-1-61804-089-3 104

 Recent Researches in Applied Information Science

two ways to store user’s session data; 1) Cb , all data cn=admin,ou=... data entries at any position of the DIT.
are stored in web cookies by the web browser, and 2) Managers of an organizational unit will be defined as
C s , only session identifier I is stored in a web cookie, members of cn=admin,ou=... for that unit, for example:
while session data are stored in a database on the web cn=admin,ou=221000,ou=roles,dc=uib,dc=no
server. C s provides the most flexible solutions. cn=admin,ou=221000,ou=res,dc=uib,dc=no
Authorization data can be obtained from the Any ou=... can have another ou=... which defined an
LDAP server; 1) all at once, ‘U and store the set in internal node. Any ou=... can have a cn=... which
C s , as a part of authentication process, or 2) on de- defined an external node. Any amount of distributive
mand, Qi depending on which Ri ∈ ’i and store it in model can be implemented in the DIT.
Cb . Permissions on Ri can be checked and operation
Oi ∈ i can be granted based on data store in Cb or C s .
Since ad hoc management of access controls data are 4 Conclusions
done, Cb provides the most up-to-date and accurate We have described in details how authentication and
authorization data, while C s needs user U relogin. authorization for Web-based applications can be mod-
elled and implemented using LDAP. Working habits
3.3 Distributive Management of modern people are changing. The current and most
probably the future trend is mobility. Touch screen
Authentication data are stored under a flat uid branch
internet tablets and smartphone would be the future
of a DIT, normally under the ou=people,dc=uib,dc=no,
tools of choice. These small and light devices will
for example uid=edpst,ou=people,dc=uib,dc=no.
have theirs programs, application and data store else-
To manage access controls data, three man-
where in the Internet clouds. In this respect, the Web
agement interfaces on a Web-based application are
plays a major role in providing mobile users with crit-
provided; 1) roles, 2) resources, and 3) permis-
ical business data, applications and services. The un-
sions. The DIT is arranged to reflect the organi-
derstanding of how authentication and authorization
zational tree where each organization unit is identi-
can be managed and deployed securely and effectively
fied by a 6 digits number. Each organization unit is
is a key factor for continuing success of the Web.
placed under the ou=roles,dc=uib,dc=no, for example
ou=221000,ou=roles,dc=uib,dc=no.
A group for example zoo under 221000 will be References:
named as ou=zoo,ou=221000,ou=roles,dc=uib,dc=no.
Roles will be placed under each group, for example: [1] Momjian, Bruce: PostgreSQL: Intrduction and
cn=admin,ou=zoo,ou=221000,ou=roles,dc=uib,dc=no Concepts. Addison-Wesley, ISBN 0-201-70331,
cn=user,ou=zoo,ou=221000,ou=roles,dc=uib,dc=no 2001.
where each role will holds a group of uid names. The [2] Abrech, Henry: Directory Service Integration
role cn=admin,ou=... is special. This admin role has and Deployment Guide. Oracle, Release 2 (9.2),
the rights to manage all DIT entries under the ou=... Part No. A96579-01, 2002.
i.e. members of the role can add, delete, and modify [3] Buecker, Axel: Identity Management Advanced
entries in the branches below. Design IBM, Redbooks series, SG24-7242-00,
All resources owned by 221000 will be placed First Edition, 2006.
under ou=221000,ou=res,dc=uib,dc=no, for example [4] Ferguson, Niels; Schneier, Bruce: Practi-
cn=sebra,ou=221000,ou=res,dc=uib,dc=no in which a cal Cryptography Addison-Wesley, ISBN 978-
groups of resources are defined. Permissions are 0471223573, 2003.
defined under a resource data entry for example: [5] Endler, David et al.: A Guide to Building Secure
cn=read:opr,cn=sebra,ou=221000,ou=res,dc=uib,dc=no. Web Application OWASP, 2002.
cn=add:opr,cn=sebra,ou=221000,ou=res,dc=uib,dc=no. [6] Fielding, R et al.: RFC 2616 Hypertext Transfer
where each permission will hold a group of uid Protocol HTTP/1.1 The Internet Society, 1999.
names. Members of the group have the permission to
[7] Kristol, D; Montulli, L.: RFC 2109 HTTP
perform operation X defined in the cn=X:opr... on the
State Management Mechanism Network Work-
group of resources defined in its parent.
ing Group, 2010.
The distribution of management responsibilities
and rights for the whole DIT are effectuated by the

ISBN: 978-1-61804-089-3 105

View publication stats