search

cosmos / cosmos-sdk

:chains: A Framework for Building High Value Public Blockchains :sparkles:
https://cosmos.network/
Apache License 2.0
6.23k stars 3.6k forks source link

Distinguish Authentication and Authorization #7615

Closed aaronc closed 2 days ago

aaronc commented 3 years ago

Summary

Problem Definition

We will have two modules with the abbreviation auth in their name but which deal with two slightly different concerns.

x/auth deals primarily with "authentication". From Oxford authentication is

the process or action of verifying the identity of a user or process.

x/msg_authorization deals with what an "authenticated" user is "authorized" to do. From Oxford authorization is

a document giving permission or authority

Which seems pretty consistent with what x/msg_authorization does.

Proposal

There is a fair amount of precedent for using authn and authz as abbreviations for authentication and authorization respectively, as well as for auth alone being confusing:

So how about x/auth becomes x/authn and x/msg_authorization becomes x/authz?

For Admin Use

alexanderbez commented 3 years ago

ACK

clevinson commented 3 years ago

👍

anilcse commented 3 years ago

ACK

fedekunze commented 3 years ago

I don't understand why are we introducing such a breaking change. Couldn't we just name the authz module authorization instead? This is clearer as the authn/z abbreviations could be read as auth-n auth-z by non native english speakers.

clevinson commented 3 years ago

I don't see an issue with reading as auth-n and auth-z. Is that really a problem? The important piece is to dimabiguate them from eachother.

We originally were just calling authz authorization, but having two modules (x/auth and x/authorization) is what was causing the initial confusion.

fedekunze commented 3 years ago

why don't we just rename authz to authorization? SDK devs are already familiar with the auth module and what it does... My take on this is that the breaking change is just not worth it

aaronc commented 3 years ago

why don't we just rename authz to authorization? SDK devs are already familiar with the auth module and what it does... My take on this is that the breaking change is just not worth it

One (possibly bad) reason not to do this is because it makes protobuf type URLs longer - cosmos.authz vs cosmos.authorization

We could also have auth and authz and just not do the rename of auth -> authn

fedekunze commented 3 years ago

We could also have auth and authz and just not do the rename of auth -> authn

I don't have a strong opinion on the authz renaming, but I'm strongly against the auth -> authn renaming because it's such a large breaking change for other applications

aaronc commented 3 years ago

@alexanderbez do you have any thoughts here? We moved forward because you ACK'ed but I would be fine keeping auth as is if there's strong opposition. @alessio ?

alessio commented 3 years ago

IMHO authn is a better name. I agree with @fedekunze though, I suspect the change wouldn't be very warmly welcomed by application developers. How about postponing the auth -> authn renaming to Cosmos SDK v1.0?

aaronc commented 3 years ago

IMHO authn is a better name. I agree with @fedekunze though, I suspect the change wouldn't be very warmly welcomed by application developers. How about postponing the auth -> authn renaming to Cosmos SDK v1.0?

Totally fine to postpone it

clevinson commented 3 years ago

Moving to icebox as this will ideally be addressed in the x /auth & x/bank refactor. Possibly with two modules in parallel (new & old auth / authz).

aaronc commented 3 years ago

A proposed API for a new authn module is in #9369.