1 kumpf 1.1 ࡱ > ( @
2 b / 0 D T i m e s N e w R o m a n l4 t !0 hz0 D F u t u r a L t R o m a n l4 t !0 hz0 "
3 ` .
4 @ n ? " d d @ @@ `` T
%
*
5 & ,
6 c $ @ f 3 @ { g 4 6 d 6 d !0 p p p @ < 4 ! d ! d 0< X5 < 4 B d B d o0< u ʚ;2N ʚ; < 4 d d d d 0 ?
O =
7 Pegasus Security Implementation + Author: Nag Boranna
Hewlett-Packard Company Security Block Diagram Authentication Block Diagram
Authorization Block Diagram Authentication Implementation
8 Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization / T ` ` ̙ 33 ` 333 MMM ` ff3 33 3 f ` f ` f ` 3 > ? " d d @ , | ? " d d @ " @ ` n ? " d d @ @@ `` P R @ ` ` p > > ^ (
9
10
11 6 i P
T Click to edit Master title style !
12 !
13
14 0 ll
R Click to edit Master text styles
Second level
Third level
Fourth level
Fifth level !
15 S
16
17 0 p ``
7 2/26/02
18
19 0 t `
?
Pegasus CIMOM
20
21 0 x `
@ * H
22 kumpf 1.1 0 h ? ̙ 33 D e f a u l t D e s i g n 0 P 8 ( m
23
24
25 N آ k k z%
26
v * K%%KKpp
27
28 N 0 k k @%
x * K%%KKpp d
29
30 c $ ? XK
31 4
32
33 N k k
34 M)
R Click to edit Master text styles
Second level
Third level
Fourth level
Fifth level !
35 S
36
37 T k k z
v * K%%KKpp
38
39 T ʻ k k @
x * K%%KKpp H
40 0 .k ? ̙ 33 P $ (
41 P r
42 P S | p
r
43 kumpf 1.1 P S ԡ
44 `
H
45 P 0 h ? ̙ 33 E$
# # 0 + (
46 r
47 S ` P
48 g
49 # l ? 0 - <P CG8
; Monitor
50 h
51 # l ` ? 0 - <P p
K
HTTP
Acceptor "
52 i
53 # l D ? 0 - <P i
A HTTP
Connection
54 j
55 # l x ? 0 - <P
A HTTP
Connection d b
56 k < G0* H I "8 ^ b
57 l 6 G) HWJII 8
58 m
59 # l ? 0 - <P :
M HTTP
Connection " B
60 n
61 b E` FN Q& U V W } ) ) ? X X 63 81-D81^ DS &{'LO^ D+ YL ^0L8]T+ YL7Gn2H+IJ7GI:9]T:I:Q =
62 qR&Q J
63 7 JJ
64 kumpf 1.1 >:* ;9>:+$. +]
65 x!+]
66 6381$ 3-D^ D
%D ^0L8]T H+ YL ^0L8]T7G@8Cn2H+IJI:B,=
67 qR&N7#Q 7 J K
J
68 7 J>:8* ;9+ +$ x!+ ]
69 x!+ $ ( ,` C 0* 0* IT NT 0* 0* B C C l o u d
<
Network d b
70 o @ < GHObIh* G j b
71 p @ B Z G * H$. I3 @Gi
72 q
73 6 Z =g
9 creates
74 r
75 # l $ ? 0 - <P p
Z HTTP
Authenticator
Delegator "
76 s
77 # l 8 ? 0 - <P P
78
@
[ CIM Operation
Request
Decoder "
79 t
80 # l ? 0 - <P `
@
X CIM Export
Request
Decoder "
81 u
82 # l ? 0 - <P
\ CIM Operation
Response
Encoder " d R
83 v @ < Z GuHb4 Iu " ^ b
84 w 6 G0* Hh IC *
" ^ b
85 kumpf 1.1 x 6 G0* HIC "
:
86 y
87 # l ? 0 - <P
^ CIM Operation
Request
Dispatcher " ! d b
88 z < G0* H3I^ yP
89 d R
90 { @ < GYHO IY d b
91 | < G&* H6 I j d b
92 } < Z G( HIuc 6
93
94 ~
95 < Gq[ H ~
D #2. Socket
Message
96
