Hands-on 04-authentication-and-access-control: Lab

name

Build and test a default-deny RBAC decision path

constraints

Run this exercise only on a disposable or authorized homelab system.
Every filesystem mutation made by the exercise is confined to /opt/lab-classroom/class67/.
The exercise does not create operating-system users, change host authentication, or expose a network listener.
The sample credentials exist only inside the short-lived Python process and are not production secrets.

steps

step

1

instruction

Create the dedicated lab directory with restrictive default permissions.

command

umask 077 && mkdir -p /opt/lab-classroom/class67/

step

2

instruction

Run the demonstration. It builds an in-memory identity store, executes six tests, and appends JSON audit events to the dedicated lab directory.

command

umask 077 && python3 - <<'PY'
import hashlib
import hmac
import json
import secrets
from datetime import datetime, timezone
from pathlib import Path

BASE = Path('/opt/lab-classroom/class67')
AUDIT = BASE / 'audit.jsonl'
ITERATIONS = 210_000
GENERIC_FAILURE = 'Invalid credentials or account unavailable'

PERMISSIONS = {
'viewer': {'inventory.read'},
'operator': {'inventory.read', 'service.restart'},
'administrator': {'inventory.read', 'service.restart', 'identity.manage'},
}

def derive(password, salt):
return hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), salt, ITERATIONS)

def record_for(password, role, enabled=True):
salt = secrets.token_bytes(16)
return {
'salt': salt,
'verifier': derive(password, salt),
'role': role,
'enabled': enabled,
}

USERS = {
'alice': record_for('class67-alice-demo', 'viewer'),
'bob': record_for('class67-bob-demo', 'operator'),
'carol': record_for('class67-carol-demo', 'administrator', enabled=False),
}
DUMMY_SALT = secrets.token_bytes(16)
DUMMY_VERIFIER = derive('dummy-value-never-used-for-login', DUMMY_SALT)

def audit(event, fields):
entry = {
'timestamp': datetime.now(timezone.utc).isoformat(),
'event': event,
fields,
}
with AUDIT.open('a', encoding='utf-8') as handle:
handle.write(json.dumps(entry, sort_keys=True) + '\n')

def authenticate(username, password):
account = USERS.get(username)
salt = account['salt'] if account else DUMMY_SALT
expected = account['verifier'] if account else DUMMY_VERIFIER
supplied = derive(password, salt)
password_matches = hmac.compare_digest(supplied, expected)
if account and password_matches and account['enabled']:
audit('authentication_success', username=username)
return {'username': username, 'role': account['role']}, None
reason = 'unknown_user'
if account and not password_matches:
reason = 'invalid_password'
elif account and password_matches and not account['enabled']:
reason = 'account_disabled'
audit('authentication_failure', username=username, reason=reason)
return None, GENERIC_FAILURE

def authorize(principal, permission, resource):
if not principal:
return False
allowed = permission in PERMISSIONS.get(principal['role'], set())
audit(
'authorization_allowed' if allowed else 'authorization_denied',
username=principal['username'],
role=principal['role'],
permission=permission,
resource=resource,
)
return allowed

def check(label, condition):
if not condition:
raise AssertionError(label)
print('PASS:', label)

principal, error = authenticate('alice', 'class67-alice-demo')
check('viewer authentication succeeds', principal is not None and error is None)
check('viewer may read inventory', authorize(principal, 'inventory.read', 'node-01'))
check('viewer may not restart service', not authorize(principal, 'service.restart', 'node-01'))

principal, error = authenticate('bob', 'class67-bob-demo')
check('operator authentication succeeds', principal is not None and error is None)
check('operator may restart service', authorize(principal, 'service.restart', 'node-01'))

principal, error = authenticate('carol', 'class67-carol-demo')
check('disabled account is rejected generically', principal is None and error == GENERIC_FAILURE)

principal, error = authenticate('alice', 'wrong-password')
check('wrong password is rejected generically', principal is None and error == GENERIC_FAILURE)

principal, error = authenticate('mallory', 'anything')
check('unknown user is rejected generically', principal is None and error == GENERIC_FAILURE)

print('Audit path:', AUDIT)
PY

step

3

instruction

Inspect the audit file without displaying or searching for any real secrets. Confirm that the file contains parseable JSON events and that denied operations are represented.

command

python3 - <<'PY'
import json
from pathlib import Path
p = Path('/opt/lab-classroom/class67/audit.jsonl')
rows = [json.loads(line) for line in p.read_text(encoding='utf-8').splitlines() if line.strip()]
print('event_count=', len(rows))
print('event_types=', sorted({row['event'] for row in rows}))
print('denied_permissions=', [row.get('permission') for row in rows if row['event'] == 'authorization_denied'])
assert rows
assert any(row['event'] == 'authentication_success' for row in rows)
assert any(row['event'] == 'authentication_failure' for row in rows)
assert any(row['event'] == 'authorization_allowed' for row in rows)
assert any(row['event'] == 'authorization_denied' for row in rows)
assert all('password' not in row for row in rows)
print('PASS: audit verification complete')
PY

discussion_prompts

Why is the role checked again when a permission is requested even though authentication already succeeded?
What additional resource attributes would be needed to prevent an operator from restarting services on nodes outside the operator's assigned environment?
Which audit fields would help an incident responder without unnecessarily exposing secrets or personal data?
How would session expiration, role changes, and account disablement affect an already authenticated session in a production design?