search

hwsc-org / hwsc-app-gateway-svc

Web application gateway management service
https://hwsc-org.github.io/hwsc-app-gateway-svc/
0 stars 0 forks source link

Epic/Authentication & Authorization #23

Closed faraonc closed 5 years ago

faraonc commented 5 years ago

Objective

The Chrome user has to be authenticated within hwsc cluster.

Purpose

For every single request within a cluster a token is passed for authorization.

Prerequisites

"eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJ1dWlkIjoiMTIzNDU2Nzg5MCIsInBlcm1pc3Npb24iOiJUb2tlbi5BRE1JTiIsImV4cGlyYXRpb25fdGltZSI6MTU0OTA5MzkxMH0.OZFQ_zU1F2BJm6kyYzsBns5qmOxbVbUnQV2SU1B_kyPfXPOmUd0fddRvF0I3IqaDz-55H7Q80w8zQyldMQ7AAg"

kimlisa commented 5 years ago

5. If the email and password are:

  • valid - then return the User without password + code.Ok - DISCONNECTED

8. In order to be AUTHORIZED, Chrome has to call GetToken from app-gateway-svc.

Why doesn't authenticateUser in user-svc also return the Token after valid credentials?

kimlisa commented 5 years ago

I guess I am not understanding why we need both authenticated and authorized states.

I also don't understand why we need to look up email and password twice, once for authentication, and again soon after just to get the token.

kimlisa commented 5 years ago
  • User password are encrypted twice, browser to app-gateway-svc and user-svc to DB

Are we now encrypting password? Not hashing? Because even with hashing in browser, if hacker gets access to the hash from the browser, they essentially have the password.

faraonc commented 5 years ago
  1. If the email and password are:
  • valid - then return the User without password + code.Ok - DISCONNECTED
  1. In order to be AUTHORIZED, Chrome has to call GetToken from app-gateway-svc.

Why doesn't authenticateUser in user-svc also return the Token after valid credentials?

Chrome dials to app-gateway-svc first using the following which I believe is not able to return a custom type such as a Token: (convert this to Typescript)

conn, err := grpc.DialContext(ctx, net.JoinHostPort(addr, port),
    grpc.WithTransportCredentials(credentials.NewClientTLSFromCert(insecure.CertPool, "")),
    grpc.WithPerRPCCredentials(basicAuth{
        username: username,
        password: password,
    }),
)
faraonc commented 5 years ago

I guess I am not understanding why we need both authenticated and authorized states.

I also don't understand why we need to look up email and password twice, once for authentication, and again soon after just to get the token.

Because app-gateway-svc does not know who is the client after dialing, so we need to authorize again just to get a token. This time we are not using a built-in GRPC function but our own implementations which can return a Token.

faraonc commented 5 years ago
  • User password are encrypted twice, browser to app-gateway-svc and user-svc to DB

Are we now encrypting password? Not hashing? Because even with hashing in browser, if hacker gets access to the hash from the browser, they essentially have the password.

We are using https://godoc.org/golang.org/x/crypto/bcrypt which I believe is a form of encryption. Your implementation is acceptable.

faraonc commented 5 years ago

I am changing the Token into

{
  "header": {"Alg": “HS256”,"Typ":  “JWT”}
  "payload": {"uuid": "1234567890", "permission": "ADMIN","expiration_time": 1549093910} 
  "signature" : "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJ1dWlkIjoiMTIzNDU2Nzg5MCIsInBlcm1pc3Npb24iOiJUb2tlbi5BRE1JTiIsImV4cGlyYXRpb25fdGltZSI6MTU0OTA5MzkxMH0.OZFQ_zU1F2BJm6kyYzsBns5qmOxbVbUnQV2SU1B_kyPfXPOmUd0fddRvF0I3IqaDz-55H7Q80w8zQyldMQ7AAg"
}
faraonc commented 5 years ago

I am changing the Token into

{
  "header": {"Alg": “HS256”,"Typ":  “JWT”}
  "payload": {"uuid": "1234567890", "permission": "ADMIN","expiration_time": 1549093910} 
  "signature" : "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJ1dWlkIjoiMTIzNDU2Nzg5MCIsInBlcm1pc3Npb24iOiJUb2tlbi5BRE1JTiIsImV4cGlyYXRpb25fdGltZSI6MTU0OTA5MzkxMH0.OZFQ_zU1F2BJm6kyYzsBns5qmOxbVbUnQV2SU1B_kyPfXPOmUd0fddRvF0I3IqaDz-55H7Q80w8zQyldMQ7AAg"
}

We decided not to do this

faraonc commented 5 years ago

Updated:

- `user-svc` has to provide `GetAuthToken`, `VerifyAuthToken`, `GetSecret`, `MakeNewSecret`
- `app-gateway-svc` has to implement `BasicAuth` and `TokenAuth`, and to provide `GetAuthToken`