Access to SPIN API through mud-supervisor RBAC

[audricschiltknecht]

What we want to do

Allow access to SPIN API (web_ui? MQTT?) to registered/enabled users in mud-supervisor

How authentication/authorization is done in mud-supervisor

Validation of a client TLS certificate and check of DB attributes.

[audricschiltknecht]

Might be a lead: https://github.com/tai/mod-auth-ticket-for-lighttpd

[audricschiltknecht]

Possible solutions

• mud-supervisor acts as a MQTT/Web proxy
• implement some sort of 2 steps process (cookie/jwt/other): client goes to mud-supervisor's API, request a proof of its credentials, use it when communicating with SPIN.

Note that MQTT can be encapsulated in Websocket

Technical solutions

lighttpd

Supports websocket proxy since 1.4.46 (1.4.50 on turris). Does not seem to support any kind of JWT validation, so limited to cert validation.

nginx

Have nginx proxy the SPIN web_ui/MQTT stream. Validate credentials using JWT (we could simply check for client certs in a first step). Cons: need to replace lighttpd with nginx, or have nginx listening on a non-standard port (but then we have 2 webservers installed, a bit of a waste...)

MQTT auth plugin

MQTT allows writing of plugins. Use https://github.com/iegomez/mosquitto-go-auth Has a JWT backend. Cons: Written in Go. Not sure we can compile it and have it run on turris/musl

[audricschiltknecht]

First version done in "jwt" branch. Principle is to use JWT and secure only the web API for now. We are using JWT: a new API has been created in mud-supervisor that will issue a JWT. This token is be passed along with the request to access the spin web interface. Then a lua script is called by lightppd that will validate that the JWT is valid and will allow/deny access to the API. Currently, the secret is hardcoded to 1234. Need to export it (eg. generated during first boot?), then accessed by the other applications.

[mcr]

Audric Schiltknecht notifications@github.com wrote:

First version done in "jwt" branch. Principle is to use JWT and secure only the web API for now. We are using JWT: a new API has been created in mud-supervisor that will issue a JWT.

Perfect use of technology!