Synnefo

The current document describes how the pithos view accesses the protected

pithos resources and proposes a new design for granting access to

the specific resources. It sketches implementation details and configuration

concerns.

Current state and shortcomings

==============================

Pithos in order to identify the user who requests to view a pithos resource

uses the information stored by astakos in the cookie after a successful user

authentication login.

The main drawback of this design is that the pithos view which serves untrusted

user content has access to the sensitive information stored in the cookie.

Abstract

========

to sensitive information. Therefore, we would like the pithos view to be

deployed in a domain outside the astakos cookie domain.

We propose a design for the pithos view to grant access to the

access-restricted resource without consulting the cookie.

Briefly the pithos view will request a short-term access token for a specific

resource from astakos. Before requesting the access token, the view should

obtain an authorization grant (authorization code) from astakos, which will be

presented by the view during the request for the access token.

Proposed changes

================

We propose to alter the view to obtain authorization according to the

authorization code grant flow.

The general flow includes the following steps:

#. The user requests to view the content of the protected resource.

#. The view requests an authorisation code from astakos by providing its

   identifier, the requested scope, and a redirection URI.

#. Astakos authenticates the user and validates that the redirection URI

   matches with the registered redirect URIs of the view.

   As far as the pithos view is considered a trusted client, astakos grants the

   access request on behalf of the user.

#. Astakos redirects the user-agent back to the view using the redirection URI

   provided earlier. The redirection URI includes an authorisation code.

#. The view requests an access token from astakos by including the

   authorisation code in the request. The view also posts its client identifier

   and its client secret in order to authenticate itself with astakos. It also

   supplies the redirection URI used to obtain the authorisation code for

   verification.

#. Astakos authenticates the view, validates the authorization code,

   and ensures that the redirection URI received matches the URI

   used to redirect the client.

   If valid, astakos responds back with an short-term access token.

#. The view exchanges with astakos the access token for the information of the

   user to whom the authoritativeness was granted.

#. The view responds with the resource contents if the user has access to the

   specific resource.

Implementation details

======================

-----------------------------------

------------------------------------

--------------------------

--------------------

--------------------------------

------------------------------------------------

------------------------------------------

--------------------------------------------------