Authentication with a Password File

xorlab Security Platform users can be authenticated using a static password file. Similarly to LDAP-based authentication, the configuration of the backend is defined in the fileAuthDataSources: subsection of the usernamePasswordAuthBackends: section in the auth/auth/auth.yml file.

Before you start configuring this backend, please read the Authentication article, if you haven’t already.

Generally, we don’t recommend this authentication method as it’s more vulnerable than the others, e.g., it is prone to credential abuse and doesn’t allow 2FA. If you really need to use it, please make sure to follow these two principles:

Use secure passwords or passphrases, i.e., make them unique, random, and long; preferably create them in a password generator of your favorite password manager or use an online service like Bitwarden.
Don’t share accounts.

Enable Logging

With this authorization method, it’s good to know whether there were any unsuccessful login attempts. You can use the logging system for that:

Follow the instructions for logging audit trail events to create a log for the audit.access.denied event.

Your auth/auth/logback-audit.xml config file should look like the one below:

<?xml version="1.0" encoding="UTF-8"?>
<included>
 <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
   <syslogHost>syslog.example.com</syslogHost>
   <port>514</port>
   <protocol>UDP</protocol>
   <facility>LOCAL0</facility>
   <encoder>
   <pattern>%jsonMsg%n</pattern>
   </encoder>
 </appender>

 <!-- Log all unsuccessful login attempts -->
 <logger name="audit.access.denied">
   <appender-ref ref="syslogAppender"/>
 </logger>
</included>

If you want to log all login attempts—both unsuccessful and successful—just change the logger name value to "audit.access".

Basic Configuration

The following configuration example shows how to enable this option:

enabledAuthBackends:
  - examplePassword

usernamePasswordAuthBackends:
  examplePassword:
    enabledAuthDataSources:
      - passwordFile

    fileAuthDataSources:
      passwordFile:
        file: passwordFile.yml

In this example, we defined the examplePassword backend, then we configured it under the usernamePasswordAuthBackends: section:

in the enabledAuthDataSources key, we set the only source of auth data to passwordFile, then
in the file key for this source under fileAuthDataSources, we pointed to the passwordFile.yml file which contains the password.

Password file

Using Expert Editor, open the default passwordFile.yml located in auth/auth/ and edit it. Use the example below to create your own password file:

users:
  - username: admin
    tenant: customerA
    displayName: The Admin
    passwordHash: "<ADD PWD HASH HERE>"
    emails: ["email1@example.com", "email2@example.com"]
    roles:
      - xcc_admin
  - username: user1
    tenant: customerA
    passwordHash: "{bcrypt}$2y$10$.4If2RFwcvHRrxlR98m9ju/mCRYCHLAYULByGXvJY.jBuK2/bckZu"
    roles:
      - xcc_analyst

All users are listed under the users: section and their available attributes are explained in the table below:

Attribute	Value
`username`	Unique user name
`tenant`	The `tenant` attribute should reference either `name` or `authTenantId`, defined in guarded_tenants.yml
`displayName`	More descriptive user name
`passwordHash`	Hash value of a password (see Password hash generator below)
`emails`	List of emails associated with the user
`roles`	Role in AG assigned to the user (see Users, Roles, and Permissions)

Password hash generator

Run the docker exec -it auth_auth create_hash command on the XCC terminal to generate a password hash from the password you enter and re-type when prompted. You should get the output similar to the one below:
$ docker exec -it auth_auth create_hash ActiveGuard password hash generator Password to hash: 1234 Hashed password: {bcrypt}$2a$10$YOmSE8jp9fSBlVP3P3KEh.UnezedRVSnBZL7x5xWQvYfiBF0z49Uy
Copy the generated hash, open Expert Editor and paste it into auth/auth/passwordFile.yml as a value for the passwordHash key of a particular user.
Once you finish adding password hashes for all users, click PUBLISH to deploy changes. After one minute, the changes will be hot-reloaded and active.

In case you don’t have access to the XCC terminal, run htpasswd -nBC 10 ignore | sed 's/ignore:/{bcrypt}/' on a Linux terminal to generate a password hash as alternative to step 1 above.

Multi-Tenant Configuration

Please refer to Multi-Tenant Password Authentication for instruction on how to configure password file-based authentication in a multi-tenant environment.

​Enable Logging

​Basic Configuration

​Password file

​Password hash generator

​Multi-Tenant Configuration

Enable Logging

Basic Configuration

Password file

Password hash generator

Multi-Tenant Configuration