Improving Web Application Security: Threats and - CGISecurity

Chapter 4: Design Guidelines for Secure Web Applications 85Web or ApplicationServerDatabaseServerABCDRole-basedauthorizationTrustedservice identityTrust BoundaryDatabase Tr usts the Web /Application ServerFigure 4.6Trusted subsystem model that supports database connection poolingThe third option is to use a limited set of identities for resource access based on therole membership of the caller. This is really a hybrid of the two models describedearlier. Callers are mapped to roles in the application’s logical middle tier, and accessto classes and methods is restricted based on role membership. Downstream resourceaccess is performed using a restricted set of identities determined by the currentcaller’s role membership. The advantage of this approach is that permissions can beassigned to separate logins in the database, and connection pooling is still effectivewith multiple pools of connections. The downside is that creating multiple threadaccess tokens used to establish different security contexts for downstream resourceaccess using Windows authentication is a privileged operation that requiresprivileged process accounts. This is counter to the principle of least privilege. Thehybrid model using multiple trusted service identities for downstream resourceaccess is shown in Figure 4.7.Web or ApplicationServerDatabaseServerABCDRole1Role2Trusted serviceidentity 1Trusted serviceidentity 2Trust BoundaryIdentity 1 and 2 havedifferent permissions in thedatabaseFigure 4.7Hybrid model