97 < G7 H"
i 7 #3. HTTP Request
Message
#5.HTTP Challenge Response Msg 8 8
98
99 < G` H
100 : k
K #6. HTTP
Request
Messages
101
102 < ! Gd H` 0J|
J #8. CIM
Request
Messages
103
104 < " G H 0J{
K #9. CIM
Response
Messages
105
106 kumpf 1.1 < ) GT Ha P
107
K #10.HTTP
Response
Message B
108
109 b (E` FN Q& U V W } ) ) ? X X 63 81-D81^ DS &{'LO^ D+ YL ^0L8]T+ YL7Gn2H+IJ7GI:9]T:I:Q =
110 qR&Q J
111 7 JJ
112 >:* ;9>:+$. +]
113 x!+]
114 6381$ 3-D^ D
%D ^0L8]T H+ YL ^0L8]T7G@8Cn2H+IJI:B,=
115 qR&N7#Q 7 J K
J
116 7 J>:8* ;9+ +$ x!+ ]
117 x!+ $ ( ,` C 0* 0* IT NT 0* 0* B C C l o u d
118 0;
L Repository and
Providers d R
119 < Z GHI
120
121 < 0 G H F [
K #1. Socket
Ready for read
122
123 < 4 G H+ |@
C #11. Socket
Write
124
125 # l X8 ? 0 - <P p
126
` Authentication
Manager . j b
127 kumpf 1.1 B G0* HBI@ 2
128 p d b
129 < G) H'I j"
130
131 < > GHk p
L #4. HTTP
Challenge
Message
132
133 # l @ ? 0 - <P 00
` " CIM Operation
Request
Authorizer " # d R
134 < GHGI p
135
136 < E Gd H`
137
J #7. CIM
Request
Messages ^ r
138 6 GH< I
139 @:
H
140 0 h ? 6 g h k 7 g i l 8 n g o 9 h i p : m r v ; r s w < r t x = s z > y u { ? u m | @ y } A ~ B C D E F G m n H I K r T r m U V W X t ̙ 33 u
% ` $ $ (
141 x
142 c $ 0
143
144 # l P ? 0 - <P P
W Authenticator
(Interface) "
145
146 # l $ ? 0 - <P _
U Authentication
Manager "
147
148 kumpf 1.1 # l 8 ? 0 - <P p
Z Local
Authentication
Handler " ^ B
149
150 6 D f P
151 P
152 n
153
154 # l ? 0 - <P ` `p
Z Basic
Authentication
Handler "
155
156 # l ? 0 - <P p
O Digest
Authentication
Handler X B
157
158 0 D f u X B
159
160
161 0 D f u
X B
162
163 0 D f uP
164 P
165 X B
166
167 0 D f n
n ^ B
168
@
169 kumpf 1.1 6 D f n0 n
170
171 # l ? 0 - <P T
] Basic
Authenticator
(Interface) " ^ B
172
173 6 D f N ``
174
175 # l d ? 0 - <P pp
A PAM "
176
177 # l 8 ? 0 - <P
X Secure
Basic
Authenticator " X B
178
179 0 D f 0 0 X B
180
181 0 D f X B
182
183 0 D f `` X B
184
185 0 D f 0
186
187 # l ? 0 - <P
188
X Simple
Basic
Authenticator " ^ B
189 @
190 kumpf 1.1 6 D f ^ r
191 6 G H؛ Iu P_`
192 d r
193 @ < Z G Hdu IA2 `
194
195
196 # l " ? 0 - <P 0T
] Local
Authenticator
(Interface) " ^ B
197
198 6 D f N
199
200 # l ' ? 0 - <P 00
^ File System
Based
Authentication " ! X B
201
202 0 D f d b
203 < Gg HO I6 0
204
205
206 # l , ? 0 - <P `
207 T
^ Digest
Authenticator
(Interface) " ! d b
208 < Z G0* H`8I pP
209
210 !
211 kumpf 1.1 T 1 ? GY Hl ? P}
212 P
P Plug-in Authentication Modules
213 "
