cablelabs / lpwanserver

LPWAN Provisioning & Management Server
https://lpwanserver.com
Apache License 2.0
37 stars 11 forks source link

Authentication on device message passing #311

Closed rhythnic closed 4 years ago

rhythnic commented 5 years ago

An uplink from a network is not authenticated.

The OpenAPI doc for v2 contains the design for authenticating uplinks, but it has not been implemented. It uses basic as the authentication scheme for the uplink endpoint, /api/uplinks/:applicationId. This is the /api/ingest/:applicationId/:networkId endpoint from v1.

For the basic authentication, the username should be the ID of the Network record, and the password is an apiKey generated by the system and stored in the securityData section of a Network record. The HTTP handler should identify the Network via the username property of the basic auth, and also ensure that the password, once hashed, matches the hashed password that's stored in the securityData object of the Network record.

If it's determined that not all networks support the use of headers in the integration, consider using the /api/uplinks/applicationId/:networkId with an apiKey query param.