[aerogear-dev] [Unified Push Server] Roles structure & password management

[Apostolos Emmanouilidis]

In general, it is very hard to detect an improperly protected REST
endpoint. Using least privilege principles could improve the control.
Regarding the roles, how could someone create a new admin user? Having
one and only one admin user with all access rights is a security
vulnerability itself. If the same admin credentials are shared between
several people/administrators it will be almost impossible to detect
which one is the compromise.

In conclusion my opinion is that:

1. Logging the endpoint accessibility is a must: e.g DateTime: User
[admin] with roles [admin] accessed createUser endpoint
2. Roles should be based on delegation of duties. "developer" or
"simple" roles do not reflect any duties and it's hard to guess their
duties without reading the documentation. Of course, delegation of
duties (e.g having a UserManagement role and the ability to assign it)
will make the role based access management part of AeroGear Unified Push
Server much more complex. However this will spread the risk of having a
single admin user with all rights.


On Tue, 2013-11-05 at 16:34 +0100, Sebastien Blanc wrote:


> -admin : can do all the CRUD operations + creating/deleting users
> The default user (admin/123) should have the "admin" role

> Users created by the admin can have the role developer or simple 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/aerogear-dev/attachments/20131106/69bec088/attachment.html