Ticket #787 (closed task: fixed)

Opened 3 years ago

Last modified 3 years ago

Auth API

Reported by: thejimmyg Owned by: thejimmyg
Priority: major Milestone: ckan-sprint-2011-09-12
Component: dgu Keywords: dgu
Cc: Repository: ckan
Theme: none

Description

Auth Proposal

Use case: We'd like an authenticated and authorized Drupal user to be able to edit/delete packages using the API

To do this a user would need a CKAN API key so we need some way of Drupal telling CKAN who a user is so that they can get their API key.

Proposed Implementation


A user visits the CKAN API key page to get their key. Because CKAN is at catalogue.data.gov.uk (a subdomain of the Drupal site) it can read Drupal cookies.

If there is no DRXtrArgs or DRXtrArgs2 cookie, we know the user isn't signed in so we redirect them to Drupal to sign in.

WISHLIST: It would be really nice if we could pass the URL to redirect back to Drupal so tha Druapl can send them back to the CKAN API key page

Either way, they get back to CKAN and now the cookies exist. When the first HTTP request header is sent, CKAN will read the Drupal session ID and then call a Drupal API, server to server.

TODO: Implement an API on the drupal server which accepts a Drupal session ID as an argument and returns the username and credentials, but only if the request if from the CKAN server (perhaps we specify an API key in the request)

If the session is valid CKAN will set its own auth cookie and show them the page with the API key. CKAN only considers a user signed in if both the CKAN cookie *and* Drupal session ID are present. If at any time they sign out of Drupal the Drupal session disappears so they will be signed out of CKAN too.

Now the user has an API key they can use the standard CKAN command line API tools.

The API key is the only thing the user will need to use the CKAN API. This poses a problem. What if a user is removed from Drupal but still has a CKAN API key?

Two solutions:

  1. API keys will be set to only be valid for the length of a Drupal session so that a user will only be able to use the write API for a little time after credentials are revoked
  1. CKAN provides an API to allow Drupal to revoke keys

Option 1. seems easier to me. If we choose this we will write a get_api_key command line tool so that Drupal user can write things like this:

::

datapkg list_packages --api_key get_api_key

The get_api_key function will prompt for username and password and then perform the steps necessary to get an API key.

Change History

comment:1 Changed 3 years ago by pudo

Alternative:

  • The Drupal system will expose a resource at data.gov.uk/profile which wil contain the reqesting user's nickname, fullname, email etc. in JSON (or XML) form.
  • The Drupal system will also run an OAuth server (and provide /request_token, /access_token, /authorize).
  • CKAN's login form will be rewired to initiate a client OAuth request on the /profile resource.
  • Recognizing CKAN's callback URL at catalogue.data.gov.uk, Drupal will automatically grant the request if a user is signed in.
  • Upon return, a user is created, optionally using the OAuth access token as the users API key, thus making it known both to Drupal and CKAN.
  • The authorizer will be extended to check access to the /profile resource for OAuth accounts (slow but safe).

Advantages:

comment:2 Changed 3 years ago by johnbywater

  • sprint changed from 1.3.3 to 1.3.4

Moved from sprint 1.3.3

comment:3 Changed 3 years ago by thejimmyg

  • Priority set to major
  • Component set to dgu
  • Milestone changed from ckan-v1.3 to longterm

comment:4 Changed 3 years ago by thejimmyg

  • Repository set to ckan
  • Theme set to none
  • Milestone changed from longterm to ckan-v1.4-sprint-5

comment:5 Changed 3 years ago by thejimmyg

The AuthAPI now exists as an IMiddleware plugin, we really need the permission system moved into CKAN before it is useful though and this depends on a refactor of the Auth system. See #1094

comment:6 Changed 3 years ago by thejimmyg

  • Milestone changed from ckan-v1.4-sprint-5 to ckan-v1.4-sprint-6

comment:7 Changed 3 years ago by shevski

  • Milestone changed from ckan-v1.5 to ckan-current-sprint

comment:8 Changed 3 years ago by kindly

  • Keywords dgu added

comment:9 Changed 3 years ago by thejimmyg

  • Status changed from new to closed
  • Resolution set to fixed
  • Milestone changed from ckan-current-sprint to ckan-sprint-2011-09-12

The joint authentication was implemented a long time ago and is deployed on catalogue.data.gov.uk. We'll build the authorisation layer in ticket #1326 so marking this as fixed.

Note: See TracTickets for help on using tickets.