Problem:

To accomplish the objective of enabling extensions to act on behalf of a user, we have devised a just-in-time (JIT) Token to manage incoming request authentication. This JIT Token will be transmitted to the extension and subsequently returned to the security plugin for privilege validation concerning both the user and the extension. Consequently, it is necessary to develop an authentication backend to efficiently handle these validation processes.

Design

Here is a graph of how user requests processed through the security-extension feature [graph1]:

If we zoom up to step 4. & 5 in [graph1] then we get [graph2] as following:

This graph shows that during the creation of the JIT Token, the user's roles will be encrypted (see: #2620 ) and combined with other claims. Subsequently, this JIT Token will be sent to the extension for further processing.

Once the extension sends back this token to security plugin, which is step 6 in [graph1] then we get [graph3] as following:

Once the security plugin receives the JIT Token back, it will be forwarded into the authentication backend. The following tasks will be initiated:

• Decrypt roles / backend_roles fields inside of the JIT Token
• Two validations will happen:
  • Validation of extensions privilege - Service Gate (1st gate and we process to the next gate after the validation)
    • Similar to user roles this field is called governing policies, and the major difference is that you cannot map those policies to users. We need to do is to compare these policies with the specific actions from the request.
    • If the Service Gate validation fails, it will directly abort the target action, and it will not process to the User Gate.
  • Validation of user privilege - User Gate (2nd gate)
    • Decrypt roles / backend_role
    • Validate the privileges by using the roles concepts (like current role concept)

Appendix

[WIP] I will put link this section to some of the issues with more concepts of roles.yml.