214 T 5 ? GY Hl ? M
O Plug-in Authentication Module
215 #
216 T 8 ? G3 H ? @k
@ HTTP Specific
217 $
218 < < GY H7s P
0k
x F Handles HTTP Specific Information, but does not deal with the protocol G G H
219 0 h ? ! " # $ ̙ 33 s
# )0 K (
220 0 x
221 0 c $ 8
222 0
223 # l Tz ? 0 - <P P
224 p
@ User Manager
225 0
226 # l H~ ? 0 - <P _
V " CIM Operation
Request
Authorizer # # ^ b
227 0 6 G&* HHIv _
228
229 0
230 # l , ? 0 - <P P
J Authorization
Handler ^
231 0 6 G,HI, p
b
232 kumpf 1.1 %0
233 B ? } ) ) ?
H Instance
Repository d b
234 &0 @ < Z G0* H=
235 I; @o
236 '0
237 ` ̙ jJ ? Z
Y Load Authorizations * ( 2
238
239 (0
240 ` t ̙ jJ ? _
Z Verify Authorization * ( 2
241
242 )0
243 ` x ̙ jJ ? `
244
Z Verify Authorization * ( 2
245 H
246 0 0 h ? ? ` 0 0 0 0 0 0 0 %0 &0 ̙ 33 z
* " ( @
247 l
248 C l @P
249
250 0 Խ `
Z
S t a r t u p :
- C I M S e v e r c r e a t e s t h e H T T P A u t h e n t i c a t o r D e l e g a t o r q u e u e . - H T T P A u t h e n t i c a t o r D e l e g a t o r c r e a t e s A u t h e n t i c a t i o n M a n a g e r - A u t h e n t i c a t i o n M a n a g e r l o a d s t h e A u t h e n t i c a t i o n H a n d l e r s ( C u r r e n t l y i t i s c r e a t i n g i n s t a n c e s o f A u t h e n t i c a t i o n H a n d l e r s , b u t i t s h o u l d b e c h a n g e d t o d y n a m i c a l l y l o a d t h o s e h a n d l e r s ) O n C l i e n t R e q u e s t :
- H T T P C o n n e c t i o n q u e u e g e t s c r e a t e d w h e n t h e r e i s c o n n e c t i o n r e q u e s t f r o m a c l i e n t - H T T P C o n n e c t i o n c r e a t e s A u t h e n t i c a t i o n I n f o o b j e c t t o k e e p t r a c k o f t h e a u t h e n t i c a t i o n i n f o r m a t i o n f o r t h i s c o n n e c t i o n . H T T P C o n n e c t i o n a n d A u t h e n t i c a t i o n I n f o o b j e c t g e t s c r e a t e d f o r e a c h n e w c o n n e c t i o n . - H T T P C o n n e c t i o n g e t s C I M r e q u e s t s , a d d s A u t h e n t i c a t i o n I n f o o b j e c t r e f e r e n c e & p a s s e s t o D e l e g a t o r - D e l e g a t o r p a r s e t h e r e q u e s t a n d l o o k s f o r A u t h o r i z a t i o n o r P e g a s u s A u t h o r i z a t i o n h e a d e r t a g s - I f t h e A u t h o r i z a t i o n a n d P e g a s u s A u t h o r i z a t i o n t a g s a r e n o t f o u n d : * C a l l s g e t A u t h R e s p o n s e H e a d e r ( ) o f t h e A u t h e n t i c a t i o n M a n g e r * S e n d s c h a l l e n g e t o t h e H T T P C o n n e c t i o n q u e u e , a n d e v e n t u a l l y t o t h e c l i e n t - I f t h e A u t h o r i z a t i o n t a g i s f o u n d : * C a l l s p e r f o r m H t t p A u t h e n t i c a t i o n ( ) m e t h o d o f A u t h e n t i c a t i o n M a n a g e r * I f a u t h e n t i c a t i o n i s s u c c e s s f u l , t h e n i t p a s s e s t h e r e q u e s t t o D e c o d e r s . E l s e c a l l s g e t A u t h R e s p o n s e H e a d e r ( ) o f t h e A u t h e n t i c a t i o n M a n g e r a n d s e n d s c h a l l e n g e b a c k . - I f t h e P e g a s u s A u t h o r i z a t i o n t a g i s f o u n d : * C a l l s p e r f o r m P e g a s u s A u t h e n t i c a t i o n ( ) m e t h o d o f A u t h e n t i c a t i o n M a n a g e r * I f a u t h e n t i c a t i o n i s s u c c e s s f u l , t h e n i t p a s s e s t h e r e q u e s t t o D e c o d e r s . E l s e c a l l s g e t A u t h R e s p o n s e H e a d e r ( ) o f t h e A u t h e n t i c a t i o n M a n g e r a n d s e n d s c h a l l e n g e b a c k .
