Transparently using macaroons with caveats to delegate authorization for access
The disclosed technology teaches confirming delegation of authorization from an authorization server (AS) by a client to a service, including an AS issuing an OAuth2 access token in the form of a Macaroon (MAT), optionally with caveats, including a root signature, and providing the MAT to a client. Included is the client modifying the OA2 access token by appending caveats that narrow authorization, and by applying a message authentication code (MAC) chaining algorithm to generate an updated signature to include in the resulting MAT with caveats (MATwC), the client delegating authorization to a service by forwarding the MATwC to the service and the service using the MATwC to access a resource server (RS), the RS passing the MATwC to the AS, and the AS determining authenticity of the MATwC as a bearer token and evaluating scope of authorization from the MAT as narrowed by the caveats, and reporting results.
1. A method of confirming delegation of authorization from an authorization server (AS) by a first client to a second client, including:
issuing, by the AS, an OAuth2 access token with a broad authorization scope in a form of a Macaroon (MAT) for access to a resource, including a root signature, and providing the MAT to the first client with initial authorization;
modifying, by the first client, the access token by appending caveats to the MAT that narrow authorization provided by the MAT, and by applying a message authentication code (MAC) chaining algorithm
to generate an updated signature to include in the resulting MAT with caveats (MATwC);
delegating, by the first client, narrowed authorization to the second client by forwarding the MATwC to the second client;
using, by the second client, the MATwC to access a resource server (RS) for a set of microservices running on the second client,
passing, by the RS, the MATwC to the AS;
determining, by the AS, authenticity of the MATwC as a bearer token and evaluating scope of authorization from the MAT as narrowed by the appended caveats; and
reporting, by the AS, results of the determining authenticity and evaluating scope of authorization.
2. The method of claim 1 , further including the access token in the form of a Macaroon being compatible with OAuth 2.0 or OAuth 2.1.
3. The method of claim 1 , further including applying, by the first client, a hash-based message authentication code (HMAC) chaining algorithm to generate the updated signature, including using the root signature as a key for the HMAC and excluding the root signature from content of the MATwC.
4. The method of claim 1 , wherein the MAT includes caveats, the AS generating a pre-issuance signature for part of the MAT not including the caveats, then the AS using the pre-issuance signature as a key in the MAC chaining algorithm when generating the root signature to the MAT including the caveats.
5. A method of confirming delegation of authorization from an authorization server (AS) by a recipient to a set of microservices, including:
issuing for use by the recipient, by the AS, an access token with a broad authorization scope in a form of a Macaroon (MAT) including a root signature, and providing the MAT to the recipient;
receiving, by the AS, a MAT-with-appended caveats (MATwC), which is a modified version of the access token that has been modified by appending caveats to the MAT that narrow authorization provided by the MAT, and by applying a message authentication code (MAC) chaining algorithm
to generate an updated signature to include in the MATwC;
determining, by the AS, authenticity of the MATwC as a bearer token and evaluating scope of authorization from the MAT as narrowed by the appended caveats for the set of microservices; and
reporting, by the AS, results of the determining authenticity and evaluating scope of authorization.
6. The method of claim 5 , further including applying, by the recipient, a hash-based message authentication code (HMAC) chaining algorithm to generate the updated signature, including using the root signature as a key for the HMAC and excluding the root signature from content of the MATwC.
7. The method of claim 5 , wherein the MAT includes caveats, the AS generating a pre-issuance signature for part of the MAT not including the caveats, then the AS using the pre-issuance signature as a key in the MAC chaining algorithm when generating the root signature to the MAT including the caveats.
8. The method of claim 5 , wherein the MAT includes caveats, the AS using a key, identified by a key identifier in the MAT, in the MAC chaining algorithm when generating the root signature to the MAT including the caveats.
9. The method of claim 5 , wherein the MAT further includes at least one of a caveat for scope of authorization, expiration, a confirmation key that requires the recipient to prove possession of an associated key whenever the recipient uses the token, and for audience that restrict the audience of the MAT.
10. The method of claim 5 , further including interacting, by the recipient, with first through tenth services, the method including:
the recipient modifying the MAT by appending respective caveats for the first through tenth services to form first through tenth MATwCs; and
the recipient forwarding the respective MATwCs for the first through tenth services to use.
