Re: using JWT with roundup

Hi all:

I have added a bit more support for this.

determine_user() in client.py validates the jwt and applying the roles
defined in the jwt to the current roundup connection. So you can now
authenticate to roundup with a jwt.

Test code is in place and passing (for both py2 and py3 with anydbm
and sqlite databases) for:

  detecting expired jwt

  using a jwt for a user with their normal role

  using a jwt for a user with a special role

  disabling support for jwt is disabled by setting the new
     WEB_JWT_SECRET config parameter to a value less than 32 bits long

The current config code disables support for jwts by creating a short
key (the string "disabled").

I have enhanced my POC rest endpoints with some additional
requirements (e.g. a jwt can't be used to create new jwt). If a user
has the role: User, they can create a jwt with a new role that is
prefixed with the role e.g. role User:email or user:timelog.

This are still rough edges:

   there is no support for blacklisting a jwt, but invalidating all jwts
      can be done by changing the WEB_JWT_SECRET

   issued jwts are not recorded anywhere

   there is no gui interface for generating or managing jwts

   only the rest endpoint can generate/validate a jwt and the admin
       would have add the code to do that to their tracker

   this needs to be better documented. Probably in rest.doc.

Is anybody else interested in this work and the workflows it opens up?
Does anybody have an opinion on adding this to the codebase?

-- rouilj

In message <[email protected]>,
"John P. Rouillard" writes:
>With the addition of the rest interface, there are a few new use cases
>that have come up. This includes allowing users to only add timelogs
>to issues without being able to add notes or change other settings.
>
>Right now this has to be done on a per user basis as Roles (and thus
>permissions) are tied to a specific user.
>
>In my limited understanding, it seems that a javascript web token
>(jwt) would be the way to allow this over the rest interface by
>redefining the Roles/permissions for an existing user on a per
>connection basis.
>
>This could allow a third party service to interact with roundup on
>behalf of a registered user and access a limited set of functions.
>
>[...]

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.


_______________________________________________
Roundup-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/roundup-devel