openid / sharedsignals

OpenID Shared Signals Working Group Repository
47 stars 12 forks source link

Stream create/update for the PUSH method to allow defining token for the receivers endpoint #75

Closed appsdesh closed 1 year ago

appsdesh commented 1 year ago

Stream create/update configuration requests to allow passing token used for the authentication of the receivers API where transmitter will push the events

Create Stream example with the token as input

POST /ssf/stream HTTP/1.1
Host: transmitter.example.com
Authorization: Bearer eyJ0b2tlbiI6ImV4YW1wbGUifQo=

{
  "delivery": {
    "method": "urn:ietf:rfc:8935",
    "url": "https://receiver.example.com/events",
    "token": "Bearer 038597ojsxas9ucisdmlsudc9sj"
  },
  "events_requested": [
    "urn:example:secevent:events:type_2",
    "urn:example:secevent:events:type_3",
    "urn:example:secevent:events:type_4"
  ]
}
independentid commented 1 year ago

+1. This relates to the question I had yesterday on the call about how to register a push stream at the publisher.  Without this enhancement the publishing server (the http client) has to register with the push receiver (the http protocol server) to obtain a token. The inverse is true for polling where the http roles are reversed as compared to push delivery. Phil

FragLegs commented 1 year ago

This is already covered in the spec. The push delivery method has an authorization_header claim where you would add this info:

POST /ssf/stream HTTP/1.1
Host: transmitter.example.com
Authorization: Bearer eyJ0b2tlbiI6ImV4YW1wbGUifQo=

{
  "delivery": {
    "method": "urn:ietf:rfc:8935",
    "url": "https://receiver.example.com/events",
    "authorization_header": "Bearer 038597ojsxas9ucisdmlsudc9sj"
  },
  "events_requested": [
    "urn:example:secevent:events:type_2",
    "urn:example:secevent:events:type_3",
    "urn:example:secevent:events:type_4"
  ]
}

I'm going to close this issue. Feel free to re-open if authorization_header doesn't solve the problem you are facing.