Authentication - Atypon-OpenSource/wayf-cloud GitHub Wiki

Table of Contents

• Authentication Methods
  • JWT
  • Token
  • Email and Password
• Implementation
  • Data Type
  • AuthenticationFacade
  • AuthenticatedEntity Access

Authentication Methods

JWT

Publishers can authenticate with the WAYF cloud via the JWT contained in their customized widget JS file. The JWT is enough to authenticate and identify the publisher because part of the claims that are signed during token generation are the publisher's ID. Thus, when receiving a JWT in conjunction with a local ID, the system can decrypt the token to understand which publisher is making the request.

The JWT value is passed in the HTTP authorization header with a prefix of "Bearer". For example, serialized headers may look like:

"headers" : { "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ" }

The JWT value does not expire and must be changed via the publisher's Javascript widget.

Token

Tokens are static strings generated by the server for a specific party. The token may have an expiration date or may by indefinite. Currently, the token is generated as a UUID but the format of the value moving forward is not important.

Each publisher has a token generated for them on registration. This is their API key. When making requests directly to the server (outside of the widget) the publisher must pass their token in the authorization header with a prefix of "Token". For example, serialized headers may look like:

"headers" : { "Authorization": "Token ffffdfe4-a4e2-4abd-8f42-169f5bc14abd" }

A publisher's API token will not expire.

Administrative users may authenticate with the WAYF cloud using their email and password. Once the email and password have been authenticated, the cloud will return to the user a generated API token that expires from two hours after login.

Email and Password

Credentialed users may authenticate with the WAYF cloud via a username and password. All passwords are securely stored in the databse encrypted with BCrypt and user specific salt.

Currently, administrators are the only users with email and password credentials. Those are only used to procure an expiring API token from the WAYF cloud. Users may authenticate via the login endpoint:

POST - /1/user/credentials

{ 
    "email" : "[email protected]",
    "password" : "test"
}

Implementation

Data Types

Authenticatable

The com.atypon.wayf.data.authentication.Authenticatable interface is a marker interface used to identify which types are able to be authenticated.

AuthenticationCredentials

com.atypon.wayf.data.authentication.AuthenticationCredentials represents credentials that can be authenticated for an Authenticatable. Credentials will have implementation specific fields -- such as email/password or tokenValue -- but all credentials will be for a specific Authenticatable type. Credentials are useful for both ensuring a party can be trusted but also in resolving a requester to a known WAYF entity.

AuthenticatedEntity

com.atypon.wayf.data.authentication.AuthenticatedEntity is the end result of a successful authentication. Presently, an AuthenticatedEntity contains the credentials and the resolved Authenticatable entity. However, moving forward, roles and permissions associated with the authentication would be stored on this type.

AuthenticationFacade

The com.atypon.wayf.facadeAuthenticationFacade abstracts a lot of the lower level authentication logic from the rest of the WAYF cloud. The AuthenticationFacade is agnostic of the authentication type and authenticatable entities. The logic for each type of authentication is delegated down to implementation specific business code. The core AuthenticationFacade, however, does a lot of work in caching the authentication credentials and the parties they resolve to.

AuthenticatedEntity Access

The currently authenticated entity is stored in the ThreadLocal wrapper, RequestContext. This value can be accessed via RequestContextAccessor.get().getAuthenticated();. The result of this call will be an AuthenticatedEntity or null if no Authenticatable party is authenticated.

AuthenticatedEntity has two static methods for converting the currently authenticated party to a publisher or user: AuthenticatedEntity.authenticatedAsPublisher and AuthenticatedEntity.authenticatedAsAdmin. These methods will return the entity cast to the proper sub-type or it will throw an HTTP 401 exception.