- I n a l l t h e s e c a s e s t h e A u t h e n t i c a t i o n I n f o o b j e c t i s u p d a t e d w i t h t h e a u t h e n t i c a t i o n s t a t u s f o r t h a t c o n n e c t i o n s e s s i o n . 8 2 + i H
251 0 h ? ̙ 33 F
$ ( `
252 $ r
253 kumpf 1.1 $ S @
254 $
255 0
t Authentication Manager - AuthenticationManager loads the Authentication Handlers - When perforHttpAuthentication() or performPegasusAuthentication() methods are called
* it parses the HTTP headers to get the auth type, user name & password information
* calls authenticate() method of the Authentication Handler module
* On successful authentication, updates AuthenticationInfo object and returns true else false
- When getAuthResoponseHeader() method is called, it gets the header from Authentication Handlers
Authentication Handlers (LocalAuthenticationHandler) - Implements the Authenticator interface - Creates response header when getAuthResoponseHeader() method is called (may get the header information from the authenticator module). - Extracts user name and password (or digest string) from the header info passed with the authenticate() and calls the authenticate() method of the loaded authenticator module.
Authenticators (SecureLocalAuthenticator) - Implements specific authenticator interface (e.g, BasicAuthenticator) - The getAuthResponseHeader() method will return the authentication challenge header info. - The authenticate() method will verify the user name and password or the digest string and return true on successful authentication, false otherwise. V 2 d = H
256 $ 0 h ? ̙ 33
8 = (
257 8 r
258 8 S
259 8
260 0 { M` @
+ Startup:
- CIMSever creates the CIMOperationRequestAuthorizer queue if requireAuthorization config property is set to true. - CIMOperationRequestAuthorizer gets an instance of UserManager
- UserManager creates AuthirizationHandler - AuthenticationHandler loads authorizations from the Repository.
On Client Request:
- CIMOperationRequestAuthorizer queue receives a request message from Decoder
- CIMOperationRequestAuthorizer calls verifyAuthorization( ) method of UserManager.
- UserManager calls verifyAuthorization( ) method of AuthorizationHandler.
- AuthorizationHandler verifies the authorizations and return true if authorization were found else false 8 2 " Z : + / S H
261 8 0 h ? ̙ 33
r j < (
262 < r
263 < S D @
P
264 <
265 0 b
0 C I M O p e r a t i o n R e q u e s t A u t h o r i z e r - G e t s t h e u s e r n a m e , n a m e s p a c e , a u t h e n t i c a t i o n t y p e a n d C I M m e t h o d n a m e s f r o m t h e C I M r e q u e s t
- C a l l s U s e r M a n a g e r s v e r i f y A u t h o r i z a t i o n ( ) m e t h o d
U s e r M a n a g e r - C r e a t e s A u t h i r i z a t i o n H a n d l e r a n d c a l l s i t s v e r i f y A u t h o r i z a t i o n ( ) m e t h o d
A u t h o r i z a t i o n H a n d l e r
- L o a d s a u t h o r i z a t i o n s f r o m t h e r e p o s i t o r y - V e r i f i e s u s e r a u t h o r i z a t i o n s w h e n v e r i f y A u t h o r i z a t i o n ( ) m e t h o d i s c a l l e d B 2 L x Z h ! $
q H
266 < 0 h ? ̙ 33 3
s ( @c@ @N@
267 r
268 S ( @@
269
270 0 3 v
a Configuration Properties required for Authentication Module
requireAuthentication = true | false
httpAuthType = Basic | Digest
passwordFilePath = cimserver.passwd (use the file in PEGASUS_HOME directory)
Configuration Properties required for Authorization Module
requireAuthorization = true | false
enableRemotePrivilegedUserAccess = true | false (enable or disable remote root access to the cimom)
0 2 < ; t
271 g < H
272 0 h ? ̙ 33 $
( d (
273 ( r
274 kumpf 1.1 ( S <
275 (
276 0 @ p`
R 1 . S e t t h e f o l l o w i n g c o n f i g u r a t i o n p r o p e r t i e s i n t h e c i m s e r v e r _ p l a n n e d . c o n f f i l e
r e q u i r e A u t h e n t i c a t i o n = t r u e
h t t p A u t h T y p e = B a s i c ( t o e n a b l e H T T P B a s i c A u t h e n t i c a t i o n )
p a s s w o r d F i l e P a t h = c i m s e r v e r . p a s s w d ( t o c r e a t e / u s e t h e p a s s w o r d f i l e i n P E G A S U S _ H O M E d i r e c t o r y )
3 . S t a r t c i m s e r v e r
4 . A d d n e w u s e r s t o c i m o m ( R e f e r t o p e g a s u s / s r c / C l i e n t s / c i m u s e r / d o c / c i m u s e r . h t m )
T o a d d u s e r n a g w i t h p a s s w o r d n a g ( u s e r n a g m u s t b e v a l i d s y s t e m u s e r o n t h a t s y s t e m )
c i m u s e r - a - u n a g - w n a g
5 . R u n a n y C I M c l i e n t s t o d o C I M o p e r a t i o n s w i t h t h e c i m o m .
