main

Authx - Proof of Concept

This repository explores various authentication and authorization workflows by introducing a separate authn/authz service. It serves as a proof of concept to illustrate potential workflows, not a production ready implementation.

To keep the implementation accessible, external dependencies have been minimized, ensuring a clear reference for understanding key concepts, including:

  • SAML based authentication including IdP chaining to external identity providers
  • OIDC based authentication
  • OAuth endpoints with links to relevant RFCs for proper usage guidance

Architecture

 -------------
 | user-agent |
 -------------
       |
       V
----|:8080|-----------------------------------------------
       |
       V
 ---------------
 | API Gateway | (use casbin to evict early, reverse proxy, inject context headers)
 ---------------
        |
        |    --------------------
        |--->| IdP (saml, oidc) |
        |    --------------------
        |    | :http   | :grpc  | (use declarative_policy)
        |    --------------------
        |        A         A
   -----------   |         |
   |         |   |         |
   V         V   |         |
 ------    ------------    |
 | UI |    | REST API |----|
 ------    ------------

[UI]: ui.example.com
[REST API]: api.example.com
[IdP]: idp.example.com

I have ommitted TLS, RS256 from the prototype to offload the decision of key management and rotation. See smallstep for PKI management.

CSV files are used instead of a database to simulate different types of scenarios. The following organizational hierarchy is demonstrated here:

Organization(name: "default")
  * Group(name: "A")
    * Project(name: "A1")
  * Group(name: "B")
    * Project(name: "B1")
Organization(name: "gitlab")
  * Group(name: "gitlab-org")
    * Project(name: "gitlab")
  * Group(name: "gitlab-com")
    * Group(name: "gl-security")
      * Group(name: "test-projects")
        * Project(name: "eicar-test-project")
      * Project(name: "disclosures")
    * Group(name: "support")
      * Group(name: "toolbox")
        * Project(name: "changelog-parser")
    * Project(name: "handbook")
    * Project(name: "www-gitlab-com")

Getting Started

  1. Install tools:

    $ mise install

  2. Add entries to /etc/hosts:

    $ tail -n3 /etc/hosts
127.0.0.1 api.example.com
127.0.0.1 idp.example.com
127.0.0.1 ui.example.com

  3. Start servers:

    $ mage

  4. Open a browser to http://ui.example.com:8080/.

Questions

See the FAQ

References