Revision 5547485e
b/Changelog | ||
---|---|---|
29 | 29 |
notifactions to users listed in 'ADMINS' setting about unhandled exceptions |
30 | 30 |
in the code. |
31 | 31 |
|
32 |
* Extend astakosclient to request and validate OAuth 2.0 access tokens |
|
33 |
|
|
32 | 34 |
Astakos |
33 | 35 |
------- |
34 | 36 |
|
... | ... | |
77 | 79 |
'ASTAKOS_ADMIN_STATS_PERMITTED_GROUPS' setting. Statistics are also availble |
78 | 80 |
from 'snf-manage stats-astakos' management command. |
79 | 81 |
|
82 |
* Implement OAuth 2.0 Authorization Code Grant |
|
83 |
Add API calls for authorization code and access token generation |
|
84 |
|
|
85 |
* Add API call for validating OAuth 2.0 access tokens |
|
86 |
|
|
80 | 87 |
* Management commands: |
81 | 88 |
* Introduced new commands: |
82 | 89 |
* component-show |
83 | 90 |
* quota-list (replacing quota, supports various filters) |
84 | 91 |
* quota-verify (replacing quota) |
92 |
* oauth2-client-add (register OAuth 2.0 client) |
|
93 |
* oauth2-client-list (list registered oauth 2.0 clients) |
|
94 |
* oauth2-client-remove (remove OAuth 2.0 client) |
|
85 | 95 |
* Changed commands: |
86 | 96 |
* component-add got options --base-url and --ui-url |
87 | 97 |
* resource-modify --limit became --default-quota |
... | ... | |
189 | 199 |
* Introduced new command: |
190 | 200 |
* file-show |
191 | 201 |
|
202 |
* Change view authentication |
|
203 |
The pithos views do not use the cookie information for user authentication. |
|
204 |
They request (from Astakos) and use a short-term access token for a |
|
205 |
specific resource. |
|
206 |
|
|
207 |
* Remove PITHOS_ASTAKOS_COOKIE_NAME setting, since it is no longer useful |
|
208 |
|
|
209 |
* Add PITHOS_OAUTH2_CLIENT_CREDENTIALS setting to authenticate the views with |
|
210 |
astakos during the resource access token generation procedure |
|
211 |
|
|
212 |
* Add PITHOS_SERVE_API_DOMAIN setting to restrict file serving endpoints to a |
|
213 |
specific host |
|
214 |
|
|
192 | 215 |
* Refactor metadata schema (table attributes) in Pithos DB to speedup current |
193 | 216 |
objects by domain attribute. This is used by Plankton for listing VM images. |
194 | 217 |
|
b/docs/admin-guide.rst | ||
---|---|---|
1504 | 1504 |
user-list List users |
1505 | 1505 |
user-modify Modify user |
1506 | 1506 |
user-show Show user details |
1507 |
oauth2-client-add Create an oauth2 client |
|
1508 |
oauth2-client-list List oauth2 clients |
|
1509 |
oauth2-client-remove Remove an oauth2 client along with its registered redirect urls |
|
1507 | 1510 |
============================ =========================== |
1508 | 1511 |
|
1509 | 1512 |
Pithos snf-manage commands |
b/docs/astakos-api-guide.rst | ||
---|---|---|
20 | 20 |
========================= ================================ |
21 | 21 |
Revision Description |
22 | 22 |
========================= ================================ |
23 |
0.15 (December 02, 2013) Extent token api with validate token call |
|
23 | 24 |
0.15 (October 29, 2013) Remove GET /authenticate in favor of POST /tokens |
24 | 25 |
0.14 (June 03, 2013) Remove endpoint listing |
25 | 26 |
0.14 (May 28, 2013) Extend token api with authenticate call |
... | ... | |
428 | 429 |
401 (Unauthorized) Invalid token or invalid creadentials or tenantName does not comply with the provided token |
429 | 430 |
500 (Internal Server Error) The request cannot be completed because of an internal error |
430 | 431 |
=========================== ===================== |
432 |
|
|
433 |
Validate token |
|
434 |
^^^^^^^^^^^^^^ |
|
435 |
|
|
436 |
This calls validates an access token and confirms that it belongs to a |
|
437 |
specified scope. |
|
438 |
|
|
439 |
========================================= ========= ================== |
|
440 |
Uri Method Description |
|
441 |
========================================= ========= ================== |
|
442 |
