Lab 1.5 - Implement Fine-Grained Access Controls

Up to this point any authenticated user to the API is authorized to use them. In this section we will restrict user1’s ability to create users, but will still be able to modify the user’s employee number.

Task 1 - Retrieve Group Membership Subsession Variable

Note

In order to implement fine-grained control the session variables that contain the data must be known. This first session shows you how to display the session variables and their values.

1. From the Jumpbox desktop click on the BIG-IP1 Putty icon

2. Enter the command sessiondump –delete all to remove any existing APM sessions

3. Enter the command tailf /var/log/apm. Hit enter a few times to create some space on the screen

4. From Postman, Select the request GET-Retrieve User Attributes-JWT-Pass. The Authorization field should already be populated with User1’s token.

5. Click Send
6. You receive a 200 OK response status code with attributes for user1 in the body of the response

Note

Your SessionID will be different

7. Return to the CLI and examine the logs. You will see a message about a new subsession being created. Copy the subsession ID

8. Exit the logs using Ctrl+Z
9. Enter the command sessiondump -subkeys <subsessionID>

10. Scroll through input until you find the session variable for subsession.oauth.scope.last.jwt.groups

Task 2 - Edit the per-request policy

1. Return to BIG-IP1’s management interface in the browser and click on the Access tab located on the left side

2. Navigate to API Protection >> Profile. Click Profile to modify the previously created API protection Profile (not the + Plus symbol)

3. Click Edit Under Per-Request Policy

4. Click the Allow terminal located at the end of the GET /aduser/create branch

5. Select Deny
6. Click Save

7. Click the + (Plus Symbol) on the GET /aduser/create branch

8. Click the General Purpose tab
9. Select Empty
10. Click Add Item

11. Enter the name Claim Check

12. Click the Branch Rules tab
13. Click the Add Branch Rule

14. Enter Name CreateUser
15. Click Change

16. Click the Advanced tab
17. Enter the string in the notes section to restrict access to only members of the CreateUser Group.
18. Click Finished

Note

expr {[mcget {subsession.oauth.scope.last.jwt.groups}] contains “CreateUser”}

19. Click Save

20. Click Reject on the CreateUser Branch to permit access

21. Select Allow
22. Click Save

23. Review the Policy Flow

Task 3 - Test the Fine-Grained Access Control with user1

1. From Postman select the request GET-Create User-JWT-Pass

2. Select the Authorization Tab

3. Select the previously created User1 token from the Available Tokens dropdown
4. The Token field is now populated
5. Click Send
6. You receive a 403 Forbidden response status code when using user1. User1 does not contain the proper claim data.

Task 4 - Test the Fine-Grained Access Control with user2

1. Select the request GET-Create User-JWT-Pass

2. Select the Authorization tab
3. Click Get New Access Token

4. Enter User2 for the Token Name and review the Postman Configuration. Nothing else should need to be modified
5. Click Request Token

6. Login using Username: user2, Password: user2

7. Scroll down to the token and click Use Token
8. The Token field is now populated
9. Click Send
10. You receive a 200 OK response status code when using user2. User2 does contain the proper claim data