![[BACK]](/icons/back.gif){kind=icon}
Return to PegasusSecurityArchitecture.ppt
CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [Pegasus] / pegasus / doc| Return to PegasusSecurityArchitecture.ppt
CVS log | Up to [Pegasus] / pegasus / doc |
| File: [Pegasus] / pegasus / doc / PegasusSecurityArchitecture.ppt (download) Revision 1.1, Wed Jun 19 21:37:55 2002 UTC (21 years, 11 months ago) by kumpf CVS Tags: test, preBug9676, postBug9676, pep_88, pegasus25BeforeLicenseUpdate, mday-merge-start, mday-merge-pegasus/src/Pegasus/Server, mday-merge-pegasus/src/Pegasus/Common, mday-2-0-patches, local, VERSION_2_1_RELEASE_HEAD, VERSION_2_1_RELEASE_BRANCH, VERSION_2_1_RELEASE, VERSION_2_1_1_RELEASE, VERSION_2_01_01, VERSION_2_00_RC_4, VERSION_2_00_RC_3, VERSION_2_00_RC_2, VERSION_2_00_RC_1, VERSION_2_00_BRANCH, TEST, TASK_PEP328_SOLARIS_NEVADA_PORT, TASK_PEP317_1JUNE_2013, TASK_PEP233_EmbeddedInstSupport-merge_out_trunk, TASK_BUG_5314_IPC_REFACTORING_ROOT, TASK_BUG_5314_IPC_REFACTORING_BRANCH, TASK_BUG_5314_IPC_REFACTORING-V1, TASK_BUG_5191_QUEUE_CONSOLIDATION_ROOT, TASK_BUG_5191_QUEUE_CONSOLIDATION_BRANCH, TASK-TASK_PEP362_RestfulService_branch-root, TASK-TASK_PEP362_RestfulService_branch-merged_out_from_trunk, TASK-TASK_PEP362_RestfulService_branch-merged_in_to_trunk, TASK-TASK_PEP362_RestfulService_branch-merged_in_from_branch, TASK-TASK_PEP362_RestfulService_branch-branch, TASK-TASK-BUG4011_WinLocalConnect-branch-New-root, TASK-TASK-BUG4011_WinLocalConnect-branch-New-merged_out_to_branch, TASK-TASK-BUG4011_WinLocalConnect-branch-New-merged_out_from_trunk, TASK-TASK-BUG4011_WinLocalConnect-branch-New-merged_in_to_trunk, TASK-TASK-BUG4011_WinLocalConnect-branch-New-merged_in_from_branch, TASK-TASK-BUG4011_WinLocalConnect-branch-New-branch, TASK-PEP362_RestfulService-root, TASK-PEP362_RestfulService-merged_out_to_branch, TASK-PEP362_RestfulService-merged_out_from_trunk, TASK-PEP362_RestfulService-merged_in_to_trunk, TASK-PEP362_RestfulService-merged_in_from_branch, TASK-PEP362_RestfulService-branch, TASK-PEP348_SCMO-root, TASK-PEP348_SCMO-merged_out_to_branch, TASK-PEP348_SCMO-merged_out_from_trunk, TASK-PEP348_SCMO-merged_in_to_trunk, TASK-PEP348_SCMO-merged_in_from_branch, TASK-PEP348_SCMO-branch, TASK-PEP328_SOLARIS_NEVADA_PORT_v2-root, TASK-PEP328_SOLARIS_NEVADA_PORT_v2-branch, TASK-PEP328_SOLARIS_NEVADA_PORT-root, TASK-PEP328_SOLARIS_NEVADA_PORT-branch, TASK-PEP328_SOLARIS_IX86_CC_PORT-root, TASK-PEP328_SOLARIS_IX86_CC_PORT-branch-v2, TASK-PEP328_SOLARIS_IX86_CC_PORT-branch, TASK-PEP317_pullop-root, TASK-PEP317_pullop-merged_out_to_branch, TASK-PEP317_pullop-merged_out_from_trunk, TASK-PEP317_pullop-merged_in_to_trunk, TASK-PEP317_pullop-merged_in_from_branch, TASK-PEP317_pullop-branch, TASK-PEP311_WSMan-root, TASK-PEP311_WSMan-branch, TASK-PEP305_VXWORKS-root, TASK-PEP305_VXWORKS-branch-pre-solaris-port, TASK-PEP305_VXWORKS-branch-post-solaris-port, TASK-PEP305_VXWORKS-branch-beta2, TASK-PEP305_VXWORKS-branch, TASK-PEP305_VXWORKS-2008-10-23, TASK-PEP291_IPV6-root, TASK-PEP291_IPV6-branch, TASK-PEP286_PRIVILEGE_SEPARATION-root, TASK-PEP286_PRIVILEGE_SEPARATION-branch, TASK-PEP274_dacim-root, TASK-PEP274_dacim-merged_out_to_branch, TASK-PEP274_dacim-merged_out_from_trunk, TASK-PEP274_dacim-merged_in_to_trunk, TASK-PEP274_dacim-merged_in_from_branch, TASK-PEP274_dacim-branch, TASK-PEP268_SSLClientCertificatePropagation-root, TASK-PEP268_SSLClientCertificatePropagation-merged_out_to_branch, TASK-PEP268_SSLClientCertificatePropagation-merged_out_from_trunk, TASK-PEP268_SSLClientCertificatePropagation-merged_in_to_trunk, TASK-PEP268_SSLClientCertificatePropagation-merged_in_from_branch, TASK-PEP268_SSLClientCertificatePropagation-branch, TASK-PEP267_SLPReregistrationSupport-root, TASK-PEP267_SLPReregistrationSupport-merging_out_to_branch, TASK-PEP267_SLPReregistrationSupport-merging_out_from_trunk, TASK-PEP267_SLPReregistrationSupport-merged_out_to_branch, TASK-PEP267_SLPReregistrationSupport-merged_out_from_trunk, TASK-PEP267_SLPReregistrationSupport-merged_in_to_trunk, TASK-PEP267_SLPReregistrationSupport-merged_in_from_branch, TASK-PEP267_SLPReregistrationSupport-branch, TASK-PEP250_RPMProvider-root, TASK-PEP250_RPMProvider-merged_out_to_branch, TASK-PEP250_RPMProvider-merged_out_from_trunk, TASK-PEP250_RPMProvider-merged_in_to_trunk, TASK-PEP250_RPMProvider-merged_in_from_branch, TASK-PEP250_RPMProvider-branch, TASK-PEP245_CimErrorInfrastructure-root, TASK-PEP245_CimErrorInfrastructure-merged_out_to_branch, TASK-PEP245_CimErrorInfrastructure-merged_out_from_trunk, TASK-PEP245_CimErrorInfrastructure-merged_in_to_trunk, TASK-PEP245_CimErrorInfrastructure-merged_in_from_branch, TASK-PEP245_CimErrorInfrastructure-branch, TASK-PEP241_OpenPegasusStressTests-root, TASK-PEP241_OpenPegasusStressTests-merged_out_to_branch, TASK-PEP241_OpenPegasusStressTests-merged_out_from_trunk, TASK-PEP241_OpenPegasusStressTests-merged_in_to_trunk, TASK-PEP241_OpenPegasusStressTests-merged_in_from_branch, TASK-PEP241_OpenPegasusStressTests-branch, TASK-Bugs5690_3913_RemoteCMPI-root, TASK-Bugs5690_3913_RemoteCMPI-merged_out_to_branch, TASK-Bugs5690_3913_RemoteCMPI-merged_out_from_trunk, TASK-Bugs5690_3913_RemoteCMPI-merged_in_to_trunk, TASK-Bugs5690_3913_RemoteCMPI-merged_in_from_branch, TASK-Bugs5690_3913_RemoteCMPI-branch, TASK-Bug2102_RCMPIWindows-root, TASK-Bug2102_RCMPIWindows-merged_out_to_branch, TASK-Bug2102_RCMPIWindows-merged_out_from_trunk, TASK-Bug2102_RCMPIWindows-merged_in_to_trunk, TASK-Bug2102_RCMPIWindows-merged_in_from_branch, TASK-Bug2102_RCMPIWindows-branch, TASK-Bug2102Final-root, TASK-Bug2102Final-merged_out_to_branch, TASK-Bug2102Final-merged_out_from_trunk, TASK-Bug2102Final-merged_in_to_trunk, TASK-Bug2102Final-merged_in_from_branch, TASK-Bug2102Final-branch, TASK-Bug2021_RemoteCMPIonWindows-root, TASK-Bug2021_RemoteCMPIonWindows-merged_out_to_branch, TASK-Bug2021_RemoteCMPIonWindows-merged_out_from_trunk, TASK-Bug2021_RemoteCMPIonWindows-merged_in_to_trunk, TASK-Bug2021_RemoteCMPIonWindows-merged_in_from_branch, TASK-Bug2021_RemoteCMPIonWindows-branch, TASK-Bug2021_RCMPIonWindows-root, TASK-Bug2021_RCMPIonWindows-merged_out_to_branch, TASK-Bug2021_RCMPIonWindows-merged_out_from_trunk, TASK-Bug2021_RCMPIonWindows-merged_in_to_trunk, TASK-Bug2021_RCMPIonWindows-merged_in_from_branch, TASK-Bug2021_RCMPIonWindows-branch, TASK-BUG7240-root, TASK-BUG7240-branch, TASK-BUG7146_SqlRepositoryPrototype-root, TASK-BUG7146_SqlRepositoryPrototype-merged_out_to_branch, TASK-BUG7146_SqlRepositoryPrototype-merged_out_from_trunk, TASK-BUG7146_SqlRepositoryPrototype-merged_in_to_trunk, TASK-BUG7146_SqlRepositoryPrototype-merged_in_from_branch, TASK-BUG7146_SqlRepositoryPrototype-branch, TASK-BUG4011_WinLocalConnect-root, TASK-BUG4011_WinLocalConnect-merged_out_to_branch, TASK-BUG4011_WinLocalConnect-merged_out_from_trunk, TASK-BUG4011_WinLocalConnect-merged_in_to_trunk, TASK-BUG4011_WinLocalConnect-merged_in_from_branch, TASK-BUG4011_WinLocalConnect-branch-New, TASK-BUG4011_WinLocalConnect-branch, STABLE, SLPPERFINST-root, SLPPERFINST-branch, RELEASE_2_9_2-RC2, RELEASE_2_9_2-RC1, RELEASE_2_9_2, RELEASE_2_9_1-RC1, RELEASE_2_9_1, RELEASE_2_9_0-RC1, RELEASE_2_9_0-FC, RELEASE_2_9_0, RELEASE_2_9-root, RELEASE_2_9-branch, RELEASE_2_8_2-RC1, RELEASE_2_8_2, RELEASE_2_8_1-RC1, RELEASE_2_8_1, RELEASE_2_8_0_BETA, RELEASE_2_8_0-RC2, RELEASE_2_8_0-RC1, RELEASE_2_8_0-FC, RELEASE_2_8_0, RELEASE_2_8-root, RELEASE_2_8-branch, RELEASE_2_7_3-RC1, RELEASE_2_7_3, RELEASE_2_7_2-RC1, RELEASE_2_7_2, RELEASE_2_7_1-RC1, RELEASE_2_7_1, RELEASE_2_7_0-RC1, RELEASE_2_7_0-BETA, RELEASE_2_7_0, RELEASE_