11. A tangible non-transitory computer readable storage media, including program instructions loaded into memory that, when executed on processors cause the processors to implement a method of confirming delegation authorization from an authorization server (AS) by a recipient to a set of microservice, the method including:
the AS issuing for use by the recipient an access token with a broad authorization scope in a form of a Macaroon (MAT) including a root signature, and providing the MAT to the recipient;
the AS receiving a MAT-with-appended caveats (MATwC), which is a modified version of the access token that has been modified by appending caveats to the MAT that narrow authorization provided by the MAT, and by applying a message authentication code (MAC) chaining algorithm
to generate an updated signature to include in the MATwC;
the AS determining authenticity of the MATwC as a bearer token and evaluating scope of authorization from the MAT as narrowed by the appended caveats for the set of microservices; and
the AS reporting results of the determining authenticity and evaluating scope of authorization.
12. The tangible non-transitory computer readable storage media of claim 11 , further including the AS applying token introspection to evaluating the scope of authorization of the MATwC.
13. A system for confirming delegation authorization from an authorization server (AS) by a recipient to a set of microservice, the system including a processor, memory coupled to the processor and program instructions from the non-transitory computer readable storage media of claim 11 loaded into the memory.
14. The system of claim 13 , wherein the program instructions extend the method including the recipient applying a hash-based message authentication code (HMAC) chaining algorithm to generate the updated signature, including using the root signature as a key for the HMAC and excluding the root signature from content of the MATwC.
15. A method of delegating from a first client to a second client, authorization from an authorization server (AS), including:
receiving, by the first client, from the AS an access token with a broad authorization scope in a form of a Macaroon (MAT), including a root signature;
modifying, by the first client, the access token by appending caveats to the MAT that narrow authorization provided by the MAT, and applying message authentication code (MAC) chaining to generate an updated signature to include in a resulting MAT with caveats (MATwC); and
delegating, by the first client, authorization to the second client by forwarding the MATwC to the second client for a set of microservices running on the second client; and
wherein the second client proves possession of a valid MATwC and authorization by forwarding the MATwC for the AS to determine authenticity of the MATwC as a bearer token and a scope of authorization from the MAT as narrowed by the appended caveats.
16. The method of claim 15 , wherein the first client participates in a Transport Layer Security (TLS) session and the root signature is generated, in part, using a client certificate from the TLS session.
17. The method of claim 15 , wherein the first client participates in a TLS session and the updated signature is generated, in part, using a client certificate from the TLS session.
18. The method of claim 17 , further including using a persistent client certificate from the TLS session.
19. The method of claim 15 , wherein the MAT further includes at least one of scope of authorization, a date/time of expiration, a confirmation key that requires the client to prove possession of an associated key whenever the first client uses the token, and an audience that restricts the audience of the MAT.
20. The method of claim 15 , further including interacting, by the first client, with first through tenth services, the method including:
the first client modifying the MAT by appending respective caveats for the first through tenth services to form first through tenth MATwCs; and
the first client forwarding the respective MATwCs for the first through tenth services to use.
21. The method of claim 15 , further including a syntax and semantics of the caveats in the MAT and MATwC indicating a progression of signatures applied in MAC chaining, such that the AS can authenticate a final signature on the MATwC.
22. A tangible non-transitory computer readable storage media, including program instructions loaded into memory that, when executed on processors cause the processors to implement a method of delegating from a first client to a second client, authorization from an authorization server (AS), the method including:
the first client receiving, directly or indirectly, from the AS an access token with a broad authorization scope in a form of a Macaroon (MAT), including a root signature;
the first client modifying the access token by appending caveats to the MAT that narrow authorization provided by the MAT, and by applying message authentication code (MAC) chaining
to generate an updated signature to include in a resulting MAT with caveats (MATwC); and
the first client delegating authorization to the second client by forwarding the MATwC to the second client for a set of microservices running on the second client; and
wherein the second client can prove possession of a valid MATwC and authorization by forwarding the MATwC for the AS to determine authenticity of the MATwC as a bearer token and a scope of authorization from the MAT as narrowed by the appended caveats.
23. A system for confirming delegation authorization from an authorization server (AS) by a recipient to a second client, the system including a processor, memory coupled to the processor and program instructions from the non-transitory computer readable storage media of claim 22 loaded into the memory.
24. The system of claim 23 , further including applying a hash-based message authentication code (HMAC) chaining algorithm to generate the updated signature, including using the root signature as a key for the HMAC and excluding the root signature from content of the MATwC.
25. The system of claim 23 , wherein the MAT further includes at least one of a caveat for scope of authorization, expiration, a confirmation key that requires the first client to prove possession of an associated key whenever the first client uses the token, and for audience that restrict the audience of the MAT.