Authentication And Authorization

introduction the authentication and authorization (aaa) service provides apis that allow you to create users, authenticate their identity, and validate their access permissions to app and platform resources functions provided by the aaa service the aaa service facilitates the following actions authentication and authorization /#user onboarding authentication and authorization /#manage user groups authentication and authorization /#user authentication methods authentication and authorization /#resources permissions and roles authentication and authorization /#permissions authentication and authorization /#roles authentication and authorization /#access token and authorization process limits limits please note that aaa api requests that exceed the 375kb size limit will be rejected avoid passing large payloads to prevent exceeding this limit user onboarding a platform user is an entity created in aaa service that represents a person who interacts with platform apps and the os1 platform onboarding a user in another service, for example, the participant service, does not automatically onboard the user to the aaa service the user must be specifically onboarded to the aaa service for using its service functionality creating a user to create a new user call the create user docid\ sgvk7ps00ptaervkvqn1u endpoint note for creating a user, firstname with any one of the email or a primarymobile number are required if providing a primarymobile number then countrycode & number are mandatory fields member description validation data type email the email address of the user pattern ^(\[a za z0 9 \\ \\+ ]+)@(\[\da za z0 9 \\ ]+)\\ (\[a za z\\ ]{2,6})$ nullable false minlength 1 string firstname the first name of the user the value can't be null and it must be between 1 to 36 characters in length nullable false minlength 1 maxlength 36 string lastname (optional) the last name of the user the value can't be null and it must be between 1 to 36 nullable false minlength 1 maxlength 36 string countrycode country code for mobile number the value can't be null and it must be between 2 to 4 characters in length nullable false pattern ^\\+(\d{1}\\ )?(\d{1,3})$ maxlength 4 minlength 2 string number the mobile number of the user get calls return a masked string in which only the last 4 digits of the phone number are in clear text the value can't be null and it must be between 4 to 10 characters in length specify a value for either email or primarymobile number also, both can be supplied as well nullable false pattern ^\[0 9]{4,14}$ maxlength 10 minlength 4 string request bodies are specified in json format the following shows an example request body to create a user and to update a user update user { "primarymobile" { "countrycode" "+1", "number" "5551234567" } } create user { "email" "johndoe\@gmail com", "firstname" "john", "lastname" "doe", "primarymobile" { "countrycode" "+91", "number" "1234567890" } } after creating a user, you can edit any attribute except for the tenantid user attributes the following user attributes can be saved as a part of user onboarding attribute description remarks tenantid tenant identifier userid system generated user identifier participantid (optional) the participant identifier of the user is generated by the participant service username the first, middle, and last name of the user the middlename and lastname values are optional if only the full name is available, it should be sent as firstname email the email address of the user either an email address or primary mobile number is required get calls return a masked value that reveals the first two characters of the username part of the email and masks the remaining characters with asterisks the domain name part is not masked primarymobile the primary mobile number with country code in json format either an email address or primary mobile number is required get calls return the country code and the last 4 digits of the mobile number the remaining characters are masked secondarymobile (optional) the secondary mobile number with country code in json format the secondary mobile number is only allowed if a primary mobile number is specified get calls return the country code and the last 4 digits of the mobile number the remaining characters are masked allowsocialauth (optional) a boolean value that specifies whether google login is allowed for example " allowsocialauth " {"google" true} default value false allowsamlauth (optional) a boolean value that specifies whether saml 2 0 login is allowed default value false samlconnector (optional) named saml 2 0 connector required if allowsamlauth is set as true samluserid (optional) the identifier for the user in the saml identity provider required if allowsamlauth is set to true isactive a boolean value that indicates whether the user is temporarily deactivated or not users deactivated using this flag can be activated again by a user of the tenant (with the required role) when set to true, user login is allowed when set to false, user login is disallowed and the user or user group is archived isdeleted a boolean value that specifies whether the user is permanently deactivated or not when set to true, user login is not allowed manage user groups a platform user group is a collection of users a user group allows a tenant to specify roles that apply to all of the users in the user group a user can be a part of multiple user groups user groups cannot be nested this means that they can contain only user entities and not other user group entities request bodies are specified in json format the following example shows request bodies for the management of user groups member description validation data type name name of the group the group name is unique for the application minlength 2 maxlength 50 pattern ^\[a za z]+( \[a za z]+) $ string description description of the group minlength 2 maxlength 50 string create groups { "name" "fmoperation", "description" "group of users responsible for first mile operations" } update groups { "description" "group description", "users" { "userids" \[ "503b235b 1378 4cb7 bc40 976cb7ceea51", "9efc9aab c55f 44e7 a01c 790e5d022945" ], "membership"\ true }, "isactive"\ true, "isdeleted"\ true } get group details "roles" \[ "platform\ role\ platform\ app\ dispatch api\ admin" ], "users" \[ "503b235b 1378 4cb7 bc40 976cb7ceea51", "9efc9aab c55f 44e7 a01c 790e5d022945" ], "groupid" "platform\ group\ dispachadmin", "name" "dispachadmin", "description" "dispatch admin group", "isactive"\ true } you can rename a user group without changing the roles attached to the user group the following methods are available for working with user groups get all group docid\ gjy8c twifydnu8gm86gt get groups docid r3wlddtxobdle iig9ir get all group docid\ gjy8c twifydnu8gm86gt user group attributes user groups are specified by a unique fully qualified name and have the following attributes attributes description remarks tenantid tenant identifier groupid system generated a fully qualified name of the user group name one word name for the user group the name must be unique across user groups of a tenant roles a list of roles mapped to the users belonging to the group users a list of user ids present in the group isdeleted a boolean value that indicates whether the user group is permanently deactivated or not set the value to true to indicate that the user group is deleted and archived the default value is false user authentication methods the authentication and authorization (aaa) service supports the following four methods for user authentication primary mobile number and otp email address and otp social login (google, github, etc ) saml 2 0 authentication (configurable for any saml 2 0 compatible external identity provider) the tenant has the option to enable or disable google login and saml 2 0 authentication at the user level (it is disabled by default) moreover, otp based login can be enabled for all users by default and cannot be disabled one time password a one time password (otp) is a unique 6 digit value and is unique for each otp request (combination of user, tenant, and request id) after the otp is issued, it will expire within 10 minutes from the issue time, or on a successful login with the otp, whichever occurs first the aaa service supports a maximum of 3 requests to resend the otp the minimum time gap between the last otp sent time and the request to resend otp is 30 seconds the platform enables otp and email login authentication methods by default social login if enabled, google login only works if an email address is specified in the aaa service for the user to establish a google login connection, call the create a social connection endpoint the following request body shows a sample api payload to create a social connection member description validation data type connectionname unique name of the connection minlength 2 maxlength 50 pattern ^\[a za z]+( \[a za z]+) $ string connectionclientid client id of the social application string connectionclientsecret client secret of the social application string { "connectionname" "google demo connection", "connectionclientid" "",//mention the connection client id "connectionclientsecret" ""//mention the connection client secret } saml 2 0 authentication the aaa service is set up as a service provider (sp) only, and not as an identity provider (idp) on successful saml 2 0 authentication, aaa service issues an authentication token for the user although the aaa service doesn't act as an idp, users have to be pre onboarded to aaa service for authorization purposes the tenant can configure their own saml 2 0 connector moreover, they can specify which attributes of the user (returned by saml idp) are matched with the saml user identifier provided in the aaa service for successful platform authentication to establish a saml connection, call create saml connection endpoint the following request body shows a sample api payload to create a connection member description validation data type connectionname unique name of the connection minlength 2 maxlength 50 pattern ^\[a za z]+( \[a za z]+) $ string signinendpoint (optional) sign in endpoint of the saml connection string signoutendpoint (optional) sign out endpoint of the saml connection string publickeycertificate the certificate required for saml connection should be of x509cert format string { "connectionname" "string", "signinendpoint" "string", "signoutendpoint" "string", "publickeycertificate" "string" } authentication token on successful authentication, the aaa service issues a unique jwt ( rfc 7519 https //datatracker ietf org/doc/html/rfc7519 ) as an authentication token for the user the authentication token is signed using a public/private key pair using rsa it is valid for 10 minutes and it is invalid in case the user is deactivated or removed from the aaa service the authentication token contains the following claims claim name description remarks iss issuer always fixed for a tenant signifies issuer of the token sub subject identifies the user for whom the token is issued aud audience apps for which access is granted exp expiry expiration date time after which the token will be invalid iat issued at the date time at which the token was issued on successful authentication, along with the authentication token, aaa service also issues a unique jwt ( rfc 7519 https //datatracker ietf org/doc/html/rfc7519 ) as a refresh token for the authentication token resources, permissions, and roles resources a platform resource is a generic name representation of any entity in a platform registered app on which action(s) can be performed by users or other services and apps for platform registered apps, the resources are created in the aaa services when the app is mapped to a tenant they are created as per the definition in a yaml file named access control yaml provided by each app these cannot be edited manually by any user of the tenant read apis are provided for reading a resource by resource id and reading all resources corresponding to a service or app ( appid ) permissions a platform permission is a generic name representation of authorization to perform a specific action on a defined platform resource the authorized action is specified in the list of allowed actions of the platform resource for platform registered apps, the permissions are created in the aaa service when the app is mapped to a tenant they are created as per the definition in a yaml file named access control yaml that is provided by each app these cannot be edited manually by any user of the tenant permissions are created in aaa service automatically when resources for a service or app are defined in the aaa service only one permission is created for each combination of resource and http methods read apis are provided to get the permission is specified by the value of permissionid to read all of the resources identified to the value that corresponds to a resourceid to read all resources corresponding to a service/app as specified by the value of appid to read the list of