Skip to content

Home

Jump to bottom
Trent Smith edited this page Jun 4, 2019 · 4 revisions

What is Fusillade

Fusillade is a service for managing user authentication and authorization.

How does it provide authentication? In the DCP it will be used by users to login using different trusted identity providers such as facebook, GitHub, google, or any other OpenID Connect compatible provider. It will also be the authentication point for service to service authentication using google service account credentials.

How does it provide authorization. Fusillade facilitates the ability for components of the DCP grant to restrict users' and services' access to specific resources. The permissions which a users or service has is managed by fusillade using a policy structure similar to AWS IAM policy documents. The various DCP components are responsible for asking Fusillade if a request is authorized and ensuring the correct permissions are created to answering the authorization question. By default if permissions is denied if not explicitly granted.

Fusillade will be managed by DCP admins who have the ability to grant additional permission and assign additional admins or create different roles for different actions such as granter users permission. Similar to AWS roles, group, resources, and users are used to manage permissions.

MVP

  1. Fusillade Setup/Deployment
    1. As a fusillade developer, I need to gradually test and deploy changes before updating a production system, to prevent introducing breaking changes that affect multiple groups. https://github.com/HumanCellAtlas/fusillade/issues/8
    2. As a fusillade operator, I would like to have a gitlab pipeline for fusillade, so that I can include it in the DCP release schedule. https://github.com/HumanCellAtlas/fusillade/issues/28
    3. As a fusillade developer, I need to safely deploy a test environment of fusillade without disrupting my production deployment.
      1. Fusillade needs to be configurable to allow multiple deployments in the same AWS account.
      2. Each deployment needs its own secrets, stage name, and resource names
      3. Define deployment name
  2. Fusillade Configure
    1. As a fusillade admin, I want to know how to setup Fusillade with an OIDC provider, so I can add and remove providers as needed. https://github.com/HumanCellAtlas/fusillade/issues/30
    2. As a fusillade admin, I would like to define default permissions assigned to all new users, to simplify the enrollment process of users.
    3. As a fusillade developer, I need to provide a default admin setup when deploying fusillade, to configure all other users and add additional admins.
  3. Updates
    1. As a fusillade developer, I need a process for non destructively updating the cloud directory schema, this will allow me to introduce new attributes and facets as the needs change. https://github.com/HumanCellAtlas/fusillade/issues/34
  4. Testing
    1. Ensure Fusillade availability by building a
      1. smoke test,
      2. integration test
  5. Health - monitoring and alerting facilities in accordance with DCP production practices (GA tech requirements) https://github.com/HumanCellAtlas/fusillade/issues/35
    1. As a DCP operator, I need to know the status of Fusillade periodically, this will allow me to monitor and take action in the event service to Fusillade is disrupted.
      1. Define the health check endpoint which returns 200 when the system is operational and 500 when the system has issues.
      2. Implement periodic health checks on AWS cloud directory, auth0, AWS iam policy evaluation service
  6. Authentication
    1. As a user, I would like logout, to prevent misuse under my name.
      1. Revoke user credentials
      2. https://github.com/HumanCellAtlas/fusillade/issues/26
    2. Should fusillade also handle the verification of the users token?
  7. Authorization
    1. As a policy writer, I want to know how to format my policy to restrict access accordingly.
      1. Write the default user policy and the default fusillade admin policy
    2. As an dcp admin, I want to know what permissions a users has.
    3. As a resource developer, I need to know how to represent the actions that can be performed by users, so policies can be written to grant users permission.
    4. As an admin, I need a way to modify user’s policies, to assign an remove permissions.
    5. As a user, I would like to see what permission I have.
    6. As a user, I would like to see what groups i belong to.
    7. ~~As a resource provider, I want policy writers to know what actions can be performed on a resource. Here is an example how AWS s3 defines it’s resource actions. https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazons3.html
  8. As a user of fusillade, I would like to know how to use the API, to integrate me my service with fusillade.
    1. Users
    2. Evaluate policy
    3. Create user
    4. Update user
    5. Disable user
    6. Enable user
    7. Add/remove user from group
      1. Who determines who can be in a group
      2. Group admins
    8. Create group
    9. Update group
    10. Remove group
  9. Add documentation on how to configure google and auth0
  10. How are users added to a group
    1. A group owner or Fusillade admin can add/remove users to a group
    2. A group must always have at least one member, and one owner. They can be the same user.

Cloud directory objects

  1. Roles
    1. Is created by admins Skip or resource owners
    2. Can be assigned to Users and groups
  2. User
    1. Is created on demand
    2. Permissions
      1. View email, status, user policy, roles and groups
        1. Get group returns all of the groups a user is aparts, and all of the groups a group is apart of.
      2. Remove self from groups, and roles
    3. Users can be assigned to multiple roles and groups
  3. Group
    1. Who can create a group?
    2. Must have at least one group admin during creating
    3. Skip Can be nested in groups
    4. A group can be assigned to multiple roles
    5. A group can have multiple roles
    6. An owner of the group must be specified when the group is created.
      1. The owner must be an email that users can message to request access to the group
    7. The owner of the group can change and there can be multiple owners.
  4. Required Roles
    1. Fusillade Admin Role
      1. Permissions
        1. Add remove roles
        2. assign , unassign roles
        3. Enable and disable users
        4. Create groups
        5. Remove groups
        6. Add users to groups
        7. Add roles to users and groups
        8. Add group admins
    2. Group Admin Role
      1. Permissions
        1. add and remove users from group
        2. assign new group admin
        3. Skip view parent groups
        4. view roles attached to group
        5. View group policy
      2. A group admin must be an admin of that group to perform actions.
    3. User Roles
      1. Permissions
        1. View email, status, user policy, roles and groups
        2. View user policy
    4. Resource Admin Role
  5. A resource shall define roles that can perform actions
  6. A resource shall define a document that outlines the actions, resource paths, context parameters and context parameter types.
    1. Example _https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazons3.html _

Questions

  1. How and where are resource permissions stored?
  2. What authorization endpoints do we need?
  3. Do we need to store anything when a user logs in?
  4. How would we revoke a users authentication
  5. How do we restrict access by project?
  6. How do we restrict access for a query?
  7. How do we restrict downstream service?
    1. None access controlled can only handle public data
    2. Service that are aways need a away to determine user access permissions
Clone this wiki locally