``/identity/v2.0/tokens/<token_id>`` GET Validates an access token and confirms that it belongs to a specified scope. |
|
443 |
========================================= ========= ================== |
|
444 |
|
|
445 |
| |
|
446 |
|
|
447 |
====================== ========================= |
|
448 |
Request Parameter Name Value |
|
449 |
====================== ========================= |
|
450 |
belongsTo Validates that a access token has the specified scope. |
|
451 |
The belongsTo parameter is optional. |
|
452 |
====================== ========================= |
|
453 |
|
|
454 |
|
|
455 |
Example response |
|
456 |
|
|
457 |
:: |
|
458 |
|
|
459 |
{"access": { |
|
460 |
"token": { |
|
461 |
"expires": "2013-12-02T15:57:34.300266+00:00", |
|
462 |
"id": "2YotnFZFEjr1zCsicMWpAA", |
|
463 |
"tenant": { |
|
464 |
"id": "c18088be-16b1-4263-8180-043c54e22903", |
|
465 |
"name": "Firstname Lastname" |
|
466 |
} |
|
467 |
}, |
|
468 |
"user": { |
|
469 |
"roles_links": [], |
|
470 |
"id": "c18088be-16b1-4263-8180-043c54e22903", |
|
471 |
"roles": [{"id": 1, "name": "default"}], |
|
472 |
"name": "Firstname Lastname"}}} |
|
473 |
| |
|
474 |
|
|
475 |
=========================== ===================== |
|
476 |
Return Code Description |
|
477 |
=========================== ===================== |
|
478 |
404 Unknown or expired access token or the access token does not belong to the specified scope |
|
479 |
=========================== ===================== |
/dev/null | ||
---|---|---|
1 |
Serve untrusted user content |
|
2 |
^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
|
3 |
|
|
4 |
We want to serve untrusted user content in a domain which does not have access |
|
5 |
to sensitive information. The information used by pithos view is set by astakos |
|
6 |
in the cookie after a successful user authentication login. Starting from |
|
7 |
synnefo version 0.15, the pithos view will be deployed in a domain outside the |
|
8 |
astakos cookie domain. The current document describes how the pithos view can |
|
9 |
grant access to the protected pithos resources. |
|
10 |
|
|
11 |
The proposed scheme follows the guidelines of the Oauth 2.0 authentication |
|
12 |
framework as described in http://tools.ietf.org/html/rfc6749/. |
|
13 |
|
|
14 |
Briefly the pithos view requests a short-term access token for a specific |
|
15 |
resource from astakos. Before requesting the access token, the view obtains |
|
16 |
an authorization grant (authorization code) from astakos, which is then |
|
17 |
presented by the view during the request for the access token. |
|
18 |
|
|
19 |
Pithos view registration to astakos |
|
20 |
=================================== |
|
21 |
The pithos view has to authenticate itself with astakos since the later has to |
|
22 |
prevent serving requests by unknown/unauthorized clients. |
|
23 |
|
|
24 |
Each oauth client is identified by a client identifier (client_id). Moreover, |
|
25 |
the confidential clients are authenticated via a password (client_secret). |
|
26 |
Then, each client has to declare at least a redirect URI so |
|
27 |
that astakos will be able to validate the redirect URI provided during the |
|
28 |
authorization code request. If a client is trusted (like a pithos view) astakos |
|
29 |
grants access on behalf of the resource owner, otherwise the resource owner has |
|
30 |
to be asked. |
|
31 |
|
|
32 |
We can register an oauth 2.0 client with the following command:: |
|
33 |
|
|
34 |
snf-manage oa2-client-add <client_id> --secret=<secret> --is-trusted --url <redirect_uri> |
|
35 |
|
|
36 |
For example:: |
|
37 |
|
|
38 |
snf-manage oa2-client-add pithos-view --secret=12345 --is-trusted --url https://pithos.synnefo.live/pithos/ui/view |
|
39 |
|
|
40 |
|
|
41 |
Configure view credentials in pithos |
|
42 |
==================================== |
|
43 |
|
|
44 |
To set the credentials issued to pithos view in order to authenticate itself |
|
45 |