N o t e :
( 1 ) O n U n i x s y s t e m s , t h e c i m u s e r C L I c a n o n l y b e r u n l o c a l l y a s r o o t .
( 2 ) B a s i c / D i g e s t a u t h e n t i c a t i o n a r e n o t f u l l y i m p l e m e n t e d o n t h e C I M S e r v e r a n d t h e C I M C l i e n t A P I . 2 L 4
277 0 D
278
279 f F # h H
280 ( 0 h ? ̙ 33
, & (
281 , r
282 , S `
t
283 ,
284 0 ` n
1 . S e t t h e f o l l o w i n g c o n f i g u r a t i o n p r o p e r t i e s i n t h e c i m s e r v e r _ p l a n n e d . c o n f f i l e
r e q u i r e A u t h o r i z a t i o n = t r u e
e n a b l e R e m o t e P r i v i l e g e d U s e r A c c e s s = f a l s e ( t o d i s a b l e r e m o t e r o o t u s e r a c c e s s t o t h e c i m o m )
2 . S t a r t c i m s e r v e r
3 . A d d a u t h o r i z a t i o n s t o t h e C I M u s e r s ( R e f e r t o p e g a s u s / s r c / C l i e n t s / c i m u s e r / d o c / c i m a u t h . h t m l )
T o a d d b o t h r e a d a n d r i g h t a u t h o r i z a t i o n s t o u s e r n a g o n n a m e s p a c e r o o t / c i m v 2
c i m a u t h - a - u n a g - n r o o t / c i m v 2 - R - W
4 . R u n a n y C I M c l i e n t s t o d o C I M o p e r a t i o n s w i t h t h e c i m o m .
N o t e :
( 1 ) O n U n i x s y s t e m s , u s e r r o o t b y d e f a u l t w i l l h a v e a l l t h e a u t h o r i z a t i o n s f o r l o c a l c l i e n t s ( t h e c l i e n t s t h a t u s e C o n n e c t L o c a l ( ) o f C I M C l i e n t A P I .
( 2 ) T h e c i m a u t h C L I c a n o n l y b e r u n l o c a l l y a s r o o t o n U n i x s y s t e m s . 2 4
285
286 " 3
287
288 1 \ S
289 7 H
290 , 0 h ? ̙ 33 0 z r @
291 (
292 X
293 C XK
294 r
295 kumpf 1.1 S Ի
296 M)
H
297 0 .k ? ̙ 33 0 ~ p ( |
298 ^
299 S XK
300 x
301 c $ XD
302 M)
H
303 0 .k ? ̙ 33 0 ~ 4 ( I;
304 4 ^
305 4 S XK
306 x
307 4 c $ t
308 M)
H
309 4 0 .k ? ̙ 33 rL Ya 8 M a? p 3 _ W ݝ )x .~ (
310 ( @
311 / 0 D T i m e s N e w R o m a n l4 t !0 hz0 D F u t u r a L t R o m a n l4 t !0 hz0 " D C o m i c S a n s M S n l4 t !0 hz0 B
312 ` .
313 @ n ? " d d @ @@ `` On-screen Show Hewlett Packard 4 2 Times New Roman
314 Futura Lt Comic Sans MS Default Design Pegasus Security Architecture Security Architecture Authentication Authorization Authentication Implementation Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization Fonts Used Design Template
Slide Titles
Slide Title _ AIT A I T _- AIT A I T - - & G &
315 JwSwgw
316 kumpf 1.1
317 - @ Times New Roman Swgw
318
319 - @@ `` T
%
*
320 & ,
321 c $ @ f 3 @ { g 4 N d N d !0 p p p @ < 4 ! d ! d 0< X5 < 4 B d B d o0< u ʚ;2N ʚ; < 4 d d d d 0 ?
O =
322 Pegasus Security Implementation + Author: Nag Boranna
Hewlett-Packard Company , , Security Architecture Authentication
Authorization
Authentication Implementation
323 Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization / T E$
# # 0 + (
324 r
325 S ` P
326 g
327 # l ? 0 - <P CG8
; Monitor
328 h
329 # l ` ? 0 - <P p
K
HTTP
Acceptor "
330 i
331 # l D ? 0 - <P i
A HTTP
Connection
332 j
333 # l x ? 0 - <P
A HTTP
Connection d b
334 k < G0* H I "8 ^ b
335 l 6 G) HWJII 8
336 m
337 kumpf 1.1 # l ? 0 - <P :
M HTTP
Connection " B
338 n
339 b E` FN Q& U V W } ) ) ? X X 63 81-D81^ DS &{'LO^ D+ YL ^0L8]T+ YL7Gn2H+IJ7GI:9]T:I:Q =
340 qR&Q J
341 7 JJ
342 >:* ;9>:+$. +]
343 x!+]
344 6381$ 3-D^ D
%D ^0L8]T H+ YL ^0L8]T7G@8Cn2H+IJI:B,=
345 qR&N7#Q 7 J K
J
346 7 J>:8* ;9+ +$ x!+ ]
347 x!+ $ ( ,` C 0* 0* IT NT 0* 0* B C C l o u d
<
Network d b
348 o @ < GHObIh* G j b
349 p @ B Z G * H$. I3 @Gi
350 q
351 6 Z =g
9 creates
352 r
353 # l $ ? 0 - <P p
Z HTTP
Authenticator
Delegator "
354 s
355 # l 8 ? 0 - <P P
356
@
[ CIM Operation
Request
Decoder "
357 t
358 kumpf 1.1 # l ? 0 - <P `
@
X CIM Export
Request
Decoder "
359 u
360 # l ? 0 - <P
\ CIM Operation
Response
Encoder " d R
361 v @ < Z GuHb4 Iu " ^ b
362 w 6 G0* Hh IC *
" ^ b
363 x 6 G0* HIC "
:
364 y
365 # l ? 0 - <P
^ CIM Operation
Request
Dispatcher " ! d b
366 z < G0* H3I^ yP
367 d R
368 { @ < GYHO IY d b
369 | < G&* H6 I j d b
370 } < Z G( HIuc 6
371
372 ~
373 < Gq[ H ~
D #2. Socket
Message
374
375 < G7 H"
i 7 #3. HTTP Request
Message
#5.HTTP Challenge Response Msg 8 8
376
377 < G` H
378 : k
K #6. HTTP
Request
Messages
379 kumpf 1.1
380 < ! Gd H` 0J|
J #8. CIM
Request
Messages
381
382 < " G H 0J{
K #9. CIM
Response
Messages
383
384 < ) GT Ha P
385
K #10.HTTP
Response
Message B
386
387 b (E` FN Q& U V W } ) ) ? X X 63 81-D81^ DS &{'LO^ D+ YL ^0L8]T+ YL7Gn2H+IJ7GI:9]T:I:Q =
388 qR&Q J
389 7 JJ
390 >:* ;9>:+$. +]
391 x!+]
392 6381$ 3-D^ D
%D ^0L8]T H+ YL ^0L8]T7G@8Cn2H+IJI:B,=
393 qR&N7#Q 7 J K
J
394 7 J>:8* ;9+ +$ x!+ ]
395 x!+ $ ( ,` C 0* 0* IT NT 0* 0* B C C l o u d
396 0;
L Repository and
Providers d R
397 < Z GHI
398
399 < 0 G H F [
K #1. Socket
Ready for read
400 kumpf 1.1
401 < 4 G H+ |@
C #11. Socket
Write
402
403 # l X8 ? 0 - <P p
404
` Authentication
Manager . j b
405 B G0* HBI@ 2
406 p d b
407 < G) H'I j"
408
409 < > GHk p
L #4. HTTP
Challenge
Message
410
411 # l @ ? 0 - <P 00
` " CIM Operation
Request
Authorizer " # d R
412 < GHGI p
413
414 < E Gd H`
415
J #7. CIM
Request
Messages ^ r
416 6 GH< I
417 @:
H
418 0 h ? 6 g h k 7 g i l 8 n g o 9 h i p : m r v ; r s w < r t x = s z > y u { ? u m | @ y } A ~ B C D E F G m n H I K r T r m
419
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P l R T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h x k m n o p q S t u v w Q z { | } ~ R o o t E n t r y dO ) P=cs
C u r r e n t U s e r 2 ) S u m m a r y I n f o r m a t i o n ( H P o w e r P o i n t D o c u m e n t ( 4 D o c u m e n t S u m m a r y I n f o r m a t i o n 8 % , T
%
*
420 & ,
421 kumpf 1.1 c $ @ f 3 @ { g 4 N d N d !0 p p p @ < 4 ! d ! d 0< X5 < 4 B d B d o0< u ʚ;2N ʚ; < 4 d d d d 0 ?