2_7-root, RELEASE_2_7-branch, RELEASE_2_6_3-RC2, RELEASE_2_6_3-RC1, RELEASE_2_6_3, RELEASE_2_6_2-RC1, RELEASE_2_6_2, RELEASE_2_6_1-RC1, RELEASE_2_6_1, RELEASE_2_6_0-RC1, RELEASE_2_6_0-FC, RELEASE_2_6_0, RELEASE_2_6-root, RELEASE_2_6-branch-clean, RELEASE_2_6-branch, RELEASE_2_5_5-RC2, RELEASE_2_5_5-RC1, RELEASE_2_5_5, RELEASE_2_5_4-RC2, RELEASE_2_5_4-RC1, RELEASE_2_5_4, RELEASE_2_5_3-RC1, RELEASE_2_5_3, RELEASE_2_5_2-RC1, RELEASE_2_5_2, RELEASE_2_5_1-RC1, RELEASE_2_5_1, RELEASE_2_5_0-RC1, RELEASE_2_5_0, RELEASE_2_5-root, RELEASE_2_5-branch, RELEASE_2_4_FC_CANDIDATE_1, RELEASE_2_4_3, RELEASE_2_4_2, RELEASE_2_4_1-BETA3, RELEASE_2_4_1-BETA2, RELEASE_2_4_1-BETA1, RELEASE_2_4_1, RELEASE_2_4_0-RC3, RELEASE_2_4_0-RC2, RELEASE_2_4_0, RELEASE_2_4-root, RELEASE_2_4-branch, RELEASE_2_3_2-testfreeze, RELEASE_2_3_2-root, RELEASE_2_3_2-releasesnapshot, RELEASE_2_3_2-branch-freeze, RELEASE_2_3_2-branch, RELEASE_2_3_1-root, RELEASE_2_3_1-branch, RELEASE_2_3_0-root, RELEASE_2_3_0-msg-freeze, RELEASE_2_3_0-branch, RELEASE_2_2_1-snapshot, RELEASE_2_2_0_0-release, RELEASE_2_2_0-root, RELEASE_2_2_0-branch, RELEASE_2_2-root, RELEASE_2_14_1, RELEASE_2_14_0-RC2, RELEASE_2_14_0-RC1, RELEASE_2_14_0, RELEASE_2_14-root, RELEASE_2_14-branch, RELEASE_2_13_0-RC2, RELEASE_2_13_0-RC1, RELEASE_2_13_0-FC, RELEASE_2_13_0, RELEASE_2_13-root, RELEASE_2_13-branch, RELEASE_2_12_1-RC1, RELEASE_2_12_1, RELEASE_2_12_0-RC1, RELEASE_2_12_0-FC, RELEASE_2_12_0, RELEASE_2_12-root, RELEASE_2_12-branch, RELEASE_2_11_2-RC1, RELEASE_2_11_2, RELEASE_2_11_1-RC1, RELEASE_2_11_1, RELEASE_2_11_0-RC1, RELEASE_2_11_0-FC, RELEASE_2_11_0, RELEASE_2_11-root, RELEASE_2_11-branch, RELEASE_2_10_1-RC1, RELEASE_2_10_1, RELEASE_2_10_0-RC2, RELEASE_2_10_0-RC1, RELEASE_2_10_0, RELEASE_2_10-root, RELEASE_2_10-branch, PRE_LICENSE_UPDATE_2003, PREAUG25UPDATE, POST_LICENSE_UPDATE_2003, POSTAUG25UPDATE, PEP286_PRIVILEGE_SEPARATION_ROOT, PEP286_PRIVILEGE_SEPARATION_CODE_FREEZE, PEP286_PRIVILEGE_SEPARATION_BRANCH, PEP286_PRIVILEGE_SEPARATION_1, PEP244_ServerProfile-root, PEP244_ServerProfile-branch, PEP233_EmbeddedInstSupport-root, PEP233_EmbeddedInstSupport-branch, PEP217_PRE_BRANCH, PEP217_POST_BRANCH, PEP217_BRANCH, PEP214ROOT, PEP214BRANCH, PEP214-root, PEP214-branch, PEP213_SIZE_OPTIMIZATIONS, PEP-214B-root, PEGASUS_FC_VERSION_2_2, PEGASUS_2_5_0_PerformanceDev-string-end, PEGASUS_2_5_0_PerformanceDev-rootlt, PEGASUS_2_5_0_PerformanceDev-root, PEGASUS_2_5_0_PerformanceDev-r2, PEGASUS_2_5_0_PerformanceDev-r1, PEGASUS_2_5_0_PerformanceDev-lit-end, PEGASUS_2_5_0_PerformanceDev-buffer-end, PEGASUS_2_5_0_PerformanceDev-branch, PEGASUS_2_5_0_PerformanceDev-AtomicInt-branch, PEG25_IBM_5_16_05, NPEGASUS_2_5_0_PerformanceDev-String-root, NNPEGASUS_2_5_0_PerformanceDev-String-branch, Makefile, MONITOR_CONSOLIDATION_2_5_BRANCH, LOCAL_ASSOCPROV-ROOT, LOCAL_ASSOCPROV-BRANCH, IBM_241_April1405, HPUX_TEST, HEAD, CQL_2_5_BRANCH, CIMRS_WORK_20130824, CHUNKTESTDONE_PEP140, BeforeUpdateToHeadOct82011, BUG_4225_PERFORMANCE_VERSION_1_DONE HP-Nag: Created a Pegasus Security Architecture slide set. |
ࡱ > ( @
b / 0 D T i m e s N e w R o m a n l4 t !0 hz0 D F u t u r a L t R o m a n l4 t !0 hz0 "
` .
@ n ? " d d @ @@ `` T
%
*
& ,
c $ @ f 3 @ { g 4 6 d 6 d !0 p p p @ < 4 ! d ! d 0< X5 < 4 B d B d o0< u ʚ;2N ʚ; < 4 d d d d 0 ?
O =
Pegasus Security Implementation + Author: Nag Boranna
Hewlett-Packard Company Security Block Diagram Authentication Block Diagram
Authorization Block Diagram Authentication Implementation
Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization / T ` ` ̙ 33 ` 333 MMM ` ff3 33 3 f ` f ` f ` 3 > ? " d d @ , | ? " d d @ " @ ` n ? " d d @ @@ `` P R @ ` ` p > > ^ (
6 i P
T Click to edit Master title style !
!
0 ll
R Click to edit Master text styles
Second level
Third level
Fourth level
Fifth level !
