Accounts & Authentication

[enketo-issue-mover]

From @kkrumlian on April 28, 2017 18:19

As we work on OC4 we are looking to do some changes to the current account & authentication workflows.

Current state of affairs

• OC creates an enketo account for a specific protocol by calling this endpoint:

  endpoint: /account (POST)
  description: /account endpoint adds a new account if it does not already exist, and returns the new or existing account.
  body:
  {"server_url":"http://host/STUDY_OID", "api_key":"1234"}

• OC calls /survey it passes the api_key=1234 & {server_url=value&form_id=CRF_OID}. Enketo returns a unique form URL associated with account(api_key=1234)
• A user then loads the form, enketo makes /formList, /DownloadMetadata, etc. calls to the server_url associated with account(api_key=1234)
• In the current model OC needs to manage api_keys

  New Workflow

• Adjust /survey calls to consume the following

  PARAM:  {server_url=value&form_id=CRF_OID&protocol_id=S_OID}
  HEADER: key=AUTHORIZATON , value="Bearer JWT token"

• if an account exists with the above server_url then use that account
• else create a new account for this server_url.

Copied from original issue: kobotoolbox/enketo-express#733

[enketo-issue-mover]

From @MartijnR on April 28, 2017 19:38

Two questions:

• algorithm to use to determine whether request is authenticated
• does old account manager with old api_key auth need to remain functional (during a transition period)?