OpenAAA, Open Source Authentication, Authorization and Accouting library
Branch | Status | Binaries | Packages |
---|---|---|---|
master |
Authentication
- strong mutual authentication using transport layer security
- strong mutual and anonymous authentication based on decentralized trust
- channel binding based on standard and well-defined mechanisms
- upper layers authentication based on keying material exporters [RFC-5705]
- anonymous authentication, no personal data transfered over channel
- general extension mechanisms negotiate peers whether to use specific methods
- supplemental data in the handshake protocol negotiating AAA methods [RFC-4680]
- TLS re/negotiation is used as signal for the re/authentication
- no user-credential-related risks
Accounting
- binding authenticated user context to encrypted session
- session management attributes and operation tied to secure TLS session
- secure session negotiations and session resumption are based on TLS
- no more cookies and other state information on application layer
- multipple network and/or application layers access same encrypted session
- single point log off can destroys all authenticated sessions and invalidate crypto material
Authorization
- unlimited additional upper layer authorization rules using single authenticated user context
- multipple network and/or application layers access and share same authenticated session
Interoperability
- strong interoperability with centralized and decentralized trust
TLS authentication based on decentralized trust
- strong mutual authentication without certificates and centralized authorities
TLS side channel authentication
- equivalent security as hardware-tokens
- strong mutual authentication without trusted certificates and CAs
TLS qualities and various attack mitigations features:
- cipher negotiations
- session negotiations and session resumption
- safe renegotiations
- application-layer protocol negotiation
- cryptographic integrity
- confidentiality
- channel binding using secure channel protocols
Besides AAA on application layer is allways prone to many implementation errors compared to TLS.
Examples
- TLS Server example: https://github.com/n13l/openaaa/blob/master/test/ssl/tls-server.sh
- TLS Client example: https://github.com/n13l/openaaa/blob/master/test/ssl/tls-client.sh
- HTTP2/TLS Client example: https://github.com/n13l/openaaa/blob/master/test/ssl/http2-client.sh
- Java Client example: https://github.com/n13l/http2-pkcs11/blob/master/com/openaaa/tls/Test.java
- Apache/2.4 (Unix) OpenAAA/1.0.0 OpenSSL/1.0.2 : https://aaa.rtfm.cz
URL References
ID | URI |
---|---|
AAA-TLS-SCA | https://github.com/n13l/openaaa/blob/master/doc/tls-sca |
OPENVPN-RFC5705 | https://github.com/OpenVPN/openvpn/blob/master/doc/keying-material-exporter.txt |