S
0 p ``
7 2/26/02
0 t `
?
Pegasus CIMOM
0 x `
@ * H
0 h ? ̙ 33 D e f a u l t D e s i g n 0 P 8 ( m
N آ k k z%
v * K%%KKpp
N 0 k k @%
x * K%%KKpp d
c $ ? XK
4
N k k
M)
R Click to edit Master text styles
Second level
Third level
Fourth level
Fifth level !
S
T k k z
v * K%%KKpp
T ʻ k k @
x * K%%KKpp H
0 .k ? ̙ 33 P $ (
P r
P S | p
r
P S ԡ
`
H
P 0 h ? ̙ 33 E$
# # 0 + (
r
S ` P
g
# l ? 0 - <P CG8
; Monitor
h
# l ` ? 0 - <P p
K
HTTP
Acceptor "
i
# l D ? 0 - <P i
A HTTP
Connection
j
# l x ? 0 - <P
A HTTP
Connection d b
k < G0* H I "8 ^ b
l 6 G) HWJII 8
m
# l ? 0 - <P :
M HTTP
Connection " B
n
b E` FN Q& U V W } ) ) ? X X 63 81-D81^ DS &{'LO^ D+ YL ^0L8]T+ YL7Gn2H+IJ7GI:9]T:I:Q =
qR&Q J
7 JJ
>:* ;9>:+$. +]
x!+]
6381$ 3-D^ D
%D ^0L8]T H+ YL ^0L8]T7G@8Cn2H+IJI:B,=
qR&N7#Q 7 J K
J
7 J>:8* ;9+ +$ x!+ ]
x!+ $ ( ,` C 0* 0* IT NT 0* 0* B C C l o u d
<
Network d b
o @ < GHObIh* G j b
p @ B Z G * H$. I3 @Gi
q
6 Z =g
9 creates
r
# l $ ? 0 - <P p
Z HTTP
Authenticator
Delegator "
s
# l 8 ? 0 - <P P
@
[ CIM Operation
Request
Decoder "
t
# l ? 0 - <P `
@
X CIM Export
Request
Decoder "
u
# l ? 0 - <P
\ CIM Operation
Response
Encoder " d R
v @ < Z GuHb4 Iu " ^ b
w 6 G0* Hh IC *
" ^ b
x 6 G0* HIC "
:
y
# l ? 0 - <P
^ CIM Operation
Request
Dispatcher " ! d b
z < G0* H3I^ yP
d R
{ @ < GYHO IY d b
| < G&* H6 I j d b
} < Z G( HIuc 6
~
< Gq[ H ~
D #2. Socket
Message
< G7 H"
i 7 #3. HTTP Request
Message
#5.HTTP Challenge Response Msg 8 8
< G` H
: k
K #6. HTTP
Request
Messages
< ! Gd H` 0J|
J #8. CIM
Request
Messages
< " G H 0J{
K #9. CIM
Response
Messages
< ) GT Ha P
K #10.HTTP
Response
Message B
b (E` FN Q& U V W } ) ) ? X X 63 81-D81^ DS &{'LO^ D+ YL ^0L8]T+ YL7Gn2H+IJ7GI:9]T:I:Q =
qR&Q J
7 JJ
>:* ;9>:+$. +]
x!+]
6381$ 3-D^ D
%D ^0L8]T H+ YL ^0L8]T7G@8Cn2H+IJI:B,=
qR&N7#Q 7 J K
J
7 J>:8* ;9+ +$ x!+ ]
x!+ $ ( ,` C 0* 0* IT NT 0* 0* B C C l o u d
0;
L Repository and
Providers d R
< Z GHI
< 0 G H F [
K #1. Socket
Ready for read
< 4 G H+ |@
C #11. Socket
Write
# l X8 ? 0 - <P p
` Authentication
Manager . j b
B G0* HBI@ 2
p d b
< G) H'I j"
< > GHk p
L #4. HTTP
Challenge
Message
# l @ ? 0 - <P 00
` " CIM Operation
Request
Authorizer " # d R
< GHGI p
< E Gd H`
J #7. CIM
Request
Messages ^ r
6 GH< I
@:
H
0 h ? 6 g h k 7 g i l 8 n g o 9 h i p : m r v ; r s w < r t x = s z > y u { ? u m | @ y } A ~ B C D E F G m n H I K r T r m U V W X t ̙ 33 u
% ` $ $ (
x
c $ 0
# l P ? 0 - <P P
W Authenticator
(Interface) "
# l $ ? 0 - <P _
U Authentication
Manager "
# l 8 ? 0 - <P p
Z Local
Authentication
Handler " ^ B
6 D f P
P
n
# l ? 0 - <P ` `p
Z Basic
Authentication
Handler "
# l ? 0 - <P p
O Digest
Authentication
Handler X B
0 D f u X B
0 D f u
X B
0 D f uP
P
X B
0 D f n
n ^ B
@
6 D f n0 n
# l ? 0 - <P T
] Basic
Authenticator
(Interface) " ^ B
6 D f N ``
# l d ? 0 - <P pp
A PAM "
# l 8 ? 0 - <P
X Secure
Basic
Authenticator " X B
0 D f 0 0 X B
0 D f X B
0 D f `` X B
0 D f 0
# l ? 0 - <P
X Simple
Basic
Authenticator " ^ B
@
6 D f ^ r
6 G H؛ Iu P_`
d r
@ < Z G Hdu IA2 `
# l " ? 0 - <P 0T
] Local
Authenticator
(Interface) " ^ B
6 D f N
# l ' ? 0 - <P 00
^ File System
Based
Authentication " ! X B
0 D f d b
< Gg HO I6 0
# l , ? 0 - <P `
T
^ Digest
Authenticator
(Interface) " ! d b
< Z G0* H`8I pP
!
