Identity and Access Management

Buckit requires the client perform both authentication and authorization for each new operation.

Authentication: The process of verifying the identity of a connecting client. Buckit requires clients authenticate using AWS Signature Version 4 protocol with support for the deprecated Signature Version 2 protocol. Specifically, clients must present a valid access key and secret key to access any S3 or Buckit administrative API, such as PUT, GET, and DELETE operations.
Authorization: The process of restricting the actions and resources the authenticated client can perform on the deployment. Buckit uses Policy-Based Access Control (PBAC), where each policy describes one or more rules that outline the permissions of a user or group of users. Buckit supports S3-specific actions and conditions when creating policies. By default, Buckit denies access to actions or resources not explicitly referenced in a user’s assigned or inherited policies.

Identity Management

Buckit supports both internal and external identity management:

IDentity Provider (IDP)	Description
Buckit Internal IDP	Provides built-in identity management functionality.
OpenID	Supports managing identities through an OpenID Connect (OIDC) compatible service.
Buckit Authentation Plugin	Supports a custom external identity manager using the Buckit Authentication Plugin extension.
Active Directory / LDAP	Supports managing identities through an Active Directory or LDAP service.
Access Management Plugin	Supports a custom external access manager using the Buckit Access Management Plugin extension.

Once authenticated, Buckit either allows or rejects the client request depending on whether or not the authenticated identity is authorized to perform the operation on the specified resource.

Buckit uses Policy-Based Access Control (PBAC) to define the authorized actions and resources to which an authenticated user has access. Each policy describes one or more actions and conditions that outline the permissions of a user or group of users.

Buckit manages the creation and storage of policies. The process for assigning a policy to a user or group depends on the configured IDentity Provider (IDP).

Buckit deployments using the Buckit Internal IDP require explicitly associating a user to a policy or policies using the bm admin policy attach command. A user can also inherit the policies attached to the groups in which they have membership.

By default, Buckit denies access to actions or resources not explicitly allowed by an attached or inherited policy. A user with no explicitly assigned or inherited policies cannot perform any S3 or Buckit administrative API operations.

For Buckit deployments using an External IDP, policy assignment depends on the choice of IDP:

OpenID Connect (OIDC)	Buckit checks for a JSON Web Token (JWT) claim (`policy` by default) containing the name of the policy or policies to attach to the authenticated user. If the policies do not exist, the user cannot perform any action on the Buckit deployment. Buckit does not support assigning OIDC user identities to groups. The IDP administrator must instead assign all necessary policies to the user’s policy claim. See Access Control for Externally Managed Identities for more information.
Active Directory / LDAP (AD/LDAP)	Buckit checks for a policy whose name matches the Distinguished Name (DN) of the authenticated AD/LDAP user. Buckit also supports querying for the authenticated AD/LDAP user’s group memberships. Buckit assigns any policy whose name matches the DN for each returned group. If no policies match either the user DN or any of the user’s group DNs, the user cannot perform any action on the Buckit deployment. See Access Control for Externally Managed Identities for more information.

OpenID Connect (OIDC)

Buckit checks for a JSON Web Token (JWT) claim (policy by default) containing the name of the policy or policies to attach to the authenticated user. If the policies do not exist, the user cannot perform any action on the Buckit deployment.

Buckit does not support assigning OIDC user identities to groups. The IDP administrator must instead assign all necessary policies to the user’s policy claim.

See Access Control for Externally Managed Identities for more information.

Active Directory / LDAP (AD/LDAP)

Buckit checks for a policy whose name matches the Distinguished Name (DN) of the authenticated AD/LDAP user.

Buckit also supports querying for the authenticated AD/LDAP user’s group memberships. Buckit assigns any policy whose name matches the DN for each returned group.

If no policies match either the user DN or any of the user’s group DNs, the user cannot perform any action on the Buckit deployment.

See Access Control for Externally Managed Identities for more information.

Buckit PBAC is built for compatibility with AWS IAM policy syntax, structure, and behavior. The Buckit documentation makes a best-effort to cover IAM-specific behavior and functionality. Consider deferring to the IAM documentation for more complete documentation on IAM, IAM policies, or IAM JSON syntax.

Deny overrides Allow

Buckit follows AWS IAM policy evaluation rules where a Deny rule overrides Allow rule on the same action/resource. For example, if a user has an explicitly assigned policy with an Allow rule for an action/resource while one of its groups has an assigned policy with a Deny rule for that action/resource, Buckit would apply only the Deny rule.

For more information on IAM policy evaluation logic, see the IAM documentation on Determining Whether a Request is Allowed or Denied Within an Account.