Live Virtual Machine Lab 16‑2: Authentication and Authorization Methods
Virtual machine labs give students hands‑on experience with real‑world security practices. Even so, in Lab 16‑2, the focus is on two foundational pillars of information security: authentication and authorization. These concepts determine who can access a system and what they can do once inside. By the end of this lab, learners will understand how to configure authentication mechanisms, apply authorization policies, and troubleshoot common issues—all within a controlled virtual environment.
Introduction
Security is often described as a tripod: authentication, authorization, and accounting (AAA). On the flip side, while authentication verifies identity, authorization governs the permissions associated with that identity. In a virtual lab, you can experiment with LDAP directories, OAuth tokens, role‑based access control (RBAC), and attribute‑based access control (ABAC) without risking real data.
- Setting up a lightweight LDAP server for authentication.
- Configuring a web application to use LDAP for login.
- Implementing RBAC in the application.
- Exploring ABAC with JSON Web Tokens (JWT).
- Testing and validating access control decisions.
Step‑by‑Step Setup
1. Provision the Virtual Machine
- OS: Ubuntu 22.04 LTS (64‑bit)
- Resources: 2 CPU, 4 GB RAM, 20 GB SSD
- Network: Bridged or NAT with port forwarding for SSH (port 22) and HTTP (port 80/443)
Once the VM boots, log in as root or a user with sudo privileges.
2. Install Core Packages
sudo apt update
sudo apt install -y slapd ldap-utils apache2 libapache2-mod-ldapauth-proxy
slapd– Lightweight Directory Access Protocol server.ldap-utils– Command‑line LDAP tools.apache2– Web server for the demo app.libapache2-mod-ldapauth-proxy– Apache module for LDAP authentication.
3. Configure LDAP Directory
a. Pre‑configuration
sudo dpkg-reconfigure slapd
During the wizard:
- Domain:
example.com - Organization:
Example Corp - Admin password:
StrongPass!23 - Database backend:
MDB - LDAP directory:
yes
b. Add Users and Groups
Create an LDIF file users.ldif:
dn: ou=People,dc=example,dc=com
objectClass: organizationalUnit
ou: People
dn: uid=john,ou=People,dc=example,dc=com
objectClass: inetOrgPerson
uid: john
sn: Doe
cn: John Doe
userPassword: {SSHA}XyZ123...
dn: ou=Groups,dc=example,dc=com
objectClass: organizationalUnit
ou: Groups
dn: cn=admins,ou=Groups,dc=example,dc=com
objectClass: groupOfNames
cn: admins
member: uid=john,ou=People,dc=example,dc=com
Load the entries:
ldapadd -x -D cn=admin,dc=example,dc=com -W -f users.ldif
4. Configure Apache for LDAP Authentication
Edit /etc/apache2/conf-available/ldapauth.conf:
AuthType Basic
AuthName "Secure Area"
AuthBasicProvider ldap
AuthLDAPURL "ldap://localhost/ou=People,dc=example,dc=com?uid"
AuthLDAPBindDN "cn=admin,dc=example,dc=com"
AuthLDAPBindPassword "StrongPass!23"
Require valid-user
Enable the configuration and reload Apache:
sudo a2enconf ldapauth
sudo systemctl reload apache2
Now, accessing /protected will prompt for a username and password. john can log in successfully.
Implementing Authorization
5. Role‑Based Access Control (RBAC)
RBAC assigns permissions based on roles. In this lab, we’ll use Apache’s Require group directive It's one of those things that adds up..
a. Define Role Groups in LDAP
Add a new group managers:
dn: cn=managers,ou=Groups,dc=example,dc=com
objectClass: groupOfNames
cn: managers
member: uid=jane,ou=People,dc=example,dc=com
Load it with ldapadd.
b. Configure Apache for RBAC
AuthType Basic
AuthName "Admin Area"
AuthBasicProvider ldap
AuthLDAPURL "ldap://localhost/ou=People,dc=example,dc=com?uid"
Require group admins
Only users in the admins group can access /admin Surprisingly effective..
6. Attribute‑Based Access Control (ABAC)
ABAC uses attributes (claims) to make fine‑grained decisions. We’ll demonstrate this with JWTs.
a. Generate JWTs
Use a simple Python script:
import jwt, datetime
payload = {
"sub": "john",
"role": "user",
"exp": datetime.utcnow() + datetime.Which means datetime. timedelta(minutes=30)
}
token = jwt.
#### b. Protect a Flask API
Create `app.py`:
```python
from flask import Flask, request, jsonify
import jwt
app = Flask(__name__)
@app.route("/api/data")
def data():
auth_header = request.headers.get("Authorization")
if not auth_header:
return jsonify({"error": "Missing token"}), 401
token = auth_header.split()[1]
try:
payload = jwt.decode(token, "secretkey", algorithms=["HS256"])
if payload["role"] != "admin":
return jsonify({"error": "Forbidden"}), 403
return jsonify({"data": "Sensitive information"})
except jwt.ExpiredSignatureError:
return jsonify({"error": "Token expired"}), 401
except jwt.
if __name__ == "__main__":
app.run(host="0.0.0.0", port=5000)
Run the app:
python3 app.py
Test with curl:
curl -H "Authorization: Bearer " http://localhost:5000/api/data
Only tokens with "role": "admin" can access the endpoint.
Troubleshooting Common Issues
| Symptom | Likely Cause | Fix |
|---|---|---|
| LDAP authentication fails | Wrong bind DN or password | Verify AuthLDAPBindDN and AuthLDAPBindPassword |
Apache returns 403 for /admin |
User not in admins group |
Add user to group in LDAP |
| JWT verification errors | Expired token or wrong secret | Check exp claim and secret key |
| Flask API returns 500 | Missing pyjwt package |
pip install pyjwt |
FAQ
Q1: Can I use Active Directory instead of OpenLDAP?
A1: Yes. The configuration steps are similar, but the LDAP URL and schema may differ. Replace ldap://localhost with your AD server and adjust the base DN accordingly.
Q2: How do I secure the LDAP connection?
A2: Enable TLS by configuring slapd with cn=config and updating Apache’s AuthLDAPURL to ldaps://. Obtain a trusted certificate or use a self‑signed one for the lab.
Q3: Is RBAC better than ABAC?
A3: Not necessarily. RBAC is simpler and works well for many scenarios. ABAC offers finer granularity, especially when permissions depend on multiple attributes (e.g., department, clearance level).
Q4: What if a user needs temporary elevated access?
A4: Use time‑limited JWTs or temporary group memberships in LDAP. Automate the revocation process with scripts or directory policies.
Conclusion
Live Virtual Machine Lab 16‑2 demystifies the mechanics behind authentication and authorization. By configuring an LDAP directory, protecting web resources with Apache, and implementing both RBAC and ABAC, students gain a practical understanding of how identity and access management (IAM) systems operate. Mastery of these concepts is essential for building secure applications, designing dependable security architectures, and safeguarding organizational data Which is the point..