T 1 ? GY Hl ? P}
P
P Plug-in Authentication Modules
"
T 5 ? GY Hl ? M
O Plug-in Authentication Module
#
T 8 ? G3 H ? @k
@ HTTP Specific
$
< < GY H7s P
0k
x F Handles HTTP Specific Information, but does not deal with the protocol G G H
0 h ? ! " # $ ̙ 33 s
# )0 K (
0 x
0 c $ 8
0
# l Tz ? 0 - <P P
p
@ User Manager
0
# l H~ ? 0 - <P _
V " CIM Operation
Request
Authorizer # # ^ b
0 6 G&* HHIv _
0
# l , ? 0 - <P P
J Authorization
Handler ^
0 6 G,HI, p
b
%0
B ? } ) ) ?
H Instance
Repository d b
&0 @ < Z G0* H=
I; @o
'0
` ̙ jJ ? Z
Y Load Authorizations * ( 2
(0
` t ̙ jJ ? _
Z Verify Authorization * ( 2
)0
` x ̙ jJ ? `
Z Verify Authorization * ( 2
H
0 0 h ? ? ` 0 0 0 0 0 0 0 %0 &0 ̙ 33 z
* " ( @
l
C l @P
0 Խ `
Z
S t a r t u p :
- C I M S e v e r c r e a t e s t h e H T T P A u t h e n t i c a t o r D e l e g a t o r q u e u e . - H T T P A u t h e n t i c a t o r D e l e g a t o r c r e a t e s A u t h e n t i c a t i o n M a n a g e r - A u t h e n t i c a t i o n M a n a g e r l o a d s t h e A u t h e n t i c a t i o n H a n d l e r s ( C u r r e n t l y i t i s c r e a t i n g i n s t a n c e s o f A u t h e n t i c a t i o n H a n d l e r s , b u t i t s h o u l d b e c h a n g e d t o d y n a m i c a l l y l o a d t h o s e h a n d l e r s ) O n C l i e n t R e q u e s t :
- H T T P C o n n e c t i o n q u e u e g e t s c r e a t e d w h e n t h e r e i s c o n n e c t i o n r e q u e s t f r o m a c l i e n t - H T T P C o n n e c t i o n c r e a t e s A u t h e n t i c a t i o n I n f o o b j e c t t o k e e p t r a c k o f t h e a u t h e n t i c a t i o n i n f o r m a t i o n f o r t h i s c o n n e c t i o n . H T T P C o n n e c t i o n a n d A u t h e n t i c a t i o n I n f o o b j e c t g e t s c r e a t e d f o r e a c h n e w c o n n e c t i o n . - H T T P C o n n e c t i o n g e t s C I M r e q u e s t s , a d d s A u t h e n t i c a t i o n I n f o o b j e c t r e f e r e n c e & p a s s e s t o D e l e g a t o r - D e l e g a t o r p a r s e t h e r e q u e s t a n d l o o k s f o r A u t h o r i z a t i o n o r P e g a s u s A u t h o r i z a t i o n h e a d e r t a g s - I f t h e A u t h o r i z a t i o n a n d P e g a s u s A u t h o r i z a t i o n t a g s a r e n o t f o u n d : * C a l l s g e t A u t h R e s p o n s e H e a d e r ( ) o f t h e A u t h e n t i c a t i o n M a n g e r * S e n d s c h a l l e n g e t o t h e H T T P C o n n e c t i o n q u e u e , a n d e v e n t u a l l y t o t h e c l i e n t - I f t h e A u t h o r i z a t i o n t a g i s f o u n d : * C a l l s p e r f o r m H t t p A u t h e n t i c a t i o n ( ) m e t h o d o f A u t h e n t i c a t i o n M a n a g e r * I f a u t h e n t i c a t i o n i s s u c c e s s f u l , t h e n i t p a s s e s t h e r e q u e s t t o D e c o d e r s . E l s e c a l l s g e t A u t h R e s p o n s e H e a d e r ( ) o f t h e A u t h e n t i c a t i o n M a n g e r a n d s e n d s c h a l l e n g e b a c k . - I f t h e P e g a s u s A u t h o r i z a t i o n t a g i s f o u n d : * C a l l s p e r f o r m P e g a s u s A u t h e n t i c a t i o n ( ) m e t h o d o f A u t h e n t i c a t i o n M a n a g e r * I f a u t h e n t i c a t i o n i s s u c c e s s f u l , t h e n i t p a s s e s t h e r e q u e s t t o D e c o d e r s . E l s e c a l l s g e t A u t h R e s p o n s e H e a d e r ( ) o f t h e A u t h e n t i c a t i o n M a n g e r a n d s e n d s c h a l l e n g e b a c k .
- I n a l l t h e s e c a s e s t h e A u t h e n t i c a t i o n I n f o o b j e c t i s u p d a t e d w i t h t h e a u t h e n t i c a t i o n s t a t u s f o r t h a t c o n n e c t i o n s e s s i o n . 8 2 + i H
0 h ? ̙ 33 F
$ ( `
$ r
$ S @
$
0
t Authentication Manager - AuthenticationManager loads the Authentication Handlers - When perforHttpAuthentication() or performPegasusAuthentication() methods are called
* it parses the HTTP headers to get the auth type, user name & password information
* calls authenticate() method of the Authentication Handler module
* On successful authentication, updates AuthenticationInfo object and returns true else false
- When getAuthResoponseHeader() method is called, it gets the header from Authentication Handlers
Authentication Handlers (LocalAuthenticationHandler) - Implements the Authenticator interface - Creates response header when getAuthResoponseHeader() method is called (may get the header information from the authenticator module). - Extracts user name and password (or digest string) from the header info passed with the authenticate() and calls the authenticate() method of the loaded authenticator module.
Authenticators (SecureLocalAuthenticator) - Implements specific authenticator interface (e.g, BasicAuthenticator) - The getAuthResponseHeader() method will return the authentication challenge header info. - The authenticate() method will verify the user name and password or the digest string and return true on successful authentication, false otherwise. V 2 d = H
$ 0 h ? ̙ 33
8 = (
8 r
8 S
8
0 { M` @
+ Startup:
- CIMSever creates the CIMOperationRequestAuthorizer queue if requireAuthorization config property is set to true. - CIMOperationRequestAuthorizer gets an instance of UserManager
- UserManager creates AuthirizationHandler - AuthenticationHandler loads authorizations from the Repository.
