Welcome to the Identity and Access Management Devroom.
Our next presenter is Danny Altairder, and he will be talking about Nubbus.
Welcome.
Thank you.
Welcome, I'm Daniel Triller, I'm Software Architect at Innovation.
This is my first time at Foster, and I'm enjoying it quite a much, maybe too much.
So when I practice this yesterday, I noticed that I need way too long, and this is a deaf
room.
So I guess you all want to see also some under the hood stuff, and so I'm going to try to skip
over the corporate stuff, just to work as a small company in Germany, with developers
from Spain, the states, and Germany, and the IAM, it produces all open source.
It's all a ferro, it keeps you free, and while it also works in small and medium businesses,
it's mostly our target group, is the public sector, and the educational sector, educational
sectors are very interesting for IAMs, because you have these domains in schools, and then
you have the school authorities, which is like a domain of domains, so like a forest or something,
and then you have the states, the ministries that are domains, or there are like collections
of school authorities, so you have like lots of levels, and at every level you have different
authorization, but come authentication, so it's very interesting context for IAMs, and
our vision is digital sovereignty, and we think the IAM is like the foundation for that,
if you don't control your identities, then you're missing like the foundation for your
environment, because you cannot control what's going on, and so our founders part of the
open source business alliance, and it's European partner April, so you find Nubus as an IAM
at the core of other products, I mean, who needs an IAM, now IAM is the ever wants to do anything
with them, they're interested in the applications, right? And in most environments, you
have already an IAM, like an active directory, Octa, and entering, how are they all called,
and so an IAM needs to integrate with that, and also, of course, needs to integrate the
applications, which are the actual value for the end users, and this is an example of how
Nubus is, for example, deployed and opened this, that's the office and collaborations
with of the German government, that it's issuing to its officers, and there it integrates
lots of applications with the upstream identity management systems, which already exists,
of course, and you find Nubus in two variants, one where it was originally developed
for is the N-based distribution, actually it's a deviant-based distribution, it's really
is deviant under the hood, plus lots of custom packages, and just for years ago we started
ripping out all the core parts of Nubus and putting them into containers and splitting them up
into more containers, and so on, until it is, well, clouds of where you would call it, so you
install it from a DVD, or either image, whatever, in your virtual machine, or on their metal,
and you get like a trendy solution, that scales well until, I know, 100,000 users may be on a
few servers, right, 20 servers or something, and all you install it by a helm, with one command
into Kubernetes, and then it's meant to scale upwards, or actually you can also, you don't
work, it's runs on my notebook, so it's needs more or less the same memory, yeah, like I said,
we're targeting so medium-sized organizations, so 100,000 to million users, and works with more
less to. Nubus is split up into functional components, you get the identity provider, which is
a heat-low, the portal, which tells each user what applications they have access to,
self-service, so you don't bother the help desk, and so on directory manager is the API to access
the data in the LDAP, which is called identity store here, and an authorization service that
is new, it's a rest API where you can add rules and conditions and combine those to create
rules and permission sets, which you can then use to authorize access to attributes or objects,
or actions, depends on the application, so application needs to use that, and in the back end of
that works, or policy agent, the great software, and the rules are generated from that API into the
API, and then there's a provision service, which generates events for changes in the back end,
from the LDAP, so that you can hear where it was that, so that like objects change can be provisioned,
but kind of provisioned users and groups from changes in the LDAP. Okay, so this is basically what
NuBus offers way to get identities into the identity store and code them, validate them, store them,
and all of that, and then to issue events to your third party applications, and that's all
then I am usually done, plus our single sign on obviously, and okay, so this is like the data flow
that you usually have, you don't have only interactive settings of users, obviously you have
upstream systems or import processes where data gets into your IAM, and you have authentication
authorization, then everything, and then somehow that data gets sent out filtered, obviously you
don't need to send the birth day to get in to provision the main account, for example,
and so on to the applications, and so if you're a developer, for example, and you want to
your software to be accessible, you know, usable by users that have been created in an
octa or Microsoft Entra on Active Directory or whatever, then you don't want to usually connect to
all of those IAMs yourself, and what you can use here is that you connect to the
almighty, well that you authorize using almighty connect with kick-load, and that you connect
to the event API that tells you when there is a change in the laptop directory, and so you work
only with rest API, so I think very comfortable for developers, and of course, so every environment,
every customer, every user is different, and so you need to customize stuff, and you need to integrate
it into the environment where things should be run, and there you have of course customization,
which means CSS, and buttons, and icons, and stuff, right, for the front end, and then you have
the data model, which is, well, you can create custom objects, and you have users and groups and
computers, and DNS, but if you need bananas, well, you can create a banana object, and then you
also want to add attributes like user as enabled for next cloud, or, I don't know, color of
her color or whatever, and so on, so you want to change the data model, so this must be
like extensible, and then, and I, of course, also the encoding of all the data and so on, right,
and then you want to issue all of it, you want to integrate the applications that are the actual
value for the end user, and that is done through interfaces, and so as I said, portal, and it's
well, it's all the front end stuff, so you have can add content there, CSS and so on, then you can
add properties, and encoding, and business logic, and, okay, so I'm going to shortcut this time's running.
