Authentication And Authorization

Introduction

The Authentication And Authorization (AAA) Service provides APIs that allow you to create users, authenticate their identity, and validate their access permissions to App and Platform Resources

Functions provided by the AAA Service

The AAA Service facilitates the following actions:

• User onboarding
• Manage User Groups
• User Authentication
• Manage resources, permissions, & roles
• A comprehensive view of permissions associated with a user and the role that granted the permission.
• Granting roles to apps and user groups
• User authorization

User onboarding

A Platform User is an entity created in AAA Service that represents a person who interacts with Platform Apps and the OS1 Platform. Onboarding a User in another service, for example, the Participant Service, does not automatically onboard the User to the AAA Service. The user must be specifically onboarded to the AAA Service for using its service functionality.

Creating a User

To create a new User call the Create a user endpoint.
Note: For creating a User, firstName with any one of the email or a primaryMobile number are required. If providing a primaryMobile number then countryCode & number are mandatory fields.

Request bodies are specified in JSON format. The following shows an example request body to create a User and to update a User.

{
   "primaryMobile":{
      "countryCode":"+91",
      "number":"0987654321"
   }
}

{
    "email":"[email protected]",
    "firstName": "John",
    "lastName": "Doe",
    "primaryMobile": {
    "countryCode": "+91",
    "number": "1234567890"
  }
}

After creating a User, you can edit any attribute except for the tenantId.

User Attributes

The following user attributes can be saved as a part of user onboarding:

Manage User Groups

A Platform User Group is a collection of Users. A User Group allows a tenant to specify Roles that apply to all of the Users in the User Group. A User can be a part of multiple User Groups. User Groups cannot be nested. This means that they can contain only User entities and not other User Group entities.

Request bodies are specified in JSON format. The following example shows request bodies for the management of User Groups:

{
  "name": "FMOperation",
  "description": "Group of users responsible for First Mile Operations"
}

{
   "description":"Group description",
   "users":{
      "userIds":[
         "503b235b-1378-4cb7-bc40-976cb7ceea51",
         "9efc9aab-c55f-44e7-a01c-790e5d022945"
      ],
      "membership":true
   },
   "isActive":true,
   "isDeleted":true
}

{
   "roles":[
      "Platform:Role:platform:app:dispatch-api:admin"
   ],
   "users":[
      "503b235b-1378-4cb7-bc40-976cb7ceea51",
      "9efc9aab-c55f-44e7-a01c-790e5d022945"
   ],
   "groupId":"platform:group:DispachAdmin",
   "name":"DispachAdmin",
   "description":"Dispatch Admin Group",
   "isActive":true
}

You can rename a user group without changing the Roles attached to the user group.

The following methods are available for working with User Groups:

• Get the details of a group of users and roles.
• Getting the list of User Groups of which a User is a member
• Getting the list of Roles attached to a User Group

User Group Attributes

User Groups are specified by a unique fully qualified name and have the following attributes:

User Authentication Methods

The Authentication And Authorization (AAA) Service supports the following four methods for user authentication:

• Primary Mobile Number and OTP
• Email Address and OTP
• Social Login (Google, Github, etc.)
• SAML 2.0 Authentication (configurable for any SAML 2.0 compatible external identity provider)

The tenant has the option to enable or disable Google Login and SAML 2.0 Authentication at the user level (it is disabled by default). Moreover, OTP-based login can be enabled for all users by default and cannot be disabled.

One-Time Password

A One-Time Password (OTP) is a unique 6-digit value and is unique for each OTP request (combination of user, tenant, and request ID). After the OTP is issued, it will expire within 10 minutes from the issue time, or on a successful login with the OTP, whichever occurs first.

The AAA service supports a maximum of 3 requests to resend the OTP. The minimum time gap between the last OTP sent time and the request to resend OTP is 30 seconds.

The Platform enables OTP and email login authentication methods by default.

Social Login

If enabled, Google Login only works if an email address is specified in the AAA service for the User.

To establish a Google Login connection, call the Create a social connection. endpoint.

The following request body shows a sample API payload to create a social connection:

{
   "connectionName":"google-demo-connection",
   "connectionClientId":"",//mention the connection client ID
   "connectionClientSecret":""//mention the connection client secret
}

SAML 2.0 Authentication

The AAA Service is set up as a Service Provider (SP) only, and not as an Identity Provider (IdP). On successful SAML 2.0 authentication, AAA Service issues an Authentication Token for the user.

Although the AAA Service doesn't act as an IdP, Users have to be pre-onboarded to AAA Service for authorization purposes.

The tenant can configure their own SAML 2.0 connector. Moreover, they can specify which attributes of the User (returned by SAML IdP) are matched with the SAML User Identifier provided in the AAA Service for successful Platform Authentication.

To establish a SAML connection, call Create a SAML connection endpoint.

The following request body shows a sample API payload to create a connection:

{
  "connectionName": "string",
  "signInEndpoint": "string",
  "signOutEndpoint": "string",
  "publicKeyCertificate": "string"
}

Authentication Token

On successful authentication, the AAA Service issues a unique JWT (RFC-7519) as an Authentication Token for the User. The Authentication Token is signed using a public/private key pair using RSA. It is valid for 10 minutes and it is invalid in case the user is deactivated or removed from the AAA Service.