with astakos during the resource access token generation procedure we have to |
|
46 |
change the ``PITHOS_OA2_CLIENT_CREDENTIALS`` setting. |
|
47 |
|
|
48 |
The value should be a (<client_id>, <client_secret>) tuple. |
|
49 |
|
|
50 |
For example:: |
|
51 |
|
|
52 |
PITHOS_OA2_CLIENT_CREDENTIALS = ('pithos-view', 12345) |
|
53 |
|
|
54 |
Authorization Code Grant Flow |
|
55 |
============================= |
|
56 |
The general flow includes the following steps: |
|
57 |
|
|
58 |
#. The user requests to view the content of the protected resource. |
|
59 |
#. The view requests an authorisation code from astakos by providing its |
|
60 |
identifier, the requested scope, and a redirection URI. |
|
61 |
#. Astakos authenticates the user and validates that the redirection URI |
|
62 |
matches with the registered redirect URIs of the view. |
|
63 |
As far as the pithos view is considered a trusted client, astakos grants the |
|
64 |
access request on behalf of the user. |
|
65 |
#. Astakos redirects the user-agent back to the view using the redirection URI |
|
66 |
provided earlier. The redirection URI includes an authorisation code. |
|
67 |
#. The view requests an access token from astakos by including the |
|
68 |
authorisation code in the request. The view also posts its client identifier |
|
69 |
and its client secret in order to authenticate itself with astakos. It also |
|
70 |
supplies the redirection URI used to obtain the authorisation code for |
|
71 |
verification. |
|
72 |
#. Astakos authenticates the view, validates the authorization code, |
|
73 |
and ensures that the redirection URI received matches the URI |
|
74 |
used to redirect the client. |
|
75 |
If valid, astakos responds back with an short-term access token. |
|
76 |
#. The view exchanges with astakos the access token for the information of the |
|
77 |
user to whom the authoritativeness was granted. |
|
78 |
#. The view responses with the resource contents if the user has access to the |
|
79 |
specific resource. |
|
80 |
|
|
81 |
|
|
82 |
Authorization code request |
|
83 |
========================== |
|
84 |
|
|
85 |
The view receives a request without either an access token or an authorization |
|
86 |
code. In that case it redirects to astakos's authorization endpoint by adding |
|
87 |
the following parameters to the query component using the |
|
88 |
"application/x-www-form-urlencoded" format: |
|
89 |
|
|
90 |
response_type: |
|
91 |
'code' |
|
92 |
client_id: |
|
93 |
'pithos-view' |
|
94 |
redirect_uri: |
|
95 |
the absolute path of the view request |
|
96 |
scope: |
|
97 |
the user specific part of the view request path |
|
98 |
|
|
99 |
For example, the client directs the user-agent to make the following HTTP |
|
100 |
request using TLS (with extra line breaks for display purposes only):: |
|
101 |
|
|
102 |
GET /astakos/oa2/auth?response_type=code&client_id=pithos-view |
|
103 |
&redirect_uri=https%3A//pithos.synnefo.live/pithos/ui/view/b0ee4760-9451-4b9a-85f0-605c48bebbdd/pithos/image.png |
|
104 |
&scope=/b0ee4760-9451-4b9a-85f0-605c48bebbdd/pithos/image.png HTTP/1.1 |
|
105 |
Host: accounts.synnefo.live |
|
106 |
|
|
107 |
Access token request |
|
108 |
==================== |
|
109 |
|
|
110 |
Astakos's authorization endpoint responses to a valid authorization code |
|
111 |
request by redirecting the user-agent back to the requested view |
|
112 |
(redirect_uri parameter). |
|
113 |
|
|
114 |
The view receives the request which includes the authorization code and |
|
115 |
makes a POST request to the astakos's token endpoint by sending the following |
|
116 |
parameters using the "application/x-www-form-urlencoded" format in the HTTP |
|
117 |
request entity-body: |
|
118 |
|
|
119 |
grant_type: |
|
120 |
"authorization_code" |
|
121 |
code: |
|
122 |
the authorization code received from the astakos. |
|
123 |
redirect_uri: |
|
124 |
the "redirect_uri" parameter was included in the authorization request |