On Client Request:
- CIMOperationRequestAuthorizer queue receives a request message from Decoder
- CIMOperationRequestAuthorizer calls verifyAuthorization( ) method of UserManager.
- UserManager calls verifyAuthorization( ) method of AuthorizationHandler.
- AuthorizationHandler verifies the authorizations and return true if authorization were found else false 8 2 " Z : + / S H
8 0 h ? ̙ 33
r j < (
< r
< S D @
P
<
0 b
0 C I M O p e r a t i o n R e q u e s t A u t h o r i z e r - G e t s t h e u s e r n a m e , n a m e s p a c e , a u t h e n t i c a t i o n t y p e a n d C I M m e t h o d n a m e s f r o m t h e C I M r e q u e s t
- C a l l s U s e r M a n a g e r s v e r i f y A u t h o r i z a t i o n ( ) m e t h o d
U s e r M a n a g e r - C r e a t e s A u t h i r i z a t i o n H a n d l e r a n d c a l l s i t s v e r i f y A u t h o r i z a t i o n ( ) m e t h o d
A u t h o r i z a t i o n H a n d l e r
- L o a d s a u t h o r i z a t i o n s f r o m t h e r e p o s i t o r y - V e r i f i e s u s e r a u t h o r i z a t i o n s w h e n v e r i f y A u t h o r i z a t i o n ( ) m e t h o d i s c a l l e d B 2 L x Z h ! $
q H
< 0 h ? ̙ 33 3
s ( @c@ @N@
r
S ( @@
0 3 v
a Configuration Properties required for Authentication Module
requireAuthentication = true | false
httpAuthType = Basic | Digest
passwordFilePath = cimserver.passwd (use the file in PEGASUS_HOME directory)
Configuration Properties required for Authorization Module
requireAuthorization = true | false
enableRemotePrivilegedUserAccess = true | false (enable or disable remote root access to the cimom)
0 2 < ; t
g < H
0 h ? ̙ 33 $
( d (
( r
( S <
(
0 @ p`
R 1 . S e t t h e f o l l o w i n g c o n f i g u r a t i o n p r o p e r t i e s i n t h e c i m s e r v e r _ p l a n n e d . c o n f f i l e
r e q u i r e A u t h e n t i c a t i o n = t r u e
h t t p A u t h T y p e = B a s i c ( t o e n a b l e H T T P B a s i c A u t h e n t i c a t i o n )
p a s s w o r d F i l e P a t h = c i m s e r v e r . p a s s w d ( t o c r e a t e / u s e t h e p a s s w o r d f i l e i n P E G A S U S _ H O M E d i r e c t o r y )
3 . S t a r t c i m s e r v e r
4 . A d d n e w u s e r s t o c i m o m ( R e f e r t o p e g a s u s / s r c / C l i e n t s / c i m u s e r / d o c / c i m u s e r . h t m )
T o a d d u s e r n a g w i t h p a s s w o r d n a g ( u s e r n a g m u s t b e v a l i d s y s t e m u s e r o n t h a t s y s t e m )
c i m u s e r - a - u n a g - w n a g
5 . R u n a n y C I M c l i e n t s t o d o C I M o p e r a t i o n s w i t h t h e c i m o m .
N o t e :
( 1 ) O n U n i x s y s t e m s , t h e c i m u s e r C L I c a n o n l y b e r u n l o c a l l y a s r o o t .
( 2 ) B a s i c / D i g e s t a u t h e n t i c a t i o n a r e n o t f u l l y i m p l e m e n t e d o n t h e C I M S e r v e r a n d t h e C I M C l i e n t A P I . 2 L 4
0 D
f F # h H
( 0 h ? ̙ 33
, & (
, r
, S `
t
,
0 ` n
1 . S e t t h e f o l l o w i n g c o n f i g u r a t i o n p r o p e r t i e s i n t h e c i m s e r v e r _ p l a n n e d . c o n f f i l e
r e q u i r e A u t h o r i z a t i o n = t r u e
e n a b l e R e m o t e P r i v i l e g e d U s e r A c c e s s = f a l s e ( t o d i s a b l e r e m o t e r o o t u s e r a c c e s s t o t h e c i m o m )
2 . S t a r t c i m s e r v e r
3 . A d d a u t h o r i z a t i o n s t o t h e C I M u s e r s ( R e f e r t o p e g a s u s / s r c / C l i e n t s / c i m u s e r / d o c / c i m a u t h . h t m l )
T o a d d b o t h r e a d a n d r i g h t a u t h o r i z a t i o n s t o u s e r n a g o n n a m e s p a c e r o o t / c i m v 2
c i m a u t h - a - u n a g - n r o o t / c i m v 2 - R - W
4 . R u n a n y C I M c l i e n t s t o d o C I M o p e r a t i o n s w i t h t h e c i m o m .
N o t e :
( 1 ) O n U n i x s y s t e m s , u s e r r o o t b y d e f a u l t w i l l h a v e a l l t h e a u t h o r i z a t i o n s f o r l o c a l c l i e n t s ( t h e c l i e n t s t h a t u s e C o n n e c t L o c a l ( ) o f C I M C l i e n t A P I .
( 2 ) T h e c i m a u t h C L I c a n o n l y b e r u n l o c a l l y a s r o o t o n U n i x s y s t e m s . 2 4
" 3
1 \ S
7 H
, 0 h ? ̙ 33 0 z r @
(
X
C XK
r
S Ի
M)
H
0 .k ? ̙ 33 0 ~ p ( |
^
S XK
x
c $ XD
M)
H
0 .k ? ̙ 33 0 ~ 4 ( I;
4 ^
4 S XK
x
4 c $ t
M)
H
4 0 .k ? ̙ 33 rL Ya 8 M a? p 3 _ W ݝ )x .~ (
( @
/ 0 D T i m e s N e w R o m a n l4 t !0 hz0 D F u t u r a L t R o m a n l4 t !0 hz0 " D C o m i c S a n s M S n l4 t !0 hz0 B
` .