O =
422 Pegasus Security Implementation + Author: Nag Boranna
Hewlett-Packard Company , , Security Block Diagram Authentication Block Diagram
Authorization Block Diagram Authentication Implementation
423 Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization / T P $ (
424 P r
425 P S | `
r
426 P S ԡ 0 `
H
427 P 0 h ? ̙ 33 r # )
428 ( @
429 / 0 D T i m e s N e w R o m a n l4 t !0 hz0 D F u t u r a L t R o m a n l4 t !0 hz0 " D C o m i c S a n s M S n l4 t !0 hz0 B
430 ` .
431 @ n ? " d d @
432
! " # $ 3 & ' ( ) * + , - . / 0 1 Oh +'0
p x
433 @ L X
d p x Pegasus Security e Nag Boranna X Gives an overview of Pegasus Authentication and Authorization Implementation and usage. AIT 228 Microsoft PowerPoint Peg@ 0q @ G_06L@ p*()@ U G g 3 & & & # TNPP 2 O M i t
434 &
435 TNPP & & TNPP
- - - ! - - - & G &
436 MJwSwgw
437 M
438 - @ Times New Roman Swgw
439 3
440 - . 2
441 R 2/26/02 . & y & . 2
442 kumpf 1.1 f 1 . - - q @ - - @ Times New Roman Swgw
443 S
444 - . 3 2
445 w Pegasus Security Architecture ! ! * . - - ! - - @ BComic Sans MS wSwgw
446 6
447 - . $ 2
448 4 Author: Nag Boranna
449
450
451 . @ BComic Sans MS wSwgw
452 W
453 - . 2
454 . Hewlett
. . 2
455 - . . 2
456 Packard Company
. - - "System wf
457
458 - & TNPP & ՜. +,0
459
U V W X t ̙ 33 u
% ` $ $ (
460 x
461 c $ 0
462
463 kumpf 1.1 # l P ? 0 - <P P
W Authenticator
(Interface) "
464
465 # l $ ? 0 - <P _
U Authentication
Manager "
466
467 # l 8 ? 0 - <P p
Z Local
Authentication
Handler " ^ B
468
469 6 D f P
470 P
471 n
472
473 # l ? 0 - <P ` `p
Z Basic
Authentication
Handler "
474
475 # l ? 0 - <P p
O Digest
Authentication
Handler X B
476
477 0 D f u X B
478
479
480 0 D f u
X B
481
482 0 D f uP
483 P
484 kumpf 1.1 X B
485
486 0 D f n
n ^ B
487
@
488 6 D f n0 n
489
490 # l ? 0 - <P T
] Basic
Authenticator
(Interface) " ^ B
491
492 6 D f N ``
493
494 # l d ? 0 - <P pp
A PAM "
495
496 # l 8 ? 0 - <P
X Secure
Basic
Authenticator " X B
497
498 0 D f 0 0 X B
499
500 0 D f X B
501
502 0 D f `` X B
503
504 0 D f 0
505 kumpf 1.1
506 # l ? 0 - <P
507
X Simple
Basic
Authenticator " ^ B
508 @
509 6 D f ^ r
510 6 G H؛ Iu P_`
511 d r
512 @ < Z G Hdu IA2 `
513
514
515 # l " ? 0 - <P 0T
] Local
Authenticator
(Interface) " ^ B
516
517 6 D f N
518
519 # l ' ? 0 - <P 00
^ File System
Based
Authentication " ! X B
520
521 0 D f d b
522 < Gg HO I6 0
523
524
525 # l , ? 0 - <P `
526 kumpf 1.1 T
^ Digest
Authenticator
(Interface) " ! d b
527 < Z G0* H`8I pP
528
529 !