|
125 |
|
|
126 |
Since the pithos view is registered as a confidential client it MUST |
|
127 |
authenticate with astakos by providing an Authorization header including the encoded client credentials as described |
|
128 |
http://tools.ietf.org/html/rfc2617#page-11. |
|
129 |
|
|
130 |
For example, the view makes the following HTTP request using TLS (with extra |
|
131 |
line breaks for display purposes only):: |
|
132 |
|
|
133 |
POST /astakos/oa2/token HTTP/1.1 |
|
134 |
Host: accounts.synnefo.live |
|
135 |
Authorization: Basic cGl0aG9zLXZpZXc6MTIzNDU= |
|
136 |
Content-Type: application/x-www-form-urlencoded |
|
137 |
|
|
138 |
grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA |
|
139 |
&redirect_uri=https%3A//pithos.synnefo.live/pithos/ui/view/b0ee4760-9451-4b9a-85f0-605c48bebbdd/pithos/image.png |
|
140 |
|
|
141 |
|
|
142 |
Access to the protected resource |
|
143 |
================================ |
|
144 |
|
|
145 |
Astakos's token endpoint replies to a valid token request with a (200 OK) |
|
146 |
response:: |
|
147 |
|
|
148 |
HTTP/1.1 200 OK |
|
149 |
Content-Type: application/json;charset=UTF-8 |
|
150 |
Cache-Control: no-store |
|
151 |
Pragma: no-cache |
|
152 |
|
|
153 |
{ |
|
154 |
"access_token":"2YotnFZFEjr1zCsicMWpAA", |
|
155 |
"token_type":"Bearer", |
|
156 |
"expires_in":20 |
|
157 |
} |
|
158 |
|
|
159 |
The view redirects the user-agent to itself by adding to the query component |
|
160 |
the access token. |
|
161 |
|
|
162 |
The view receives the request which includes an access token and requests |
|
163 |
from astakos to validate the token by making a GET HTTP request to the |
|
164 |
astakos's validation endpoint:: |
|
165 |
|
|
166 |
GET /astakos/identity/v2.0/tokens/2YotnFZFEjr1zCsicMWpAA?belongsTo=/b0ee4760-9451-4b9a-85f0-605c48bebbdd/pithos/image.png HTTP/1.1 |
|
167 |
Host: accounts.synnefo.live |
|
168 |
|
|
169 |
The astakos's validation endpoint checks whether the token is valid, has not |
|
170 |
expired and that the ``belongsTo`` parameter matches with the ``scope`` |
|
171 |
parameter that was included in the token request. |
|
172 |
If not valid returns a 404 NOT FOUND response. |
|
173 |
If valid, returns the information of the user to whom the token was assigned. |
|
174 |
|
|
175 |
In the former case the view redirects to the requested path |
|
176 |
(without the access token or the authorization code) in order to re-initiate |
|
177 |
the procedure by requesting an new authorization code. |
|
178 |
|
|
179 |
In the later case the view proceeds with the request and if the user has access |
|
180 |
to the requested resource the resource's data are returned, otherwise the |
|
181 |
access to resource is forbidden. |
|
182 |
|
|
183 |
Authorization code and access token invalidation |
|
184 |
================================================ |
|
185 |
|
|
186 |
Authorization codes can be used only once (they are deleted after a |
|
187 |
successful token creation) |
|
188 |
|
|
189 |
Token expiration can be set by changing the ``OA2_TOKEN_EXPIRES`` setting. |
|
190 |
By default it is set to 20 seconds. |
|
191 |
|
|
192 |
Tokens granted to a user are deleted after user logout or authentication token |
|
193 |
renewal. |
|
194 |
|
|
195 |
Expired tokens presented to the validation endpoint are also deleted. |
|
196 |
|
|
197 |
Authorization code and access token length |
|
198 |
========================================== |
|
199 |
|
|
200 |
Authorization code length is adjustable by the ``OA2_AUTHORIZATION_CODE_LENGTH`` |
|
201 |
setting. By default it is set to 60 characters. |
|
202 |
|
|
203 |
Token length is adjustable by the ``OA2_TOKEN_LENGTH`` setting. |
|
204 |
By default it is set to 30 characters. |
|
205 |
|
|
206 |
Restrict file serving endpoints to a specific host |
|
207 |
================================================== |
|
208 |
|
|
209 |
