Milestone 2.4: Security Support

[gsvarovsky]

We will develop examples and tests to show integration with identity providers, with preference given to standards-based authentication protocols such as those compliant with SASL1. We will show how user identity can be bound to data operations, with cryptographic strength.

• Enhanced vanilla Javascript app with user login and logging of signed operations
• Enhanced React.js demonstration app with user login and logging of signed operations
• Additional documentation for security support

outcome

The analysis phase of this milestone took more effort than expected. This was largely due to the importance of showing (or at least showing how) all the 'axes' of access control (as described in the spec write-up below) could be achieved in a demo app with very few lines of code. The result is relatively simple and explicable; but you can see from the mindmap below how many options were considered.

The following pull requests are to be considered part of this milestone:

• Bearer authentication for socket.io m-ld-gateway#19
  Note that this includes documentation that can be viewed online at:
  • https://gw.m-ld.org/accounts (section: remotes authentication options)
  • https://gw.m-ld.org/signed-updates (whole page)
• Use KeyCloak for application login m-ld-todomvc-vanillajs#4
• Security milestone write-up #8
  The new 'security' page can be more easily viewed here

As with previous milestones, the modifications have been made to the Vanilla JS demo, and will be ported to the React demo once they have been brought to a common structure.

mindmap