How to build subscription based security around Azure functions

Working in company which deals with hundreds of client azure tenants showed me how different it is working on your own tenant.

Recently i worked on a subscription based service and i want to show you how to build the secruity walls arround your azure functions.

Here is an example of subscriotion service which caters differently for each client based on thier type of subscription. Free or Paid or Premium. 

Data Persistence Models in Docker Containers

A container has different layers starting with Minimal Subset of OS topped by Container Filesystem topped by Application layer topped by Hosting layer. All these layers are read-only.

There is a top layer called Container Runtime layer which will be in a Read/Write state. 

The data on Container Runtime layer is persistent only when the container is stopped/started . If a continer is deleted, this data will be lost forever. Also this data is isolated only to that continer and cannot be shared with other containers.

So lets look at better data persistance models to share data between different containers on a Host.

Volume and Bind Mount are two ways of persistent data storage thats avilable on a Host, which can be accessed (read/write) by multiple containers.

Volume is the storage created and managed by Docker. This means no containers can go beyond the boundaries of docker while working with volumes.

Bind Mount is the storage directly from file system of the host file. So if there is a malicious code deployed in a container, it can break the host by manipulating the host filesystem.

By now looking at color coding you should have understood that Volume is a better/safer way of storing and sharing data between containers. Let me show you by a demonstration.

AWS FreeTier Subscription - First 4 Things You Need To Do

As a AWS Free-Tier user you are entitled for lot of free compute power.

This is AWS way of saying "Please experiment and learn".

But expirements go wrong sometimes. In this case they can go really bad if you are not carefull.

Here are the 4 things you need to do first after signingup for AWS Free-Tier subscription.

#1. Set billing alert.

#2. Enable MFA

#3. Delete root account access keys

#4. Bring IAM dashboard's "Security Status" to all Green 5/5

Ok, i will take you through each change and explain you why.

Using Certificate Authentication for Cross Domain Communication

I have addressed couple of posts on logic behind certificates , how to use them with WCF in both transport and message security contexts.

In this post i try to present the basic idea and implementation of using certificates for communication between different parties in realtime scenario. Dont worry about the screenshots of config files, you can download the sample and get all the settings you required for copy.

There are many scenarios which demand certificates authentication mechanism. Common examples are
#1. Banking web application which do their transactions using FBA and Certificate authentication
#2. Server to Server calls.
#3. Service to Service calls
#4. Application to service calls.
and so on covering most of the high security requirments.

But everything boils down to "A cross domain communication or we can say Domain independent communication".

OAuth Basics

CodeProject
This sure looks like a Branded Car Logo . . . Isn't it.

No, this represents the new authentication mechanism on which most of the sites are working today.

OAuth - Open Authentication.

I love Valet key example. Many luxury cars come with a valet key. It is a special key you give the parking attendant and unlike your regular key, will only allow the car to be driven a short distance while blocking access to the trunk and the onboard cell phone. Regardless of the restrictions the valet key imposes, the idea is very clever. You give someone limited access to your car with a special key, while using another key to unlock everything else.

Basics of SAML

CodeProject

Before jumping into practical implementation of SSO, lets know the basics of SAML. 
SAML 

Security Assertion Markup Language (SAML) is an XML based framework developed by the Organization for the Advancement of Structured Information Standards (OASIS), used for the exchange of security information between different parties. This is an open standard that can be used to exchange security information between different products. 

History

# SAML V1.0 became an OASIS standard in November 2002. SAML V1.1 

# In September 2003 and has seen significant success, gaining momentum in financial services, higher

education, government, and other industry segments.

# In 2005, SAML V2.0 unifies the building blocks of federated identity in SAML V1.1 with input from higher

education's Shibboleth initiative and the Liberty Alliance's Identity Federation Framework.