A new setting ``PITHOS_SERVE_API_DOMAIN`` has been introduced. When set, |
|
210 |
all api views that serve pithos file contents will be restricted to be served |
|
211 |
only under the domain specified in the setting value. |
|
212 |
|
|
213 |
If an invalid host is identified and request HTTP method is one |
|
214 |
of ``GET``, ``HOST``, the server will redirect using a clone of the request |
|
215 |
with host replaced to the one the restriction applies to. |
b/docs/design/pithos-view-authorization.rst | ||
---|---|---|
1 |
Serve untrusted user content |
|
2 |
^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
|
3 |
|
|
4 |
We want to serve untrusted user content in a domain which does not have access |
|
5 |
to sensitive information. The information used by pithos view is set by astakos |
|
6 |
in the cookie after a successful user authentication login. Starting from |
|
7 |
synnefo version 0.15, the pithos view will be deployed in a domain outside the |
|
8 |
astakos cookie domain. The current document describes how the pithos view can |
|
9 |
grant access to the protected pithos resources. |
|
10 |
|
|
11 |
The proposed scheme follows the guidelines of the OAuth 2.0 authentication |
|
12 |
framework as described in http://tools.ietf.org/html/rfc6749/. |
|
13 |
|
|
14 |
Briefly the pithos view requests a short-term access token for a specific |
|
15 |
resource from astakos. Before requesting the access token, the view obtains |
|
16 |
an authorization grant (authorization code) from astakos, which is then |
|
17 |
presented by the view during the request for the access token. |
|
18 |
|
|
19 |
Pithos view registration to astakos |
|
20 |
=================================== |
|
21 |
The pithos view has to authenticate itself with astakos since the later has to |
|
22 |
prevent serving requests by unknown/unauthorized clients. |
|
23 |
|
|
24 |
Each oauth client is identified by a client identifier (client_id). Moreover, |
|
25 |
the confidential clients are authenticated via a password (client_secret). |
|
26 |
Then, each client has to declare at least a redirect URI so |
|
27 |
that astakos will be able to validate the redirect URI provided during the |
|
28 |
authorization code request. If a client is trusted (like a pithos view) astakos |
|
29 |
grants access on behalf of the resource owner, otherwise the resource owner has |
|
30 |
to be asked. |
|
31 |
|
|
32 |
We can register an oauth 2.0 client with the following command:: |
|
33 |
|
|
34 |
snf-manage oauth2-client-add <client_id> --secret=<secret> --is-trusted --url <redirect_uri> |
|
35 |
|
|
36 |
For example:: |
|
37 |
|
|
38 |
snf-manage oauth2-client-add pithos-view --secret=12345 --is-trusted --url https://pithos.synnefo.live/pithos/ui/view |
|
39 |
|
|
40 |
|
|
41 |
Configure view credentials in pithos |
|
42 |
==================================== |
|
43 |
|
|
44 |
To set the credentials issued to pithos view in order to authenticate itself |
|
45 |
with astakos during the resource access token generation procedure we have to |
|
46 |
change the ``PITHOS_OAUTH2_CLIENT_CREDENTIALS`` setting. |
|
47 |
|
|
48 |
The value should be a (<client_id>, <client_secret>) tuple. |
|
49 |
|
|
50 |
For example:: |
|
51 |
|
|
52 |
PITHOS_OAUTH2_CLIENT_CREDENTIALS = ('pithos-view', 12345) |
|
53 |
|
|
54 |
Authorization Code Grant Flow |
|
55 |
============================= |
|
56 |
The general flow includes the following steps: |
|
57 |
|
|
58 |
#. The user requests to view the content of the protected resource. |
|
59 |
#. The view requests an authorisation code from astakos by providing its |
|
60 |
identifier, the requested scope, and a redirection URI. |
|
61 |
#. Astakos authenticates the user and validates that the redirection URI |
|
62 |
matches with the registered redirect URIs of the view. |
|
63 |
As far as the pithos view is considered a trusted client, astakos grants the |
|
64 |
