Security

Authentication versus authorization

Authentication is the process of verifying identity. This identity can be a user account used by a person, a host ID used by a machine, a server certificate used by a server software component, or a client certificate used by a client software component. Authentication is usually performed by proving the identity bearer has a secret that is known only to the bearer.

After an identity is authenticated, authorization is the process of determining who is allowed to do what. Authorization is accomplished by assigning privileges or roles to an identity that accesses system objects.

A privilege is an access right to one or more system objects. A role is a collection of privileges. A role can be assigned to one or more users. A user may have multiple roles. Unlike hierarchical users, a role does not contain another role.

Symphony security model

Out of the box, the Symphony security model uses Symphony’s own user account database. A user account defined in the database includes a password to provide authentication, and assigned role, which provides authorization.

Symphony also provides a security plug in for sites that prefer to use a third-party security mechanism, such as Kerberos, LDAP, or ActiveDirectory, and so on.

Symphony user roles

Regardless of the authentication method you use, Symphony uses role-based authorization to control access to system objects. Symphony supports the following roles:
  • The Cluster Administrator role can administer any objects and workload in the cluster

  • The Consumer Administrator role can administer any objects and workload in consumers to which they have access

  • The Consumer User role can run workload in consumers to which they have access

User accounts are created and managed in EGO. EGO authorizes users from its user database.

Each consumer is associated with a list of user accounts that are allowed to access the consumer. Different user accounts can submit or control workload. However, each consumer is associated with only one user account for running workload—all workload that runs under one consumer runs under one operating system account.

Impersonation

Sometimes service instances require user-specific privileges to access certain resources. Sometimes due to a security policy at an organization, it is necessary to isolate the user under which a process runs. Symphony provides flexible ways to configure the user account under which workload runs, allowing you to isolate users and applications.

Impersonation means that the system runs executables under a designated operating system account.

Security across communication channels

Symphony uses open Secure Socket Layer (SSL) to secure communications between components. SSL is a protocol that uses encryption and authentication techniques to secure connections between clients and servers.