Saturday, November 6, 2010

PKI authentication and legacy web application

One of the most secure ways of user authentication- is the PKI authentication. A lot of modern systems support this method and everything works nice and smoothly (almost everything - details in the my next post). But, as usually, in real big enterprise you have a dilemma: you need the strongest authentication but you have a lot of legacy systems (or it takes ages to get changes in authentication method from vendor).
The best way (IMHO) to resolve this problem is to use mutual ssl on certificates.
SSL will terminate on reverse proxy server in front of your Business Application Server inside the high secure network zone . So, here the scheme:



It looks really easy, isn't it?
How it works:
1. Each user has his own certificate and private key. It could be located on smart card, token or inside OS key storage.
2. User's browser must be configured to use this certificate for authentication (It's easy - just import it in browser or point it to OS key storage)
3. User must connect to revers proxy server (ssl termination point) for getting access to Business Application Server.

4. Revers proxy server checks validity of user's certificate and some certificate's fields (if you need to restrict access to only some users groups) like OU, CN or "extended key usage" and establish mutual ssl connection.
5. Revers proxy server offloads ssl and make direct connection over http (or non-mutual ssl connection) to your business application server.
6. Business application server authenticate user and authorised them by user/password pair.

The key point of this scheme is the Revers Proxy Server with ssl offloading feature (May be the better name for it - Secure Application Gateway).
How this servers looks like?
1. Open Source:
Any *nix + Apache web server with mod_proxy and mod_ssl + some changes in Apache config for certificate verification.
2. Load balancer or Web Application firewall from your favorite vendor. I have tested this on F5 BigIP and everything works perfectly.

Almost forget. You will get a lot of users' web request logging possibilities during  implementation of this scheme. So you can easily control users' activity within business application server.

That's all folks. Stay secure.

57 comments:

  1. I am a new user of this site so here i saw multiple articles and posts posted by this site,I curious more interest in some of them hope you will give more information on this topics in your next articles. MONTOLA supporto GPS universale per auto

    ReplyDelete
  2. I just couldn't leave your website before telling you that I truly enjoyed the top quality info you present to your visitors? Will be back again frequently to check up on new posts. athletiktraining berlin

    ReplyDelete
  3. The worst part of it was that the software only worked intermittently and the data was not accurate. You obviously canot confront anyone about what you have discovered if the information is not right. USDA ORGANIC

    ReplyDelete
  4. Writing with style and getting good compliments on the article is quite hard, to be honest.But you've done it so calmly and with so cool feeling and you've nailed the job. This article is possessed with style and I am giving good compliment. Best! fire flap

    ReplyDelete
  5. Truly, this article is really one of the very best in the history of articles. I am a antique ’Article’ collector and I sometimes read some new articles if I find them interesting. And I found this one pretty fascinating and it should go into my collection. Very good work! Earings

    ReplyDelete
  6. Excellent Blog! I would like to thank for the efforts you have made in writing this post. I am hoping the same best work from you in the future as well. I wanted to thank you for this websites! Thanks for sharing. Great websites! Fahrradhelm und -kappen

    ReplyDelete
  7. Well we really like to visit this site, many useful information we can get here. SELF-CARE CARDS

    ReplyDelete
  8. I really enjoy simply reading all of your weblogs. Simply wanted to inform you that you have people like me who appreciate your work. Definitely a great post. Hats off to you! The information that you have provided is very helpful. best email hosting

    ReplyDelete
  9. With so many books and articles coming up to give gateway to make-money-online field and confusing reader even more on the actual way of earning money, how to make money blogging

    ReplyDelete
  10. Looking for best Baby Prams online for your kids use. Lots of people found this.

    ReplyDelete
  11. Staggering and trendy online business web architecture is only one of our specialities. https://www.sandeepmehta.co.in/affordable-seo-services-delhi/

    ReplyDelete
  12. In case you are zeroing in to a greater degree toward the visual depiction part of Web design.
    https://onohosting.com/

    ReplyDelete
  13. I recently came across your article and have been reading along. I want to express my admiration of your writing skill and ability to make readers read from the beginning to the end. I would like to read newer posts and to share my thoughts with you. pet loss

    ReplyDelete
  14. Going to graduate school was a positive decision for me. I enjoyed the coursework, the presentations, the fellow students, and the professors. And since my company reimbursed 100% of the tuition, the only cost that I had to pay on my own was for books and supplies. Otherwise, I received a free master’s degree. All that I had to invest was my time. women shoes

    ReplyDelete
  15. I recently came across your article and have been reading along. I want to express my admiration of your writing skill and ability to make readers read from the beginning to the end. I would like to read newer posts and to share my thoughts with you. baby clothes singapore

    ReplyDelete
  16. I value the blog article. Really looking forward to read more. Really Great.security guard company in singapore

    ReplyDelete
  17. How about we keep on moving on into 2021 social media patterns in showcasing with drawing in, development centered substance thoughts! such a good point

    ReplyDelete
  18. How about to make professional verified on tiktok account for show your talent on Internet.

    ReplyDelete
  19. I really loved reading your blog. It was very well authored and easy to understand. Unlike other blogs I have read which are really not that good.Thanks alot! https://www.go2college.ca/

    ReplyDelete
  20. MavericksMedia
    Most entrepreneurs don't have it in their spending plan to recruit a different promoting firm to chip away at website improvement (SEO), so it basic that your web designer have insight in SEO.

