chmreid
commented
4 years ago Some notes, to update this ticket:
- security and auth machinery currently lives in
dss/util/security.py, this will probably stay the same or move todss/util/auth.pyor something similar - API endpoint functions will have their decorators changed slightly - the security decorator will take arbitrary arguments (what arguments, and what values, will depend entirely on the auth mechanism being used)
- the security flow (determining whether a given user is allowed to access a given endpoint) will be abstracted into an auth class; there will be a base class and a set of derived classes, one for each type of auth (example: one class for using Fusillade auth mechanism; one class for using a weak identity-based AuthZ mechanism like group membership; one class for using a CRUD-based Auth0 mechanism; etc.)
For our next steps:
- in order to interface with Auth0 and get an MVP for the Elm milestone, we will focus on implementing a CRUD-based Auth0 mechanism (each API endpoint function will be decorated with a security check that specifies whether the API endpoint is C, R, U, or D, and calls appropriate functions to do AuthN/AuthZ/FLAC as needed)
- we are adding Fusillade auth classes because the code has already been written, but we will not be testing the Fusillade auth classes or running a Fusillade service
@amarjandu has opened #103, which implements the above-mentioned auth base class and has added appropriate decorators to several API endpoints.
As an administrator I would like to use Auth0 to authenticate users based on Google accounts.
When this is complete users should be able to log in using their Google account and use the CLI and DSS
Need direct Auth0 (bypass Fusillade)
This is prep for fine level access control (Epic to come!)