Package: eidawsauth
Method /auth for EIDA authenticationThis projects is the implementation of the/authmethod as described in EIDA.Input : a signed token (validity will be checked by the program)Output : a login and password in thelogin:passwordformThis login and password is valid for a certain amount of time (24h typically)Playing aroundpipinstallgunicornhttpie
gunicorn--reload-w1eidaws_auth:authThen, to send a post request :httplocalhost:8000/version
httpPOSTlocalhost:8000<token.ascRunning testspipinstall-e.
pytestConfigurationThe conifguration is set in theeidawsauth/config.pyfile.There are 4 classes :Config: the root class with some defaultsProduction: the configuration suitable for productionTest: the configuration suitable for pytestDev: the configuration for the developpment environmentYou can choose the configuration class by setting up theRUNMODEenvironment variable. Default value is DEVELOPMENTRUNMODE=PRODUCTIONgunicorn-w4eidaws_auth:autDatabase initialisationUser and minimum privilegesgrantconnectondatabase"resifAuth"toeidawsauth;grantconnectondatabase"resifInv-Prod"toeidawsauth;\c"resifAuth"grantselect,insert,update,deleteontableusers,credentialsTOeidawsauth;grantselect,updateonsequenceusers_user_index_seqTOeidawsauth;\c"resifInv-Prod"grantselect,insert,update,deleteontableeida_temp_usersTOeidawsauth;grantselectontablenetworkstoeidawsauth;grantselect,updateonsequenceaut_user_user_id_seqtoeidawsauth;Expected tables schemaAUTHDBTableusers:
From the existing table, we have to add anexpires_atcolumn.altertableusersaddcolumnifnotexistsexpires_attimestampdefaultvaluenull;Tablecredentials:
No modification to the resifAuth schemaPRIVILEDGEDBTableaut_user.
No modification to the resifInv-Prod schema.Colonne|Type|Collationnement|NULL-able|Pardéfaut|Stockage|------------+---------+-----------------+-----------+-------------------------------------------+----------+user_id|integer||notnull|nextval('aut_user_user_id_seq'::regclass)|plain|network_id|bigint|||0|plain|network|text||notnull||extended|start_year|integer||notnull|0|plain|end_year|integer||notnull|0|plain|name|text||notnull||extended|Index:"aut_user_pkey"PRIMARYKEY,btree(user_id)"uniq_aut_user"UNIQUECONSTRAINT,btree(network,start_year,end_year,name)Contraintesdeclésétrangères:"aut_user_network_id_fkey"FOREIGNKEY(network_id)REFERENCESnetworks(network_id)ONDELETESETDEFAULTExplanationsWhat does this program do ?StepsGet all configurations and setup database connectionsRead the data from POST request
NOTE : We should put a size limit on the WSGI serverVerify the token's signature using the geofon public keyParse the token's informationsCompute a random login and passwordRegister this in the resifAuth database, along with theexpires_atvalue (24h)From themember-offield in the token :do the mapping from EPOS names to FDSN reference from the epos_fdsn table in the resifAuth database
the FDSN reference is the network name, startyear, endyearregister the login along with the FDSN references and the expiration date in the resifInv-Prod database, tableaccessReturn thelogin:passwordto the clientOther methods/versionreturns the version number and environment string./cleanupRemove old users, credentials and privileges.It's probably a good idea to protect this method at the webserver level.