blob: 6e52288804202f9150b9d9bf85aadc9e76c689a4 [file] [log] [blame]
Sai Gandhamd67a9de2018-05-25 15:48:11 +00001.. This work is licensed under a Creative Commons Attribution 4.0 International License.
2.. http://creativecommons.org/licenses/by/4.0
3
Instrumentalbbe71542018-05-25 12:29:38 -05004AAF Architecture
5================
Sai Gandhamd67a9de2018-05-25 15:48:11 +00006AAF is designed to cover Fine-Grained Authorization, meaning that the Authorizations provided are able to used an Applications detailed authorizations, such as whether a user may be on a particular page, or has access to a particular Pub-SUB topic controlled within the App.
7
8This is a critical function for Cloud environments, as Services need to be able to be installed and running in a very short time, and should not be encumbered with local configurations of Users, Permissions and Passwords.
9
10To be effective during a computer transaction, Security must not only be secure, but very fast. Given that each transaction must be checked and validated for Authorization and Authentication, it is critical that all elements on this path perform optimally.
11
12|image0|
13
14.. |image0| image:: aaf-object-model.jpg
15 :height: 600px
16 :width: 800px
17
18Certificate Manager
19===================
20
21Overview
22--------
23Every secure transaction requires 1) Encryption 2) Authentication 3) Authorization.
24
25 - HTTP/S provides the core Encryption whenever used, so all of AAF Components require HTTP/S to the current protocol standards (current is TLS 1.1+ as of Nov 2016)
26 - HTTP/S requires X.509 certificates at least on the Server at minimum. (in this mode, 1 way, a client Certificate is generated)
27 - Certificate Manager can generate certificates signed by the AT&T Internal Certificate Authority, which is secure and cost effective if external access are not needed
28 - These same certificates can be used for identifying the Application during the HTTP/S transaction, making a separate UserID/Password unnecessary for Authentication.
29 - Authentication - In order to tie generated certificates to a specific Application Identity, AAF Certificate Manager embeds a ILM AppID in the Subject. These are created by AT&T specific Internal Certificate Authority, which only generates certificates for AAF Certman. Since AAF Certman validates the Sponsorship of the AppID with requests (automatically), the end user can depend on the AppID embedded in the Subject to be valid without resorting to external calls or passwords.
30
31 - ex:
32 - Authorization - AAF Certman utilizes AAF's Fine-grained authorizations to ensure that only the right entities perform functions, thus ensuring the integrity of the entire Certificate Process
33
34|image1|
35
36.. |image1| image:: aaf-cm.png
37 :height: 768px
38 :width: 1024px
39
40Capabilities
41------------
42
43
44Usage Scenarios
45---------------
46
47
48Interactions
49------------