access request on behalf of the user. |
|
65 |
#. Astakos redirects the user-agent back to the view using the redirection URI |
|
66 |
provided earlier. The redirection URI includes an authorisation code. |
|
67 |
#. The view requests an access token from astakos by including the |
|
68 |
authorisation code in the request. The view also posts its client identifier |
|
69 |
and its client secret in order to authenticate itself with astakos. It also |
|
70 |
supplies the redirection URI used to obtain the authorisation code for |
|
71 |
verification. |
|
72 |
#. Astakos authenticates the view, validates the authorization code, |
|
73 |
and ensures that the redirection URI received matches the URI |
|
74 |
used to redirect the client. |
|
75 |
If valid, astakos responds back with an short-term access token. |
|
76 |
#. The view exchanges with astakos the access token for the information of the |
|
77 |
user to whom the authoritativeness was granted. |
|
78 |
#. The view responses with the resource contents if the user has access to the |
|
79 |
specific resource. |
|
80 |
|
|
81 |
|
|
82 |
Authorization code request |
|
83 |
========================== |
|
84 |
|
|
85 |
The view receives a request without either an access token or an authorization |
|
86 |
code. In that case it redirects to astakos's authorization endpoint by adding |
|
87 |
the following parameters to the query component using the |
|
88 |
"application/x-www-form-urlencoded" format: |
|
89 |
|
|
90 |
response_type: |
|
91 |
'code' |
|
92 |
client_id: |
|
93 |
'pithos-view' |
|
94 |
redirect_uri: |
|
95 |
the absolute path of the view request |
|
96 |
scope: |
|
97 |
the user specific part of the view request path |
|
98 |
|
|
99 |
For example, the client directs the user-agent to make the following HTTP |
|
100 |
request using TLS (with extra line breaks for display purposes only):: |
|
101 |
|
|
102 |
GET /astakos/oauth2/auth?response_type=code&client_id=pithos-view |
|
103 |
&redirect_uri=https%3A//pithos.synnefo.live/pithos/ui/view/b0ee4760-9451-4b9a-85f0-605c48bebbdd/pithos/image.png |
|
104 |
&scope=/b0ee4760-9451-4b9a-85f0-605c48bebbdd/pithos/image.png HTTP/1.1 |
|
105 |
Host: accounts.synnefo.live |
|
106 |
|
|
107 |
Access token request |
|
108 |
==================== |
|
109 |
|
|
110 |
Astakos's authorization endpoint responses to a valid authorization code |
|
111 |
request by redirecting the user-agent back to the requested view |
|
112 |
(redirect_uri parameter). |
|
113 |
|
|
114 |
The view receives the request which includes the authorization code and |
|
115 |
makes a POST request to the astakos's token endpoint by sending the following |
|
116 |
parameters using the "application/x-www-form-urlencoded" format in the HTTP |
|
117 |
request entity-body: |
|
118 |
|
|
119 |
grant_type: |
|
120 |
"authorization_code" |
|
121 |
code: |
|
122 |
the authorization code received from the astakos. |
|
123 |
redirect_uri: |
|
124 |
the "redirect_uri" parameter was included in the authorization request |
|
125 |
|
|
126 |
Since the pithos view is registered as a confidential client it MUST |
|
127 |
authenticate with astakos by providing an Authorization header including the |
|
128 |
encoded client credentials as described in |
|
129 |
http://tools.ietf.org/html/rfc2617#page-11. |
|
130 |
|
|
131 |
For example, the view makes the following HTTP request using TLS (with extra |
|
132 |
line breaks for display purposes only):: |
|
133 |
|
|
134 |
POST /astakos/oauth2/token HTTP/1.1 |
|
135 |
Host: accounts.synnefo.live |
|
136 |
Authorization: Basic cGl0aG9zLXZpZXc6MTIzNDU= |
|
137 |
Content-Type: application/x-www-form-urlencoded |
|
138 |
|
|
139 |
grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA |
|
140 |
&redirect_uri=https%3A//pithos.synnefo.live/pithos/ui/view/b0ee4760-9451-4b9a-85f0-605c48bebbdd/pithos/image.png |
|
141 |
|
|
142 |
|
|
143 |
Access to the protected resource |
|
144 |
