Implementing System AuthN & Compliance at Pinterest | by Pinterest Engineering | Pinterest Engineering Weblog | Jan, 2023

Armen Tashjian | Safety Engineer, Company Safety

Flow map from User to Okta to External Identity Provider to Device Compliance Check with an arrow back to Okta “User redirected back to Okta to proceed with authentication.”

Pinterest has enforced using managed and compliant units in our Okta authentication circulation, utilizing a passwordless implementation, in order that entry to our instruments all the time requires a wholesome Pinterest machine.

Following the phishing-based assaults towards our friends within the tech trade, Pinterest determined to take a two pronged strategy to defend towards comparable assaults. We determined to:

  1. Require a managed and wholesome Pinterest machine be used to entry all Pinterest sources, even when within the possession of legitimate credentials
  2. Require FIDO2 credentials for consumer authentication

On this publish, we’ll be specializing in how we required using Pinterest managed units in our Okta authentication circulation.

Picture 1: A consumer on an Android machine is prevented from authenticating. Picture 2: A consumer on macOS is warned about some compliance failures.

There are a number of driving forces behind this initiative:

  • With the introduction of our PinFlex WFH coverage, we anticipated an elevated variety of workers interacting with Pinterest instruments and companies outdoors of the workplace.
  • For worker going through instruments, Pinterest is a SaaS-first firm, which implies that the overwhelming majority of our instruments are web accessible. These instruments will stay internet-accessible both by selection, or due to the dearth of native IP-based allowlisting capabilities.
  • Our urge for food for network-centric safety controls has diminished. Whereas that doesn’t imply that VPN or on-premise network-based entry will probably be fully going away, we acknowledge that our default place gained’t be to drive customers to be on a selected community with a view to entry sources, particularly a SaaS device.
  • We now have a set of essential safety controls that solely exist on company-managed units and/or Cellular BYOD with MDM.

We really feel that requiring a managed and wholesome machine for authentication mitigates a few of the misplaced safety boundaries described above, by making certain that:

  • Phished consumer credentials (whether or not password, OTP, or push notification) won’t lead to entry to Pinterest sources.
  • Web-accessible Pinterest instruments, together with those who might comprise delicate information, can’t be accessed from unmanaged or unknown units.
  • Managed units will probably be in a hardened state, making it harder for adversaries to realize a foothold.

Whereas researching the completely different integration choices inside Okta, a number of issues turned obvious for Okta Basic prospects:

  1. The prevailing bespoke machine associated integrations that do exist between MDM suppliers and Okta, equivalent to System Belief with Jamf or WS1, don’t present complete options to prospects.
  2. If an Okta buyer or a possible vendor needs to combine with Okta to do one thing “attention-grabbing” with the authentication circulation, the one avenue for doing so is to determine mutual belief with some external identity provider (IdP), the place these “attention-grabbing” issues can happen.

Due to this fact, we didn’t have a lot of a selection however to construct and route customers to our personal customized id supplier. Zuul (apologies Netflix) is an OIDC id supplier that the Pinterest safety staff constructed, with a view to incorporate our machine auth and compliance necessities into the Okta authentication circulation.

Flow map from User to Okta to External Identity Provider to Device Compliance Check with an arrow back to Okta “User redirected back to Okta to proceed with authentication.”
Picture 3: Excessive stage circulation diagram of Okta authentication with idP Routing/Discovery

Like a few of the distributors on this area, we combine our IdP with Okta utilizing IdP Routing/Discovery, the place our IdP acts as a trusted exterior id supplier. We combine with Okta utilizing the “IdP as SSO” strategy, reasonably than the “IdP as a Issue/MFA” strategy, because the latter conflicts with our FIDO2 implementation.

At its core, and from Okta’s perspective, our IdP is nothing greater than a compliant OIDC IdP. Nonetheless, now that we’re within the essential path for SSO authentication, all the expertise, in addition to the success of the authentication request, could be enhanced to implement using a managed and compliant machine.

One of many challenges that must be overcome with any device-based answer is having the ability to affiliate an authentication try with a selected machine. This requirement is why a certificate-based strategy was a lovely choice.

We concern certificates to all managed units, together with desktop and cellular platforms, by our MDM answer, which requires customers to authenticate to ensure that a credential to be issued to the machine. This enables us to:

  1. Decide the consumer id earlier than interacting with them (e.g. FIDO2) by encoding the consumer id within the PKI certificates issued to the machine throughout MDM enrollment
  2. Affiliate an authentication try with a bodily machine, because the certificates was issued to that machine throughout enrollment
  3. Keep away from platform-specific brokers, as certificate-based authentication is natively supported on the platforms that we assist at Pinterest, so we’re in a position to benefit from a platform-agnostic strategy to authentication

Our customized IdP solely helps mTLS authentication with consumer certificates, utilizing certificates which might be tied each to a consumer and machine. And not using a legitimate consumer certificates, which is just distributed to managed units, authentication to our IdP is just not potential.

For functions that don’t assist Mutual TLS authentication, for the explanations described within the followup weblog publish, a workaround exists to revert again to password-based authentication.

One other hurdle to beat is Okta’s lack of “enforcement” of an exterior id supplier. Though we will route customers to an exterior id supplier, Okta doesn’t present the instruments essential to correctly implement using an id supplier.

Okta clearly indicates that using IdP Routing, and corresponding IdP Routing Guidelines, is just not a safety management:

Routing guidelines enhance the end-user sign-in expertise, however they don’t present safety enhancements. It’s worthwhile to configure consumer authentication insurance policies in your IdPs independently of your routing guidelines.

