User authentication

[jerkerdelsing]

How does it relate to

• JWT
• authentication via X.509 certificate
• work by PhD. student at LTU

[emanuelpalm]

Authentication via JWTs

A custom variant of JWTs are used by the authorization system when it issues tokens. As far as I know, the procedure for creating and deciphering the tokens are not specified in any document. I used the code of the Authorization (AUTH) system as a guide for my own token implementation in the Kalix library. According to my best knowledge, if a system is able to show off a valid token and has a certificate with the Arrowhead root (arrowhead.eu) certificate in its chain of issuers, it should be granted access to the service it tries to consume. If I remember correctly, tokens are created by AUTH in accordance to whatever rules it already has been configured with. The rules themselves are encoded into the actual tokens, which means that the tokens do not have to be verified against the AUTH system when validated by provider systems.

Tokens is the only way a system outside a cloud can be provided access to a service inside that cloud.

Authentication via x.509 Certificates

A previous discussion about authentication via x.509 certificates can be read here: eclipse-arrowhead/core-java-spring#198. In addition to that discussion, I can mention that some systems use a whitelisting mechanism in addition to checking that their consumers belong to the same cloud or have valid tokens. For example, if a service consumer can present a certificate with a LDAP Common Name starting with sysop and ending in the Common Name of the certificate of the current cloud (e.g. sysop.my-cloud.my-company.arrowhead.eu), it will be granted access to the management endpoints of the core-java-spring systems. Similar mechanisms are used by the service_registry, authorization and orchestrator systems to identify each other (the so-called internal endpoints use this mechanism).

Other Efforts
I'm not very familiar with other efforts at LTU.

[tsvetlin]

User authentication was previously discussed with BOSCH, and they offered the usage of Keycloack (https://www.keycloak.org/).