Closed m4v15 closed 7 years ago
I've picked this up. Have refactored a fair bit.
Instructions on how to see what I've done: TODO (message me in the meantime)
I've been working with the following 3 links open: http://oauth2-server.readthedocs.io/en/latest/api/oauth2-server.html#oauth2server-token https://tech.zilverline.com/2017/03/17/nodejs-oauth2-provider https://github.com/slavab89/oauth2-server-example-mongodb
user - user of the platform, a person, or 'resource owner' client- an app, owned by a user
authorization code
to the client, specific to the useraccess token
from the platform for the specific userGET /oauth/authorize
client_id
, redirect_uri
POST /oauth/authorize
POST /oauth/authorize
Authentication: bearer {token}
header, to assure the grant for access has come from the actual userclient_id=...
, redirect_uri=...
, response_type=code
, state=<randomstring>
redirect_uri
including a url param code=<authorization_code>
POST /oauth/token
Content-Type: application/x-www-form-urlencoded
headerclient_id
, client_secret
, code=<authorization_code>
, grant_type=authorization_code
TODO:
required views/endpoints:
login
for usersmy apps
page for usersadd app
page/route for usersauthorize
view for each specific app presented to usersmore specifically, required endpoints:
POST /oauth/clients
: requires user authentication, create new client, provide redirect_uri, generate secretOkay I have done some reading, and want to try and drop in a top level description of how this should all fit together.
In terms of authentication of requests made to the OTP API. A request can be authenticated in one of two ways.
Now, we number 2 basically set up. Creating the authentication token for part 1 is the (very) difficult part.
The module we are using will provide 3 methods, once we have configured it to properly interface with the database.
So there is a kinda hidden step in here, that is not immediately obvious from looking at those three functions, but might be the missing piece in terms of understanding. Here is I think a key point https://github.com/oauthjs/node-oauth2-server/issues/264#issuecomment-193209294!
Basically, there are two steps in the granting of the authorisation code
The second step here utilises the authorise function, with a custom authorisationFunction. There is another way to do this, but I do not understand it and it seems like passing a custom authorisationFunction makes more sense.
Here is an example: https://github.com/ubilogix/koa2-oauth-server/blob/master/examples/index.js#L273 with login redirecting back to grant page https://github.com/ubilogix/koa2-oauth-server/blob/master/examples/index.js#L226
I see the best way forward being
@des-des
Here is I think a key point https://github.com/oauthjs/node-oauth2-server/issues/264#issuecomment-193209294!
thanks, this was useful, flagging up similar things which were causing me problems, I think the module is just designed right now in a non-standard way.
I think we are on the same page now, more or less.
Next steps in my opinion:
/authorize
route, as described here@mattlub yup you are correct! But I see those things coming between point 3 and 4 above.
Ie now we know what we are doing, we need to find a way of moving stuff into master without merging everything together into one giant pull..
@des-des yeh sorry, I hadn't seen your 'next steps' section when I wrote my comment. I'm good to start on your steps 1 and 2 tomorrow.
@mattlub
Clients will not authenticate.
A user can do 2 things:
Ie a super user might both these things, both allow another app to act on their behalf, but also create their own app (think github).
Not sure I am quite following you, but there will be 2 different ways to authenticate.
authorisation=bearer {oauthToken}
I do not think we need to store jwts right now, we can give them a 1h expiry time, and not store them on the server.
Lets chat about anything that does make sense tomorrow morning (sorry maybe kinda rambling)
@mattlub is this ready for me to look at again?
I think yes (from his gitter message) the only thing I questioned was adding the API mongoose models to their own folder and we weren't sure where the best place to put Authmodel.js
cos it's not a mongoose model, but in the src folder seems a bit weird.
@des-des yes has been for 2 days!
ready for review.
@mattlub comments:
OLD comments:
DO NOT MERGE Not going to be ready for a while just trying out a few things
relates #93 #27
UPDATE from @mattlub: I've done a fair bit of work on this, see my comments below