This successfully implies that we can not depend on exterior IdP as being something greater than an “non-obligatory” type of authentication. With out taking any further steps to implement using an exterior IdP, it’s trivial to bypass using an exterior IdP by reverting again to Okta username/password-based authentication.

Within the quote above, Okta alludes to “consumer authentication insurance policies” as a technique of enforcement. Had these referenced insurance policies been precise “utility sign-on insurance policies,” enforcement would have been a non-issue. Sadly, the one Okta insurance policies that exist are “world sign-on” insurance policies, which can not account for the inevitable utility exceptions that you’ll possible run into, and are subsequently not sensible to make use of.

SAML Inline Hooks permit for an exterior service to switch a SAML assertion earlier than that SAML Assertion is signed by Okta. On the floor, that’s not likely related to a tool authentication answer, however there may be one notable return sort that piqued our curiosity: the power to reject an entry try by returning an error.

The requests despatched by Okta in a SAML Inline Hook comprise some related details about an utility entry try, together with:

  1. The appliance that’s being accessed
  2. The consumer making an attempt to entry the appliance
  3. How the consumer’s Okta session was established

Within the examples under, notice the distinction between the “periods” in these two app entry makes an attempt.

Entry try to reject (exterior IdP not used)

Entry try to permit (exterior IdP used)

Because of this we will programmatically make an access-based resolution for each single utility entry try. For an entry try that ought to proceed, we return an empty response. For entry makes an attempt that must be rejected, we throw an error. In different phrases, we will overcome no matter limitations exist in Okta app sign-on insurance policies by bolting on our personal customized app sign-on coverage utilizing an inline hook.

To enhance the consumer expertise, we additionally revoke a consumer’s Okta session when this error is surfaced.

Within the instance under, a consumer has established an Okta session with one of many many ways in which IdP routing could be bypassed, in an try to bypass our machine necessities. But, they nonetheless can not entry an utility that requires our exterior IdP.

User is directed to a 400 bad request screen and has to be redirected back to the hompage.
Picture 4: SAML Inline Hook blocks an utility entry try, because of an Okta session that was not established with the right idP

Though SAML Inline Hooks signify an excellent momentary answer for us, that is under no circumstances excellent. SAML Inline Hooks have to be enabled on a per utility foundation and may solely be enabled on functions which might be manually configured in Okta, so some reconfiguration of apps is likely to be mandatory. We’re planning to reconfigure functions that have been downloaded from the Okta Integration Network for the only real function of enabling our SAML Inline Hook on these functions.

We’re hopeful that Okta will launch one thing, in both Okta Basic or OIE, that permits for us to natively implement an IdP on a per utility foundation, with a configuration that additionally permits FIDO2 enforcement. Alternatively, an “Inline Hook” for basic authentication that may be universally utilized to each Okta app would even be an attention-grabbing various.

Now that each Okta authentication try requires customers to authenticate towards our IdP, we have now the chance to judge the well being of a tool. The intent of our compliance insurance policies is to implement our safety hardening tips to make sure that the fleet of units which might be able to accessing our instruments are in compliance and in a hardened state.

Within the occasion {that a} machine with compliance failures makes an attempt to authenticate, we will take a number of actions, together with presenting a warning to the consumer, or for some insurance policies, blocking the authentication try altogether.

User is directed to a screen that reads “There are one or more issues with your device. Warnings: chrome_running_versions and uptime.”
Picture 5: A consumer on macOS is warned about some compliance failures.

Our compliance framework permits for some capabilities that have been essential to us and usually are not generally seen in different options. This consists of:

  1. Insurance policies which might be outlined as code, permitting us to create complicated insurance policies if mandatory
  2. Insurance policies that may keep in mind information from as many information sources as wanted. We at present combine with Splunk, Chef, Workspace One, and osquery, with extra integrations deliberate.
  3. “Actions” which might be executed upon the failure of a coverage, two of which we present on this weblog publish (Block/Warn)
  4. The power to slowly shard a brand new coverage throughout the fleet, utilizing our present manufacturing framework for deploying experiments

Beneath we’ve created an instance coverage to make sure that a consumer authenticating to Okta is doing so from a tool that’s owned by them and logged in on that machine with an identical username.

Picture 6: A consumer on macOS is prevented from authenticating as their machine is failing the instance coverage “username_mismatch”.

Beneath is the code related to this instance coverage. In an effort to carry out this analysis, we take information collected from two completely different information sources (Airwatch MDM and osquery), and examine the usernames with the particular person making an attempt to authenticate to Okta.

Potential future compliance insurance policies may keep in mind:

  1. Patch standing
  2. Malware detection
  3. Safety agent well being
  4. Log ingestion well being
  5. Utility/browser extensions
  6. Kernel/system extensions
  7. Root CAs
  8. CIS hardening tips
  9. And many different issues!

We’ve solely begun our machine compliance journey, and an excellent quantity of labor lies forward, together with:

  • Repeatedly codifying machine compliance insurance policies
  • Extra integrations, for each amassing information, in addition to performing actions within the occasion of failures
  • Evaluating machine compliance not simply at authentication time, however on a steady foundation
  • Closing the Okta enforcement gaps by enabling SAML Inline Hooks throughout all apps

A giant thanks to our companions in IT and Site visitors Engineering, for serving to Company Safety to implement this, and a particular point out goes to Jason Craig, a human being.

Keep tuned for some followup weblog posts, together with:

  • Our FIDO2 implementation
  • A extra in depth look into machine compliance

For any ideas or suggestions, be happy to achieve out to zuul[at]pinterest.com

To study extra about engineering at Pinterest, try the remainder of our Engineering Weblog and go to our Pinterest Labs web site. To discover life at Pinterest, go to our Careers web page.