Maybe interesting is we're working on a skin server for the input and a skin client for the output
to move from like our own data model, which is custom, and not everybody knows that,
to standardize data model, and extensions are installed using like a package, where you can put
all of that inside, and then add that package to your Kubernetes cluster, or the virtual machine,
it's a bit different, but basically the same thing, and there we had a problem, because the whole
thing should be BSI compliant, or BSI as the German federal cyber security policy making institution,
and they say, for example, that root fault systems in containers must be read only, and
container images must be cryptographically signed, and so with these two things, how do we add
code to our model, how do we change the look and feel, and that was a bit of a problem at first,
and then we find out where we can do that, and actually, quite simple, you create a container
of your extensions, and that container you can sign, right, and it's, well, not changeable,
and at runtime, or at deployment time, at runtime, you can't change stuff, but at deployment time,
container is mounted as an internal container, how it is, image for that, right, and
the unit containers are executed one after another, so first in container stores the original
content of the directory, where you want to add extensions, and then the extensions added one after
another to that, and that is mounted as a volume onto the actual program, and then you have
immutable artifacts, the attribute cryptographically signed, but still you have the possibility to add
stuff to your application, and to the data model and so on, and I will show you the later,
if I have enough time, the structure is cut off, no, it's okay, it's very simple, in all that you need,
in your container is such a file system structure, where you have the plug-in types that are supported
by nubos, so let's add up schema, add up ACLs, UDM is this, was the data model, and that the
handler for that to use those groups and stuff, and management console is the UI for management,
and directly content, of course, you may want to add some example users or a directory structure
in the allowed, so you need a way to add objects, and that also using the general file,
and we use this method ourselves, or on code, the portal for example is optional, or actually
all, almost all, components of nubos are optional to install, and so they must use the same mechanism
to add the data, and the images and stuff that they need, dynamically, but not dynamically,
but at start time, okay, demo time, no, no, wait, yes, okay, as I said before, I started a small
gelatin cluster on my laptop using kind, very nice software, but works also with other
criminals, single node distributions, and so there will be a pod running, which pod is a few containers,
and if we now look for example at the UDM rest API, so that's the API to provision objects
in order to see this code of for me, is it complete for you, yes, yeah, so somehow this screen is not
full screen for me, okay, let's just fill this pod, and it will immediately spawn in U1,
and now we see that it multiple containers were created, there's one called compatibility and use
your commit, ignore that, there's loads internal plugins, load portload extensions, and then the
actual container, UDM rest API, and these, if we now look at them, they do copy operations,
trivial Cp1 to 1, so from the source to something called slash target, icons here and so on,
and then there's a load portload extensions, which is to add the extension that we need for the portal,
and here you can see it skips the plugin types that are not supported because there's nothing
at the target, so it cannot copy anything, and then it copies the stuff where it has found plugins,
so that's UDM handlers and the set icons and syntax, which is encoders, and module,
and let's really the whole magic, where is that, yeah, so if you look at the
portload extension container, you can actually look into the plugin directory and see
there's really that what I showed in the presentation, I just those files, and the embarrassing
symbol loader is this crazy code, that this is just copying, and that's legal, and that's
a secure, because the source and the target are signed, and there is no nothing in between,
that does that, so we all code is signed and not changed at runtime, so plugins are
simple to create, but what's the other side, the other side is integration, and that's done using
the freely API, wrong, wrong, what the, oh yeah, okay here, so that's the provision API,
one that issues events, well actually that offers to download events, so yes, you can subscribe
as a consumer, and then you get a name, you'll also subscribe to it, and when you subscribe,
you'll say for what objects you want to subscribe, like users, groups, DNS, entries, whatever,
and then updates about those objects will be streams to queue, and you'll everyone
can join us in their own queue, so all consumers can work in parallel and us synchronously,
and so I'll demo this, so we import HTTP client, and this is hanging, the password is already running,
so it's there, and here we've got a list of subscriptions, so that means consumers,
and we have the portal consumer, because it creates a kind of cash for the portal about users,
their groups, and what applications they can see, and then there's the self-service consumer that
sends emails for new registers that email users, but okay we need our own test user, right,
so we call it test, it is interested in users and groups, and it has a cool password,
so a shared secret, and created, and there you see our consumer is now there, and okay let's
look at get me the next message, and then it's, we do long polling, we could have done a
how's it called, web service, you know, interactive HTTP, APIs, so anyway we do long polling,
if there's nothing, then you get nothing, see, you get an empty JSON response, but if there is
something, you get an immediate return with a new object, there's no change, because we haven't done
anything in the directory, so I'm going to change a user, let me test one, not found, how is it possible?
I don't know, what's wrong here, I was one's to her, so a user has been changed, and I
find no now look for messages, I immediately get a change, so the administrator had the
hour first name was admin, and the new first name is admin test one, so we did change an
object in the directory and got an event for that, and if I look for changes again, I will get
the same change, because we are first to acknowledge this change, so that's if you're application
crashes, and then get up again, it can just ask again, if are there any changes, and if there
were none, then you will still get the same message, so you can do the same, if you crashed,
you can just ask again, you will get the same message, and finish your task, and only when you
finish your task, you set the state, you acknowledge the thing, and so that was the message number one,
and then you have acknowledged the change and you can move on to that the next event,
okay, times drying out, yeah, funny works, okay, so time short, you can contact me via email
or there are document documents online for architect operators and developers, and we have a
forum, we can also contact us, and you will find me here if you have questions with
two, a few minutes, are you? So we have almost seven minutes, actually, we have one question
through metrics, so I will read it for you, on this slide about the setup with Kubernetes,
there was a line, BSI compliant for the higher security levels, yes, so the question
is, do you know about any uses in VS and MIT compliant environments? I got there, this is something
German, government compliant specific, can you repeat the other words? Yes, and FD compliant,
I'm sorry, I don't know what that is, okay, maybe you can show in metrics and collaborate with
okay, I will look there, thank you, any questions? Okay, thank you very much, thank you