The Authentication Token contains the following claims:

On successful authentication, along with the Authentication Token, AAA Service also issues a unique JWT (RFC-7519) as a Refresh Token for the Authentication Token.

Resources, Permissions, and Roles

Resources

A Platform Resource is a generic name representation of any entity in a Platform Registered App on which action(s) can be performed by users or other services and apps.

For Platform Registered Apps, the resources are created in the AAA Services when the app is mapped to a tenant. They are created as per the definition in a YAML file named access-control.yaml provided by each app. These cannot be edited manually by any user of the tenant.

Read APIs are provided for reading a resource by resource ID and reading all resources corresponding to a service or app (appId).

Permissions

A Platform Permission is a generic name representation of authorization to perform a specific action on a defined Platform Resource. The authorized action is specified in the list of allowed actions of the Platform Resource.

For Platform Registered Apps, the permissions are created in the AAA Service when the app is mapped to a tenant. They are created as per the definition in a YAML file named access-control.yaml that is provided by each app. These cannot be edited manually by any user of the tenant.

Permissions are created in AAA Service automatically when resources for a service or app are defined in the AAA Service. Only one Permission is created for each combination of Resource and HTTP Methods.

Read APIs are provided to get:

• The permission as specified by the value of permissionId.
• To read all of the resources identified to the value that corresponds to a resourceId.
• To read all resources corresponding to a service/app as specified by the value of appId.
• To read the list of roles to which this permission is granted.

Roles

A Platform Role is a generic named representation of a set of permissions to access resources of a specific app or service. A Role is specific to an application.

Roles are mapped to a User Group or app. One or more Roles can be mapped to a User Group or app. They cannot be granted directly to a User. Granting a Role to a User Group grants the role to all Users in the group.

Creating Roles

To create a Role, call the Create app role endpoint and then pass the following parameters in the request body:

The following shows sample request bodies for creating and updating a Role:

{
   "roleName":"admin",
   "description":"Admin role of the App",
   "securityLevel": "OPEN",
   "permissions":[
      "platform:app:app1:createAPI:post",
      "platform:app:app1:deleteAPI:delete",
      "platform:app:app1:getAPI:get",
      "platform:app:app1:updateAPI:put"
   ],
  "canGrantToApps": false,
  "canGrantToUsers": true
}

{
   "description":"Admin role of the user read permission",
   "assignPermissions":true,
   "permissions":[
      "user:read"
   ],
  "canGrantToApps": false,
  "canGrantToUsers": true
}

Type of Roles

The platform has two kinds of Roles:

• Platform Managed Roles
  These are roles created/managed by CoreOS Services and Apps. These roles cannot be edited by any user of the tenant. These roles and their mapping to user groups, apps, or services, get automatically removed when the app/service that created the role is removed for the tenant.

  When a service or app is deployed, the installation process reads the access-control.yaml file, included in the App/Service repository, and correspondingly creates the following:

  • Resources & Permissions offered by the Service/App.
  • Roles offered by the Service/App.
  • Roles required by the installed App to access resources of other Services or Apps.

• Tenant Managed Roles
  These are Roles created by the Tenant. These roles provide more granularity compared to Platform Managed Roles.

Role Attributes

Roles are specified by a unique fully qualified name and their definition includes the following attributes:

Role-Based Access Control (RBAC)

Role-Based Access C`1ontrol (RBAC) is a method of restricting access based on the roles of individual users or apps within a tenant.

User Access:
Access can be provided to users by assigning roles to a user group. Roles offered by an App can be mapped to one or more User Groups.

App Access:
Roles are assigned to an app for authenticating apps when they call another web service. Roles can be mapped to one or more Apps or Services. More than one Role can be mapped to an App or Service.

Access Token and Authorization Process

User Access Token

On successful user authentication, a browser/mobile app requests Authorization API of AAA Service with appDomain, appId, and Authentication Token in HTTP Headers.

After verifying the authentication token, AAA Service issues a unique JWT (RFC-7519) as an Access Token that is valid for the unique combination of browser/mobile app, the tenant associated with the appDomain, and the Authentication Token.

📘

Access Token Validity

The Access Token has a validity of 24 hours.

User Authentication & Authorization (UI to Service)

Once the user is successfully logged in, all REST API requests to backend services include the following HTTP Headers:

• X-COREOS-ACCESS: Authorization Token
• X-COREOS-TID: Tenant ID
• X-COREOS-REQUEST-ID: Request ID
• X-COREOS-USERINFO: Userinfo

Service to Service Authentication & Authorization

For Service-to-Service communication, a client credentials grant is implemented for authentication. AAA service exposes an API to obtain a token for service communication, and this token should be sent as the header in all API communications to other services. The authorization is determined by the roles-required section in the access-control.yaml file.

All Service-to-Service REST API requests include the following headers:

• X-COREOS-REQUEST-ID: Request ID
• X-COREOS-TID: Tenant ID

{
  "clientId": "string",
  "clientSecret": "string",
  "audience": "string"
}