Managing Security of API-based Integration Workflows

Security requirements, particularly those on confidentiality, require IT processes to be compliant to the least privilege principle. OAuth 2.0, a currently broadly adopted authorization protocol, meets these requirements only partially. For example, due to unilateraly defined and service provider specific representation of access scopes, the possibility to granulary and interoperably structure access restrictions and authorizations is virtually eliminated. This problem concerns in particular cross-domain data exchanges, as the security measures in different organizations can be applied only in limited extent.

The architecture and relevant first results of ongoing work were presented in the scope of DISSECT Workshop at IEEE/IFIP NOMS Conference. The proposed approach addresses the security management of API-based interactions. The prospects of service providers, clients and data owners are taken into consideration to enable the contextual dependence in API-based data exchanges, as well as to support the granularity and interoperability in security management.

Bojan Suzic Graz University of Technology, Austria This work has been supported partially by the SUNFISH project (N.644666) funded by the European Commission H2020 Program Overview  Cloud Integration – Introduction and Approaches  API-based Integration: Use Case, Protocols, Practice  Proposed Approach  Integration in the Workflow  Discussion  Summary and Further Work 2 IEEE/IFIP DISSECT 2016 ӿ Istanbul, April 29 [th] 2016

API-based Integration – Use Case

Authorization scope : abstract term, non-structured, out-of-the-band, opaque
Gmail: supports a limited set of static scopes
Able to read all emails and metadata in an account
There is no specialized view, data filtering, limitation on fields…

Scope	Meaning
gmail.readonly	Read all resources and their meta-data
gmail.compose	Create, read, update and delete drafts, including sending of messages and drafts
gmail.send	Sending of messages, without read or update privileges
gmail.insert	Inserting and importing messages
gmail.labels	CRUD of labels
gmail.modify	All R/W operations except perm. deletion of threads and messages
https://mail.google.com/	Full access to the account

6 IEEE/IFIP DISSECT 2016 ӿ Istanbul, April 29 [th] 2016

API-based Integration – Use Case

Authorization scope : abstract term, non-structured, out-of-the-band, opaque
Salesforce: in many cases full scope required
Able to perform a broad set of operations well beyond the required use case
Coarse-grained scopes - Least privilege principle?

Scope	Meaning
api	Access to user’s account using API. Encompasses chatter_api scope
chatter_api	Access to Chatter API resources
custom_permissions	Access to the custom permissions in a client-associated organization
full	Full data available to the user. Encompasses all other scopes
id	Access to the identity URL service
openid	Unique identifier of user in OpenID Connected applications. Can be used to retrieve token conforming to OIDC specifications
refresh_token	Allows provision of refresh tokens to eligible users, enabling the client to interact with the resource in offline mode.
visualforce	Provides access to Visualforce
web	Allows to use the token on the web, incl. access to Visualforce pages

7 IEEE/IFIP DISSECT 2016 ӿ Istanbul, April 29 [th] 2016

Object Properties (Excerpt)  Connect entity instances of different concepts, establishing relations  Behavioral and constitutional

mples:	Col2
exposes	Entity that service exposes to clients using web API
contains, isPartOf	Relationships between entities stating constitutive (hierarchical) relationship between instances
subClassOf	An abstract description of possible inter-class relations
type	Class type of particular entity instance
hasType	Supported class specialization for exposed resources
requestsAccess	Used to relate an access requests with a service
supportsOperation	Denotes operations that can be executed on entity
acceptsOperation	Denotes operations that are accepted by the client
acceptsSubtype	Subtype of resources satisfying a client request

14 IEEE/IFIP DISSECT 2016 ӿ Istanbul, April 29 [th] 2016