@ n ? " d d @ @@ `` On-screen Show Hewlett Packard 4 2 Times New Roman
Futura Lt Comic Sans MS Default Design Pegasus Security Architecture Security Architecture Authentication Authorization Authentication Implementation Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization Fonts Used Design Template
Slide Titles
Slide Title _ AIT A I T _- AIT A I T - - & G &
JwSwgw
- @ Times New Roman Swgw
- @@ `` T
%
*
& ,
c $ @ f 3 @ { g 4 N d N d !0 p p p @ < 4 ! d ! d 0< X5 < 4 B d B d o0< u ʚ;2N ʚ; < 4 d d d d 0 ?
O =
Pegasus Security Implementation + Author: Nag Boranna
Hewlett-Packard Company , , Security Architecture Authentication
Authorization
Authentication Implementation
Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization / T E$
# # 0 + (
r
S ` P
g
# l ? 0 - <P CG8
; Monitor
h
# l ` ? 0 - <P p
K
HTTP
Acceptor "
i
# l D ? 0 - <P i
A HTTP
Connection
j
# l x ? 0 - <P
A HTTP
Connection d b
k < G0* H I "8 ^ b
l 6 G) HWJII 8
m
# l ? 0 - <P :
M HTTP
Connection " B
n
b E` FN Q& U V W } ) ) ? X X 63 81-D81^ DS &{'LO^ D+ YL ^0L8]T+ YL7Gn2H+IJ7GI:9]T:I:Q =
qR&Q J
7 JJ
>:* ;9>:+$. +]
x!+]
6381$ 3-D^ D
%D ^0L8]T H+ YL ^0L8]T7G@8Cn2H+IJI:B,=
qR&N7#Q 7 J K
J
7 J>:8* ;9+ +$ x!+ ]
x!+ $ ( ,` C 0* 0* IT NT 0* 0* B C C l o u d
<
Network d b
o @ < GHObIh* G j b
p @ B Z G * H$. I3 @Gi
q
6 Z =g
9 creates
r
# l $ ? 0 - <P p
Z HTTP
Authenticator
Delegator "
s
# l 8 ? 0 - <P P
@
[ CIM Operation
Request
Decoder "
t
# l ? 0 - <P `
@
X CIM Export
Request
Decoder "
u
# l ? 0 - <P
\ CIM Operation
Response
Encoder " d R
v @ < Z GuHb4 Iu " ^ b
w 6 G0* Hh IC *
" ^ b
x 6 G0* HIC "
:
y
# l ? 0 - <P
^ CIM Operation
Request
Dispatcher " ! d b
z < G0* H3I^ yP
d R
{ @ < GYHO IY d b
| < G&* H6 I j d b
} < Z G( HIuc 6
~
< Gq[ H ~
D #2. Socket
Message
< G7 H"
i 7 #3. HTTP Request
Message
#5.HTTP Challenge Response Msg 8 8
< G` H
: k
K #6. HTTP
Request
Messages
< ! Gd H` 0J|
J #8. CIM
Request
Messages
< " G H 0J{
K #9. CIM
Response
Messages
< ) GT Ha P
K #10.HTTP
Response
Message B
b (E` FN Q& U V W } ) ) ? X X 63 81-D81^ DS &{'LO^ D+ YL ^0L8]T+ YL7Gn2H+IJ7GI:9]T:I:Q =
qR&Q J
7 JJ
>:* ;9>:+$. +]
x!+]
6381$ 3-D^ D
%D ^0L8]T H+ YL ^0L8]T7G@8Cn2H+IJI:B,=
qR&N7#Q 7 J K
J
7 J>:8* ;9+ +$ x!+ ]
x!+ $ ( ,` C 0* 0* IT NT 0* 0* B C C l o u d
0;
L Repository and
Providers d R
< Z GHI
< 0 G H F [
K #1. Socket
Ready for read
< 4 G H+ |@
C #11. Socket
Write
# l X8 ? 0 - <P p
` Authentication
Manager . j b
B G0* HBI@ 2
p d b
< G) H'I j"
< > GHk p
L #4. HTTP
Challenge
Message
# l @ ? 0 - <P 00
` " CIM Operation
Request
Authorizer " # d R
< GHGI p
< E Gd H`
J #7. CIM
Request
Messages ^ r
6 GH< I
@:
H
0 h ? 6 g h k 7 g i l 8 n g o 9 h i p : m r v ; r s w < r t x = s z > y u { ? u m | @ y } A ~ B C D E F G m n H I K r T r m
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P l R T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h x k m n o p q S t u v w Q z { | } ~ R o o t E n t r y dO ) P=cs
C u r r e n t U s e r 2 ) S u m m a r y I n f o r m a t i o n ( H P o w e r P o i n t D o c u m e n t ( 4 D o c u m e n t S u m m a r y I n f o r m a t i o n 8 % , T
%
*
& ,
c $ @ f 3 @ { g 4 N d N d !0 p p p @ < 4 ! d ! d 0< X5 < 4 B d B d o0< u ʚ;2N ʚ; < 4 d d d d 0 ?
O =
Pegasus Security Implementation + Author: Nag Boranna
Hewlett-Packard Company , , Security Block Diagram Authentication Block Diagram
Authorization Block Diagram Authentication Implementation
Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization / T P $ (
P r
P S | `
r
P S ԡ 0 `
H
P 0 h ? ̙ 33 r # )
( @
/ 0 D T i m e s N e w R o m a n l4 t !0 hz0 D F u t u r a L t R o m a n l4 t !0 hz0 " D C o m i c S a n s M S n l4 t !0 hz0 B
` .