================================ |
|
145 |
|
|
146 |
Astakos's token endpoint replies to a valid token request with a (200 OK) |
|
147 |
response:: |
|
148 |
|
|
149 |
HTTP/1.1 200 OK |
|
150 |
Content-Type: application/json;charset=UTF-8 |
|
151 |
Cache-Control: no-store |
|
152 |
Pragma: no-cache |
|
153 |
|
|
154 |
{ |
|
155 |
"access_token":"2YotnFZFEjr1zCsicMWpAA", |
|
156 |
"token_type":"Bearer", |
|
157 |
"expires_in":20 |
|
158 |
} |
|
159 |
|
|
160 |
The view redirects the user-agent to itself by adding to the query component |
|
161 |
the access token. |
|
162 |
|
|
163 |
The view receives the request which includes an access token and requests |
|
164 |
from astakos to validate the token by making a GET HTTP request to the |
|
165 |
astakos's validation endpoint:: |
|
166 |
|
|
167 |
GET /astakos/identity/v2.0/tokens/2YotnFZFEjr1zCsicMWpAA?belongsTo=/b0ee4760-9451-4b9a-85f0-605c48bebbdd/pithos/image.png HTTP/1.1 |
|
168 |
Host: accounts.synnefo.live |
|
169 |
|
|
170 |
The astakos's validation endpoint checks whether the token is valid, has not |
|
171 |
expired and that the ``belongsTo`` parameter matches with the ``scope`` |
|
172 |
parameter that was included in the token request. |
|
173 |
If not valid returns a 404 NOT FOUND response. |
|
174 |
If valid, returns the information of the user to whom the token was assigned. |
|
175 |
|
|
176 |
In the former case the view redirects to the requested path |
|
177 |
(without the access token or the authorization code) in order to re-initiate |
|
178 |
the procedure by requesting an new authorization code. |
|
179 |
|
|
180 |
In the later case the view proceeds with the request and if the user has access |
|
181 |
to the requested resource the resource's data are returned, otherwise the |
|
182 |
access to resource is forbidden. |
|
183 |
|
|
184 |
Authorization code and access token invalidation |
|
185 |
================================================ |
|
186 |
|
|
187 |
Authorization codes can be used only once (they are deleted after a |
|
188 |
successful token creation) |
|
189 |
|
|
190 |
Token expiration can be set by changing the ``OAUTH2_TOKEN_EXPIRES`` setting. |
|
191 |
By default it is set to 20 seconds. |
|
192 |
|
|
193 |
Tokens granted to a user are deleted after user logout or authentication token |
|
194 |
renewal. |
|
195 |
|
|
196 |
Expired tokens presented to the validation endpoint are also deleted. |
|
197 |
|
|
198 |
Authorization code and access token length |
|
199 |
========================================== |
|
200 |
|
|
201 |
Authorization code length is adjustable by the |
|
202 |
``OAUTH2_AUTHORIZATION_CODE_LENGTH`` setting. By default it is set to |
|
203 |
60 characters. |
|
204 |
|
|
205 |
Token length is adjustable by the ``OAUTH2_TOKEN_LENGTH`` setting. |
|
206 |
By default it is set to 30 characters. |
|
207 |
|
|
208 |
Restrict file serving endpoints to a specific host |
|
209 |
================================================== |
|
210 |
|
|
211 |
A new setting ``PITHOS_SERVE_API_DOMAIN`` has been introduced. When set, |
|
212 |
all api views that serve pithos file contents will be restricted to be served |
|
213 |
only under the domain specified in the setting value. |
|
214 |
|
|
215 |
If an invalid host is identified and request HTTP method is one |
|
216 |
of ``GET``, ``HOST``, the server will redirect using a clone of the request |
|
217 |
with host replaced to the one the restriction applies to. |
b/docs/index.rst | ||
---|---|---|
137 | 137 |
|
138 | 138 |
Resource-pool projects design <design/resource-pool-projects> |
139 | 139 |
Resource defaults design <design/resource-defaults> |
140 |
Pithos view authentication <design/pithos-view-authentication.rst>
|
|
140 |
Pithos view authorization <design/pithos-view-authorization.rst>
|
|
141 | 141 |
|
142 | 142 |
|
143 | 143 |
Contact |
b/docs/quick-install-admin-guide.rst | ||
---|---|---|
