Restricting authorization on a web app based on certain criteria

Question

For a web app, we are authenticating and authorizing users. There is no Sign-up option, but rather these users are provisioned into the system explicitly and are given certain permissions based on their level.

Say a role has access to customer data. This access is required to conduct business processes during business hours, or say when that user has an appointment with a specific customer.

Is there any way that we can restrict (or reduce) the permission of a user based on certain criteria, e.g. they are using the web app on mobile, or it is outside business hours, or it is being accessed outside a set location?

I have come across this question where they suggest to use IP based restriction, or specific hardware devices with certificate installed. IP restriction could be enabled, but it does not solve the need to access on the go. Having specific hardware doesn't help if they provide full access on the go. I don't have much of a background in security, so any direction is appreciated.

Update From what everyone is suggesting, I will try to understand about Identity Aware Proxy which would handle dynamic generation of permission, or roll out something on the db side, or look at setting up logging. Thanks for sharing. I don't know which is the right answer.

Answer 1

It is not uncommon that access is restricted by IP address, geographic location, type of device (especially managed or not), patch status, time etc. Some of these information need to have agents on the client device, others not.

There are several solutions out there which help implementing this. Look out for the capabilities of IAP (Identity Aware Proxy) offered by various companies in the context of Zero-Trust and BeyondCorp, Conditional Access in AD etc. Some relevant players in the area are ZScaler, Akamai, Cloudflare, Okta, Cisco Duo, Microsoft, ...

Answer 2

You say, "we are authenticating and authorizing users. There is no Sign-up option, but rather these users are provisioned into the system explicitly and are given certain permissions based on their level."

This suggests that you have something akin to a back-end database along the lines of:

 User                 Permission_Level
-------------         ----------------

Bob                   Level 3
Jane                  Level 7
Al                    Level 1

and you query the permission level for each user.

You need to expand your permissions level to include your other parameters and dynamically compute the effective permission level as a function of the additional parameters, such as:

 User  Max_Level                    Effective_Level
-----  ---------  -----------------------------------------------------------  

Bob       3       Function(Max_Level - Device_Type - Date_time_chunk - Other)
Jane      7                           same     
Al        1                           same  

Unless you're dealing with a denial of service attack, you probably don't want to block the IP address. Additional parameters you may want to include in your computed effective level by individual user might include:

• Suspended
• Suspension Time
• Alert

Probably others. Most of the information, including the device type can be determined on the fly by the web server.

Answer 3

I'd like to suggest what may be simpler, alternative solution.

If access to application is provisioned only to 'trusted' employees, you could set up a policy specifying your access restrictions (working hours etc). This policy could be visible at the login to the web app.

On the application backend, you set up logging for authentication requests and the running a certain functions/who ran them, etc within the application. Those logs could be exported to centralized logging system that flags events that you create (access outside 9-5 etc).

Depending on how serious of a security breach it would be for a user to use the application outside of policy, the policy and risk of being caught may be a strong enough deterrent to keep your users in check.

Worth checking out: https://geekflare.com/open-source-centralized-logging/

Answer 4

consider placing identity-aware proxy (IAP) in front of your application.

1. IAP would authenticate end user using any of the auth providers that you employ within your organization (google, office365, AD, etc). That yields JWT ID token that can be cryptographically verified (usually auth vendors publish their public keys and/or provide server-side SDK for you to verify that). This token confirms who the user is.
2. Then you need use IAP to authorize the user to access your application. IAP would consult some kind of policy, that could be as simple as allow authenticated [email protected] to access this particular app, or use some role mapping using SAML, group membership, etc. This typically results in ID token being exchanged into shorter-lived session JWT token, that is often set as a cookie for the target application domain.
3. You may propagate user information further down to database layer - i.e. if you use PostgreSQL, then mapping user role to database role is an excellent approach, that would decouple your application logic from data security.

check out:

• https://firebase.google.com/docs/auth/admin/manage-cookies
• https://pomerium.io (open source IAP)
• https://cloud.google.com/iap/ or https://gw.run for a cloud-managed IAP
• https://www.postgresql.org/docs/current/ddl-rowsecurity.html