# IAACaaS: IoT Application-Scoped Access Control as a Service +
## 5 Implementation and Results
### Implementation
#### 5.1.1 Identity Provider  
The Identity Management GEri is named KeyRock ([[https://catalogue.fiware.org/enablers/identity-management-keyrock](https://catalogue.fiware.org/enablers/identity-management-keyrock)]([https://catalogue.fiware.org/enablers/identity-management-keyrock](https://catalogue.fiware.org/enablers/identity-management-keyrock)) [Last accessed on 3 October 2017]). As one of the main services that the FIWARE ecosystem offers to its users is a public, Openstack-based cloud infrastructure, KeyRock has been implemented using Openstack technology as a starting point. This way, interoperability between it and the cloud infrastructure is ensured.  
KeyRock has two main components, named after their Openstack's counterparts: Python-based, back-end Keystone and Django-based, front-end Horizon.  
Openstack's Keystone ([[https://docs.openstack.org/developer/keystone](https://docs.openstack.org/developer/keystone)]([https://docs.openstack.org/developer/keystone](https://docs.openstack.org/developer/keystone)) [Last accessed on 3 October 2017]) has many of the functionalities that KeyRock requires, but not all of them. This is why a set of extensions had to be developed and included in KeyRock's Keystone. The most important ones for the purpose of this work are one that integrates the OAuthLib library ([[https://github.com/idan/oauthlib](https://github.com/idan/oauthlib)]([https://github.com/idan/oauthlib](https://github.com/idan/oauthlib)) [Last accessed on 3 October 2017]) to support OAuth 2.0 and another one that is in charge of the management of roles and permissions and its application-scoped assignment. The latter one overwrites the vanilla roles engine, which recedes into the background. This component makes use of an SQL database for persistence.  
KeyRock's Horizon serves as a friendlier user interface for users and administrators to manage applications, AC policies, etc., as opposed to the REST API offered by KeyRock's Keystone. This component also extends Openstack's front-end service Horizon ([[https://docs.openstack.org/developer/horizon](https://docs.openstack.org/developer/horizon)]([https://docs.openstack.org/developer/horizon](https://docs.openstack.org/developer/horizon)) [Last accessed on 3 October 2017]), to include the needed modules so as to fit the proposed model. These modules are a set of business logic (and their correspondent views) that helps in the tasks that were described in Section 4.2, such as the registration and management of OAuth 2.0 applications, PEP components, IoT devices, user accounts and the assignment of roles and permissions.  
The existing OAuth 2.0 libraries offer support for managing access tokens and application registration. However, all the features related to IoT devices and PEP components' management are new for our model implementation. Therefore, we had to include the new entities and to integrate them with the existing data models to offer our application-based access control mechanism. On the other hand, the ability to provide a user-friendly interface to manage this kind of low-level entities was also a challenge to take into consideration.