918 | 918 |
|
919 | 919 |
# snf-manage resource-modify --default-quota-interactive |
920 | 920 |
|
921 |
.. _pithos_view_registration: |
|
922 |
|
|
923 |
Register pithos view as an OAuth 2.0 client |
|
924 |
------------------------------------------- |
|
925 |
|
|
926 |
Starting from synnefo version 0.15, the pithos view, in order to get access to |
|
927 |
the data of a protect pithos resource, has to be granted authorization for the |
|
928 |
specific resource by astakos. |
|
929 |
|
|
930 |
During the authorization grant procedure, it has to authenticate itself with |
|
931 |
astakos since the later has to prevent serving requests by unknown/unauthorized |
|
932 |
clients. |
|
933 |
|
|
934 |
To register the pithos view as an OAuth 2.0 client in astakos, we have to run |
|
935 |
the following command:: |
|
936 |
|
|
937 |
snf-manage oauth2-client-add pithos-view --secret=<secret> --is-trusted --url https://node2.example.com/pithos/ui/view |
|
921 | 938 |
|
922 | 939 |
Servers Initialization |
923 | 940 |
---------------------- |
... | ... | |
1075 | 1092 |
Pithos web client to get from astakos all the information needed to fill its |
1076 | 1093 |
own cloudbar. So we put our astakos deployment urls there. |
1077 | 1094 |
|
1095 |
The ``PITHOS_OAUTH2_CLIENT_CREDENTIALS`` setting is used by the pithos view |
|
1096 |
in order to authenticate itself with astakos during the authorization grant |
|
1097 |
procedure and it should container the credentials issued for the pithos view |
|
1098 |
in `the pithos view registration step`__. |
|
1099 |
|
|
1100 |
__ pithos_view_registration_ |
|
1101 |
|
|
1078 | 1102 |
Pooling and Greenlets |
1079 | 1103 |
--------------------- |
1080 | 1104 |
|
b/docs/upgrade/upgrade-0.15.rst | ||
---|---|---|
143 | 143 |
|
144 | 144 |
pithos-host$ pithos-migrate upgrade head |
145 | 145 |
|
146 |
2.3 Update configuration files |
|
146 |
.. _pithos_view_registration: |
|
147 |
|
|
148 |
2.3 Register pithos view as an oauth 2.0 client in astakos |
|
149 |
---------------------------------------------------------- |
|
150 |
|
|
151 |
Starting from synnefo version 0.15, the pithos view, in order to get access to |
|
152 |
the data of a protect pithos resource, has to be granted authorization for the |
|
153 |
specific resource by astakos. |
|
154 |
|
|
155 |
During the authorization grant procedure, it has to authenticate itself with |
|
156 |
astakos since the later has to prevent serving requests by unknown/unauthorized |
|
157 |
clients. |
|
158 |
|
|
159 |
To register the pithos view as an OAuth 2.0 client in astakos, use the |
|
160 |
following command:: |
|
161 |
|
|
162 |
snf-manage oauth2-client-add pithos-view --secret=<secret> --is-trusted --url https://pithos.synnefo.live/pithos/ui/view |
|
163 |
|
|
164 |
2.4 Update configuration files |
|
147 | 165 |
------------------------------ |
148 | 166 |
|
149 | 167 |
The ``ASTAKOS_BASE_URL`` setting has been replaced (both in Cyclades and |
... | ... | |
240 | 258 |
setting (used to decrypt the instance hostname) in |
241 | 259 |
``20-snf-stats-settings.conf`` on your Stats host. |
242 | 260 |
|
261 |
In addition to this, we have to change the ``PITHOS_OAUTH2_CLIENT_CREDENTIALS`` |
|
262 |
setting in the ``20-snf-pithos-app-settings.conf`` file to set the credentials |
|
263 |
issued for the pithos view in `the previous step`__. |
|
264 |
|
|
265 |
__ pithos_view_registration_ |
|
266 |
|
|
243 | 267 |
3. Create floating IP pools |
244 | 268 |
=========================== |
245 | 269 |
|
b/snf-astakos-app/astakos/oa2/management/commands/oauth2-client-add.py | ||
---|---|---|
43 | 43 |
|
44 | 44 |
class Command(SynnefoCommand): |
45 | 45 |
args = "<identfier>" |
46 |
help = "Create a oauth2 client" |
|
46 |
help = "Create an oauth2 client"
|
|
47 | 47 |
|
48 | 48 |
option_list = SynnefoCommand.option_list + ( |
49 | 49 |
make_option('--secret', |
Also available in: Unified diff