roles to which this permission is granted roles a platform role is a generic named representation of a set of permissions to access resources of a specific app or service a role is specific to an application roles are mapped to a user group or app one or more roles can be mapped to a user group or app they cannot be granted directly to a user granting a role to a user group grants the role to all users in the group creating roles to create a role, call the create app role https //app archbee com/public/preview 9m3sxlb43kjczevknejvn/preview wjq9ofmlij3 emss5s7w4 endpoint and then pass the following parameters in the request body member description validation data type rolename name of the role (each role should be assigned with a name) maxlength 50 pattern ^\[a za z]+( \[a za z]+) $ string description description of the role nullable false minlength 2 maxlength 50 pattern ^(\[a za z])(\[a za z0 9,\s] )$ string securitylevel the security level of the role the default is open used to restrict the access level for the role default open valid values sensitive , restricted , open string permissions ids of permission that are attached to this role pattern ^(\[a za z])(\[ \ a za z0 9] )$ string cangranttoapps the boolean value indicates if the role can be granted to other apps/services default false boolean cangranttousers the boolean value indicates if the role can be granted to user groups default true boolean the following shows sample request bodies for creating and updating a role update user { "rolename" "admin", "description" "admin role of the app", "securitylevel" "open", "permissions" \[ "platform\ app\ app1\ createapi\ post", "platform\ app\ app1\ deleteapi\ delete", "platform\ app\ app1\ getapi\ get", "platform\ app\ app1\ updateapi\ put" ], "cangranttoapps" false, "cangranttousers" true } create user { "description" "admin role of the user read permission", "assignpermissions"\ true, "permissions" \[ "user\ read" ], "cangranttoapps" false, "cangranttousers" true } type of roles the platform has two kinds of roles platform managed roles these are roles created/managed by coreos services and apps these roles cannot be edited by any user of the tenant these roles and their mapping to user groups, apps, or services, get automatically removed when the app/service that created the role is removed for the tenant resources & permissions offered by the service/app roles offered by the service/app roles required by the installed app to access resources of other services or apps tenant managed roles these are roles created by the tenant these roles provide more granularity compared to platform managed roles role attributes roles are specified by a unique fully qualified name and their definition includes the following attributes attribute description remarks tenantid unique identifier of the tenant appid the app to which permissions in the role belong a role can contain only permissions for resources that belong to a given app roleid a unique, system generated fully qualified name for the role format platform\ role \<appid> \<rolename> for example platform\ role\ fms\ fleetmanager or platform\ role\ faas\ faasadmin rolename a unique name for the role in the app specified by appid max 50 characters names can contain only alphabetic characters and hyphens however, the name should not start with a hyphen permissions list of permission names attached to this role managedby this field contains the appid of the app/service that created the role or tenantid if the role was created by a tenant users of a tenant cannot edit or remove roles managed by apps or services cangranttousers a boolean value that indicates whether this role can be granted to user groups true if the role can be granted to user groups; otherwise false default value true cangranttoapps a boolean value that indicates whether this role can be granted to apps true if the role can be granted to apps; otherwise false default value false isactive a boolean value that indicates whether the role is active deactivated roles can be activated again by a user of the tenant true if the role is active; otherwise false isdeleted a boolean value that indicates whether the role is permanently deactivated and will be archived true if the role is permanently deactivated; otherwise false role based access control (rbac) role based access control (rbac) is a method of restricting access based on the roles of individual users or apps within a tenant user access access can be provided to users by assigning roles to a user group roles offered by an app can be mapped to one or more user groups app access roles are assigned to an app for authenticating apps when they call another web service roles can be mapped to one or more apps or services more than one role can be mapped to an app or service access token and authorization process user access token on successful user authentication, a browser/mobile app requests the authorization api of aaa service with appdomain, appid, and authentication token in http headers after verifying the authentication token, aaa service issues a unique jwt ( rfc 7519 https //datatracker ietf org/doc/html/rfc7519 ) as an access token that is valid for the unique combination of browser/mobile app, the tenant associated with the appdomain, and the authentication token 📘 access token validity access token validity the access token has a validity of 24 hours user authentication & authorization (ui to service) once the user is successfully logged in, all rest api requests to backend services include the following http headers x coreos access authorization token x coreos tid tenant id x coreos request id request id x coreos userinfo userinfo service to service authentication & authorization for service to service communication, a client credentials grant is implemented for authentication aaa service exposes an api to obtain a token for service communication, and this token should be sent as the header in all api communications to other services the authorization is determined by the roles required section in the access control yaml file all service to service rest api requests include the following headers x coreos request id request id x coreos tid tenant id member description validation data type clientid application's client id nullable false string clientsecret application's client secret nullable false string audience app id for which the token is required not required in keycloak api calls nullable false string { "clientid" "string", "clientsecret" "string", "audience" "string" }