    ReplyDelete
  21. Social media generally is about commitment through sharing, which for business implies focusing on your item range, your articles, or your administrations at drawing in a likely client or customer base. small seo article rewriter

    ReplyDelete
  22. Wow great blog article. Really thank you! Awesome.best security guard agency

    ReplyDelete
  23. When your website or blog goes live for the first time, it is exciting. That is until you realize no one but you and your. liquor home delivery near me

    ReplyDelete
  24. I think it could be more general if you get a football sports activity home builders in mississippi

    ReplyDelete
  25. Very nice blog and articles. I am realy very happy to visit your blog. Now I am found which I actually want. I check your blog everyday and try to learn something from your blog. Thank you and waiting for your new post. digital marketing near me

    ReplyDelete
    Replies
    1. Really enjoyed this article post. Really looking forward to read more. Will read on...
      security agency

      Delete
  26. I was taking a gander at some of your posts on this site and I consider this site is truly informational! Keep setting up.. digital marketing near me

    ReplyDelete
  27. I have read almost the whole the article. Everything were represented in pretty good way.
    I regularly use to visit your site to collect some new idea from your topic and usually fund it here.
    Awesome representing way and full of information.
    Thanks.
    What Is A Full Stack Developer?
    web development Services

    ReplyDelete
  28. MrGeekDMA provides high quality of Digital Marketing Services to clients. digital marketing agency in pakistan
    Best digital marketing agency in Pakistan.

    ReplyDelete
  29. More Instagram followers, likes, and views boost your presence on social media platforms. buy instagram followers

    ReplyDelete

  30. Pakistan's the best SMM Pak Panel with cheapest price starting from US$0.001. The Top SMM Panel where people buy Social Media Marketing services such as Instagram.

    ReplyDelete
  31. I was just browsing through the internet looking for some information and came across your blog. I am impressed by the information that you have on this blog. It shows how well you understand this subject. Bookmarked this page, will come back for more. FPV Aufnahmen deutschlandweit

    ReplyDelete
  32. At Seed Out, you can Donate Zakat crowd fund directly to micro-entrepreneurs, alleviating poverty sustainably through raising entrepreneurs, creating businesses and jobs

    ReplyDelete
  33. It has fully emerged to crown Singapore's southern shores and undoubtedly placed her on the global map of residential landmarks. I still scored the more points than I ever have in a season for GS. I think you would be hard pressed to find somebody with the same consistency I have had over the years so I am happy with that. Tagungsraum

    ReplyDelete
  34. Really nice and interesting post. I was looking for this kind of information and enjoyed reading this one. Keep posting. Thanks for sharing. web design agency

    ReplyDelete
  35. Great info! I recently came across your blog and have been reading along. I thought I would leave my first comment. I don’t know what to say except that I have. Liquor Store Mississippi

    ReplyDelete
  36. I would like to thank you for the efforts you have made in writing this article. I am hoping the same best work from you in the future as well.. Oxford Insurance Agency

    ReplyDelete
  37. This article gives the light in which we can observe the reality. This is very nice one and gives indepth information. Thanks for this nice article. hard to find electronic parts

    ReplyDelete
  38. Shafi Dropship helps you to launch your turnkey dropship store without hiring designers. shopify dropshipping store Get your own money making dropshipping stores in USA, UK & Canada.

    ReplyDelete
  39. I have bookmarked your website because this site contains valuable information in it. I am really happy with articles quality and presentation. Thanks a lot for keeping great stuff. I am very much thankful for this site. Digital Marketing Services

    ReplyDelete
  40. Great Article it its really informative and innovative keep us posted with new updates. its was really valuable. thanks a lot. mediation services

    ReplyDelete
  41. Through this post, I know that your good knowledge in playing with all the pieces was very helpful. I notify that this is the first place where I find issues I've been searching for. You have a clever yet attractive way of writing. Best Residential Roofers Near Me

    ReplyDelete
  42. It’s very informative and you are obviously very knowledgeable in this area. You have opened my eyes to varying views on this topic with interesting and solid content. Health Insurance for Startups

    ReplyDelete
  43. Such a very useful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article. Expense Reduction

    ReplyDelete
  44. I adore your websites way of raising the awareness on your readers. Construction Jobs

    ReplyDelete
  45. At Seed Out, you can Donate Zakat crowd fund and Pay Zakat Online directly to micro-entrepreneurs, alleviating poverty sustainably through raising entrepreneurs, creating businesses and jobs

    ReplyDelete
  46. Mmm.. good to be here in your article or post, whatever, I think I should also work hard for my own website like I see some good and updated working in your site. Titos Vodka

    ReplyDelete
  47. I see some amazingly important and kept up to length of your strength searching for in your on the site Roofing Companies Near Me

    ReplyDelete
  48. They're produced by the very best degree developers who will be distinguished for your polo dress creating. You'll find polo Ron Lauren inside exclusive array which include particular classes for men, women. outlet

    ReplyDelete
  49. Thank you very much for this great post. 먹튀검증

    ReplyDelete
  50. Fast Hosting For WordPress Sites · Let Your Site Run up to 500% Faster · Enjoy top-rated hosting support · Put your site's safety first · Customer Success Stories. WordPress Web Hosting in India

    ReplyDelete
  51. If you don"t mind proceed with this extraordinary work and I anticipate a greater amount of your magnificent blog entries mellow fellow delta 8

    ReplyDelete
  52. Very useful post. This is my first time i visit here. I found so many interesting stuff in your blog especially its discussion. Really its great article. Keep it up. photobooth mariage paris

    ReplyDelete
  53. I think about it is most required for making more on this get engaged builder Oxford

    ReplyDelete
  54. This is very educational content and written well for a change. It's nice to see that some people still understand how to write a quality post.! Web Development Melbourne

    ReplyDelete
  55. Wow! Such an amazing and helpful post this is. I really really love it. It's so good and so awesome. I am just amazed. I hope that you continue to do your work like this in the future also. Documentaries to watch

    ReplyDelete