BSidesSF 2017 - Access Control with Concierge: One Tool to Rule Them All (Karthik Rangarajan)

### Overview In this BSidesSF 2017 presentation, Kartik Rangarajan introduces Concierge, an internal identity and access management (IAM) tool designed to streamline onboarding, offboarding, and role-based permissions across disparate corporate and infrastructure systems. Prior to Concierge, managing access meant dealing with over a hundred credentials scattered across OpenLDAP, Google Single Sign-On (SSO), Salesforce, Expensify, SSH, GitHub, and internal SaaS products. New employees faced multi-day onboarding delays involving numerous Jira tickets across IT, DevOps, and business operations, while offboarding under tight deadlines was error-prone and audits took days of manual log pulling. Concierge was built to automate these workflows, establish a single source of truth, and avoid manual management tasks such as RDPing into Windows servers.

### Key Topics - **Single Source of Truth:** Concierge pulls canonical employee information (departments, names, roles) from BambooHR and maps them into Active Directory (AD). AD acts as the source of truth for access groups and rights, which OneLogin then syncs with to handle SAML SSO into cloud tools like Google Apps and Salesforce. - **SSH and Linux Fleet Access:** Because the organization relies on Linux instances in EC2 and does not use AD for server logins, Concierge handles SSH public keys directly. Users upload their SSH keys to Concierge, and a custom SaltStack state/module queries Concierge on a recurring schedule (every ~30 minutes) to create, update, or remove user accounts on target instances according to their team role. - **Ephemeral and Privileged Access:** For high-sensitivity systems requiring compliance controls, Concierge introduces dynamic "access services" to grant time-limited access (e.g., SSH to specific servers, AWS access, or customer staging/production environments) with manager approval workflows, secondary IT/DevOps notifications, and immediate revocation capabilities. - **Comet Environments:** Managing ephemeral test environments called Comet, which persist for two days for performance testing and development.

### Technical Details - **Extensibility via Python Metaclasses:** Concierge employs a modular Python interface called the dormant service interface. To integrate a new system or service (such as an SSH target), engineers implement standard methods defining how to list access objects, list users, create or delete accounts, and configure approval criteria without modifying the core backend or frontend UI. - **Asynchronous Task Architecture:** Concierge leverages Celery backed by RabbitMQ or Redis to execute non-blocking operations, list access objects asynchronously, expire access automatically upon timeout, and handle retries with idempotency if third-party APIs (such as OneLogin) fail during offboarding. - **Frontend and APIs:** The application features Google OAuth login, an administrative interface using Google Materialize, a comprehensive audit trail of system and user events, and a pre-configured Python client leveraging RESTful API keys.

### Takeaways Concierge demonstrates how unifying HR systems, Active Directory, SSO providers, and configuration management tools (SaltStack) into a coherent architecture eliminates administrative overhead in identity governance. Rangarajan highlighted ongoing work before open-sourcing the project, focusing on improving UI design, expanding backend and frontend test coverage to support open-source contributions, and hardening automated offboarding retries. Testing prior to production rollout was validated using a dedicated secondary Google Apps domain.