530 T 1 ? GY Hl ? P}
531 P
P Plug-in Authentication Modules
532 "
533 T 5 ? GY Hl ? M
O Plug-in Authentication Module
534 #
535 T 8 ? G3 H ? @k
@ HTTP Specific
536 $
537 < < GY H7s P
0k
x F Handles HTTP Specific Information, but does not deal with the protocol G G H
538 0 h ? ! " # $ ̙ 33 s
# )0 K (
539 0 x
540 0 c $ 8
541 0
542 # l Tz ? 0 - <P P
543 p
@ User Manager
544 0
545 # l H~ ? 0 - <P _
V " CIM Operation
Request
Authorizer # # ^ b
546 0 6 G&* HHIv _
547 kumpf 1.1
548 0
549 # l , ? 0 - <P P
J Authorization
Handler ^
550 0 6 G,HI, p
b
551 %0
552 B ? } ) ) ?
H Instance
Repository d b
553 &0 @ < Z G0* H=
554 I; @o
555 '0
556 ` ̙ jJ ? Z
Y Load Authorizations * ( 2
557
558 (0
559 ` t ̙ jJ ? _
Z Verify Authorization * ( 2
560
561 )0
562 ` x ̙ jJ ? `
563
Z Verify Authorization * ( 2
564 H
565 0 0 h ? ? ` 0 0 0 0 0 0 0 %0 &0 ̙ 33 r Q :
566 - ( @
567 / 0 D T i m e s N e w R o m a n T5 t !0 hz0 D F u t u r a L t R o m a n T5 t !0 hz0 " D C o m i c S a n s M S n T5 t !0 hz0 B
568 kumpf 1.1 ` .
569 @ n ? " d d @ @@ `` T %
*
570
571 & , c $ @ f 3 @ { g 4 N d N d !0 p p p @ < 4 ! d ! d 0< @6 < 4 B d B d o0< u ʚ;2N ʚ; < 4 d d d d 0 ?
O =
572 Pegasus Security Architecture + Author: Nag Boranna
Hewlett-Packard Company " , Security Architecture Authentication
Authorization
Authentication Implementation
573 Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization / T P $ (
574 P r
575 P S `
r
576 P S x 0 `
H
577 P 0 h ? ̙ 33 r
578 ( @
579 / 0 D T i m e s N e w R o m a n T5 t \ !0 t hz0 D F u t u r a L t R o m a n T5 t \ !0 t hz0 " D C o m i c S a n s M S n T5 t \ !0 t hz0 B
580 ` .
581 @ n ? " d d @ @@ `` T %
*
582
583 & , c $ @ f 3 @ { g 4 N d N d !0 h p p p @ < 4 ! d ! d 0$ @6 < 4 B d B d o0$ u ʚ;2N ʚ; < 4 d d d d 0 ?
O =
584 Pegasus Security Architecture + Author: Nag Boranna
Hewlett-Packard Company " , Security Architecture Authentication
Authorization
Authentication Implementation
585 Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization / T r
586 ( @
587 / 0 D T i m e s N e w R o m a n T5 t !0 hz0 D F u t u r a L t R o m a n T5 t !0 hz0 " D C o m i c S a n s M S n T5 t !0 hz0 B
588 ` .
589 kumpf 1.1 @ n ? " d d @ @@ `` T %
*
590
591 & , c $ @ f 3 @ { g 4 N d N d !0 p p p @ < 4 ! d ! d 0< @6 < 4 B d B d o0< u ʚ;2N ʚ; < 4 d d d d 0 ?
O =
592 Pegasus Security Architecture + Author: Nag Boranna
Hewlett-Packard Company " , Security Architecture Authentication
Authorization
Authentication Implementation
593 Authentication Components Authorization Implementation Authorization Components Security Configurations Enabling Authentication Enabling Authorization / T r
594 R o o t E n t r y dO ) `@s
C u r r e n t U s e r 2 * S u m m a r y I n f o r m a t i o n ( H P o w e r P o i n t D o c u m e n t ( 4 k
595
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P l T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h x m n o p q S t u v w Q z { | } ~
596
! " # $ 3 & ' ( ) * + , - . / 0 1 horization Fonts Used Design Template
Slide Titles
Slide Title " _
597 Bapu Patil _- AIT A I T - - & G &
598 JwSwgw
599
600 - @ Times New Roman Swgw
601
602 -
|
Return to
PegasusSecurityArchitecture.ppt
CVS log
Up to [Pegasus] / pegasus / doc