Rafiki: Rafiki (RS) <> Auth Server (AS) Integration: Access control and signing requests

[matdehaast]

Summary

Rafiki's Open Payments APIs require GNAP grants and corresponding signature-bound access tokens for authentication and authorization.

Intended Outcomes

All requests are access controlled and signed. This includes the following requests

• client <> RS
• RS <> AS
• RS <> another RS

How will it work?

• Rafiki validates token + signature on client requests
• Rafiki self-provisions key(s)
• Rafiki (optionally) signs introspection requests with said key(s)
• Rafiki requests grants to access resources on other Rafiki instances (e.g. incoming payments)
• Rafiki signs requests to other Rafiki instances

Links

• Milestone
• https://github.com/interledger/rafiki/issues/585
• https://github.com/interledger/rafiki/issues/606
• https://github.com/interledger/rafiki/issues/576
• https://github.com/interledger/rafiki/issues/583
• https://github.com/interledger/rafiki/issues/587
• https://github.com/interledger/open-payments/issues/184