Securing the CLI with OAuth2 Gadget Authorization

Most firms have robust exterior safety, e.g. blocking all entry to manufacturing belongings utilizing a firewall, and requiring a VPN to get “inside” entry to manufacturing environments. Nevertheless, as soon as you’re related to the VPN, the inner methods are normally very poorly protected, and there may be little to no authentication and authorization for inside instruments and providers.

Two widespread threats to inside safety are compromised worker laptops and provide chain assaults. In these eventualities, the attacker operates behind the firewall, usually with unrestricted community entry.

Companies with an online ui might be secured utilizing an software load balancer, e.g. an AWS ALB with OIDC, however how do you defend entry to command line interface (CLI) based mostly instruments? Requiring a username and password for each CLI invocation makes it painful to make use of and storing the credentials on the system leaves them extensive open in case the pc they reside on is compromised.

The Command Line

Most inside instruments have a CLI to handle the providers which might be used throughout the firm and plenty of are poorly protected. What’s one of the simplest ways to authorize CLIs? And how will you tie authorization into the corporate’s SSO?

One possibility is to deploy Hashicorp Vault, however that’s a whole lot of setup and upkeep, so until you will have a workforce to function it, Vault won’t be a great match.

Another choice is the OAuth2 gadget authorization grant (RFC8628), which is what this weblog publish will present you the right way to use.

The OAuth 2.0 gadget authorization grant is designed for Web-connected gadgets that both lack a browser to carry out a user-agent-based authorization or are enter constrained to the extent that requiring the consumer to enter textual content as a way to authenticate in the course of the authorization circulate is impractical. It permits OAuth purchasers on such gadgets (like good TVs, media consoles, digital image frames, and printers) to acquire consumer authorization to entry protected assets by utilizing a consumer agent on a separate gadget.

For those who ever used the AWS CLI with Single SignOn, that is what it does.

OAuth2 Gadget Circulation

The Gadget Authorization Circulation comprises two completely different paths; one happens on the gadget requesting authorization (the CLI) and the opposite happens in a browser. The browser circulate path, whereby a tool code is sure to the session within the browser, happens as a parallel path half within the gadget circulate path.

Implementing the OAuth Gadget Circulation

Now we’ll have a look at what the above sequence diagram appears like when it’s carried out.

The interior CLI instrument at Rockset known as rsctl and is written in go. Step one is to provoke the gadget circulate to get a JWT entry token.

$ rsctl login
Making an attempt to robotically open the SSO authorization web page in your default browser.
If the browser doesn't open otherwise you want to use a distinct gadget to authorize this request, open the next URL:

https://rockset.auth0.com/activate?user_code=BBLF-JCWB

Then enter the code:
BBLF-JCWB

Efficiently logged in!

If you’re utilizing the CLI after logging in to a different pc, e.g. ssh:ing to a Linux server, and you utilize macOS, you’ll be able to configure iTerm to robotically open the hyperlink utilizing a “Run command” set off.

The web page that the hyperlink takes you to appears like this:

Upon getting confirmed that the “consumer code” is appropriate (matches with what the CLI reveals), and also you click on “Verify”, it should take you thru the traditional OAuth2 login process (which in our case requires a username, password and {hardware} token).

As soon as the authentication is accomplished, you can be redirected and introduced with a dialog just like the one beneath, and you’ll shut the browser window.

The CLI has now obtained a jwt entry token which is legitimate for plenty of hours and is used to authenticate by way of inside providers. The token might be cached on disk and reused between CLI invocations at some point of its lifetime.

Once you situation a brand new rsctl command, it should learn the cached Entry Token from disk, and use it to authenticate with the inner APIs.

Beneath the Hood

We’ve carried out and open sourced a go module to carry out the gadget authorization circulate (github.com/rockset/device-authorization). It helps each Auth0 and Okta as OAuth suppliers.

Pattern Code

The next code is out there within the instance listing within the git repository.

Embedded content material: https://gist.github.com/pmenglund/5ed2708cdb88b6a6982258aed59a0899

We now have a JWT token, which can be utilized to authenticate REST calls by setting the Authorization header to Bearer: <jwt entry token>

Embedded content material: https://gist.github.com/pmenglund/b2ac7bb15ce25755a69573f5a063cb14

It’s now as much as the receiving finish to validate the bearer token, which might be finished utilizing an AWS ALB with OIDC authentication or a supplier particular API from the API server.

Offline Validation

Another choice for entry token validation is “offline validation”. In offline validation, the API server will get the general public key used to signal the JWT token from the supplier (and caches the general public key) and performs the validation within the API server, as an alternative of creating a validation request to the supplier.

Residual Threat

One factor this doesn’t defend in opposition to is an attacker with a foothold on the pc that executes the CLI. They will simply wait till the consumer has accomplished the authentication, and they’ll then be capable to act because the consumer at some point of the entry token.

To mitigate this danger, you’ll be able to require a one time password (OTP), e.g. a Yubikey, each time the consumer performs a privileged motion.

$ rsctl delete useful resource foobar
please enter yubikey OTP: ccccccvfbbcddjtuehgnfrbtublkuufbgeebklrubkhf
useful resource foobar deleted

Closing Ideas

On this weblog, we have now proven how we constructed and open-sourced a go module to safe the Command Line Interface (CLI) utilizing an OAuth2 gadget authorization circulate that helps each Auth0 and Okta SSO suppliers. You’ll be able to add this go module to your inside instruments and scale back inside safety threats.