@ n ? " d d @
! " # $ 3 & ' ( ) * + , - . / 0 1 Oh +'0
p x
@ L X
d p x Pegasus Security e Nag Boranna X Gives an overview of Pegasus Authentication and Authorization Implementation and usage. AIT 228 Microsoft PowerPoint Peg@ 0q @ G_06L@ p*()@ U G g 3 & & & # TNPP 2 O M i t
&
TNPP & & TNPP
- - - ! - - - & G &
MJwSwgw
M
- @ Times New Roman Swgw
3
- . 2
R 2/26/02 . & y & . 2
f 1 . - - q @ - - @ Times New Roman Swgw
S
- . 3 2
w Pegasus Security Architecture ! ! * . - - ! - - @ BComic Sans MS wSwgw
6
- . $ 2
4 Author: Nag Boranna
. @ BComic Sans MS wSwgw
W
- . 2
. Hewlett
. . 2
- . . 2
Packard Company
. - - "System wf
- & TNPP & ՜. +,0
U V W X t ̙ 33 u
% ` $ $ (
x
c $ 0
# l P ? 0 - <P P
W Authenticator
(Interface) "
# l $ ? 0 - <P _
U Authentication
Manager "
# l 8 ? 0 - <P p
Z Local
Authentication
Handler " ^ B
6 D f P
P
n
# l ? 0 - <P ` `p
Z Basic
Authentication
Handler "
# l ? 0 - <P p
O Digest
Authentication
Handler X B
0 D f u X B
0 D f u
X B
0 D f uP
P
X B
0 D f n
n ^ B
@
6 D f n0 n
# l ? 0 - <P T
] Basic
Authenticator
(Interface) " ^ B
6 D f N ``
# l d ? 0 - <P pp
A PAM "
# l 8 ? 0 - <P
X Secure
Basic
Authenticator " X B
0 D f 0 0 X B
0 D f X B
0 D f `` X B
0 D f 0
# l ? 0 - <P
X Simple
Basic
Authenticator " ^ B
@
6 D f ^ r
6 G H؛ Iu P_`
d r
@ < Z G Hdu IA2 `
# l " ? 0 - <P 0T
] Local
Authenticator
(Interface) " ^ B
6 D f N
# l ' ? 0 - <P 00
^ File System
Based
Authentication " ! X B
0 D f d b
< Gg HO I6 0
# l , ? 0 - <P `
T
^ Digest
Authenticator
(Interface) " ! d b
< Z G0* H`8I pP
!
T 1 ? GY Hl ? P}
P
P Plug-in Authentication Modules
"
T 5 ? GY Hl ? M
O Plug-in Authentication Module
#
T 8 ? G3 H ? @k
@ HTTP Specific
$
< < GY H7s P
0k
x F Handles HTTP Specific Information, but does not deal with the protocol G G H
0 h ? ! " # $ ̙ 33 s
# )0 K (
0 x
0 c $ 8
0
# l Tz ? 0 - <P P
p
@ User Manager
0
# l H~ ? 0 - <P _
V " CIM Operation
Request
Authorizer # # ^ b
0 6 G&* HHIv _
0
# l , ? 0 - <P P
J Authorization
Handler ^
0 6 G,HI, p
b
%0
B ? } ) ) ?
H Instance
Repository d b
&0 @ < Z G0* H=
I; @o
'0
` ̙ jJ ? Z
Y Load Authorizations * ( 2
(0
` t ̙ jJ ? _
Z Verify Authorization * ( 2
)0
` x ̙ jJ ? `
Z Verify Authorization * ( 2
H
0 0 h ? ? ` 0 0 0 0 0 0 0 %0 &0 ̙ 33 r Q :
- ( @
/ 0 D T i m e s N e w R o m a n T5 t !0 hz0 D F u t u r a L t R o m a n T5 t !0 hz0 " D C o m i c S a n s M S n T5 t !0 hz0 B
` .
@ n ? " d d @ @@ `` T %
*
& , c $ @ f 3 @ { g 4 N d N d !0 p p p @ < 4 ! d ! d 0< @6 < 4 B d B d o0< u ʚ;2N ʚ; < 4 d d d d 0 ?
O =
Pegasus Security Architecture + Author: Nag Boranna
Hewlett-Packard Company " , Security Architecture Authentication
Authorization
Authentication Implementation
Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization / T P $ (
P r
P S `
r
P S x 0 `
H
P 0 h ? ̙ 33 r
( @
/ 0 D T i m e s N e w R o m a n T5 t \ !0 t hz0 D F u t u r a L t R o m a n T5 t \ !0 t hz0 " D C o m i c S a n s M S n T5 t \ !0 t hz0 B
` .
@ n ? " d d @ @@ `` T %
*
& , c $ @ f 3 @ { g 4 N d N d !0 h p p p @ < 4 ! d ! d 0$ @6 < 4 B d B d o0$ u ʚ;2N ʚ; < 4 d d d d 0 ?
O =
Pegasus Security Architecture + Author: Nag Boranna
Hewlett-Packard Company " , Security Architecture Authentication
Authorization
Authentication Implementation
Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization / T r
( @
/ 0 D T i m e s N e w R o m a n T5 t !0 hz0 D F u t u r a L t R o m a n T5 t !0 hz0 " D C o m i c S a n s M S n T5 t !0 hz0 B
` .
@ n ? " d d @ @@ `` T %
*
& , c $ @ f 3 @ { g 4 N d N d !0 p p p @ < 4 ! d ! d 0< @6 < 4 B d B d o0< u ʚ;2N ʚ; < 4 d d d d 0 ?
O =
Pegasus Security Architecture + Author: Nag Boranna
Hewlett-Packard Company " , Security Architecture Authentication
Authorization
Authentication Implementation
Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization / T r
R o o t E n t r y dO ) `@s
C u r r e n t U s e r 2 * S u m m a r y I n f o r m a t i o n ( H P o w e r P o i n t D o c u m e n t ( 4 k
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P l T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h x m n o p q S t u v w Q z { | } ~
! " # $ 3 & ' ( ) * + , - . / 0 1 horization Fonts Used Design Template
Slide Titles
Slide Title " _
Bapu Patil _- AIT A I T - - & G &
JwSwgw
- @ Times New Roman Swgw
-