Bug 13920 - API authentication system - proposal
Summary: API authentication system - proposal
Status: RESOLVED WONTFIX
Alias: None
Product: Koha
Classification: Unclassified
Component: Web services (show other bugs)
Version: master
Hardware: All All
: P5 - low new feature (vote)
Assignee: Julian Maurice
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on: 7174 13995 14539 13799 14437
Blocks:
  Show dependency treegraph
 
Reported: 2015-03-26 18:37 UTC by Julian Maurice
Modified: 2018-06-08 08:04 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 13920: API Authentication, part 1: API keys management in interface (23.78 KB, patch)
2015-03-26 18:40 UTC, Julian Maurice
Details | Diff | Splinter Review
Bug 13920: API Authentication, part 2: implement authentication in API (19.75 KB, patch)
2015-03-26 18:40 UTC, Julian Maurice
Details | Diff | Splinter Review
[DO NOT PUSH] Bug 13920: Example usage for api authentication (3.46 KB, patch)
2015-03-26 18:40 UTC, Julian Maurice
Details | Diff | Splinter Review
Bug 13920 - API authentication system - Swagtenticator authentication - WIP (23.08 KB, patch)
2015-06-24 14:13 UTC, Olli-Antti Kivilahti
Details | Diff | Splinter Review
Bug 13920: 7. API Authentication, part 1: API keys management in interface (23.81 KB, patch)
2015-06-24 15:13 UTC, Olli-Antti Kivilahti
Details | Diff | Splinter Review
Bug 13920: 8. API Authentication, part 2: implement authentication in API (19.81 KB, patch)
2015-06-24 15:15 UTC, Olli-Antti Kivilahti
Details | Diff | Splinter Review
Bug 13920 - 9. API authentication system - Swagtenticator authentication - WIP (20.81 KB, patch)
2015-06-24 15:16 UTC, Olli-Antti Kivilahti
Details | Diff | Splinter Review
Bug 13920: 7. API Authentication, part 1: API keys management in interface (23.81 KB, patch)
2015-06-25 09:33 UTC, Julian Maurice
Details | Diff | Splinter Review
Bug 13920: 8. API Authentication, part 2: implement authentication in API (10.85 KB, patch)
2015-06-25 09:33 UTC, Julian Maurice
Details | Diff | Splinter Review
Bug 13920: 9. API authentication system - Swagtenticator authentication - WIP (20.76 KB, patch)
2015-06-25 09:33 UTC, Julian Maurice
Details | Diff | Splinter Review
Bug 13920: 7. API Authentication, part 1: API keys management in interface (26.03 KB, patch)
2015-07-24 14:07 UTC, Olli-Antti Kivilahti
Details | Diff | Splinter Review
Bug 13920: 8. API authentication system - Swagtenticator authentication (14.23 KB, patch)
2015-07-24 14:08 UTC, Olli-Antti Kivilahti
Details | Diff | Splinter Review
Bug 13920: 7. API Authentication, part 1: API keys management in interface (28.42 KB, patch)
2015-07-27 12:26 UTC, Olli-Antti Kivilahti
Details | Diff | Splinter Review
Bug 13920: 7. API Authentication, part 1: API keys management in interface (28.47 KB, patch)
2015-07-27 12:31 UTC, Olli-Antti Kivilahti
Details | Diff | Splinter Review
Bug 13920: 7. API Authentication, part 1: API keys management in interface (59.84 KB, patch)
2015-07-31 10:35 UTC, Olli-Antti Kivilahti
Details | Diff | Splinter Review
Bug 13920: 7. API Authentication, part 1: API keys management in interface (59.38 KB, patch)
2015-07-31 12:15 UTC, Olli-Antti Kivilahti
Details | Diff | Splinter Review
Bug 13920: API Authentication, part 1: API keys management in interface (29.48 KB, patch)
2015-08-27 17:22 UTC, Julian Maurice
Details | Diff | Splinter Review
Bug 13920: API authentication system - Swagtenticator authentication (13.18 KB, patch)
2015-08-27 17:22 UTC, Julian Maurice
Details | Diff | Splinter Review
Bug 13920: 5.1. API authentication system - Swagtenticator authentication - Replace Swagtenticator with x-around-action -hook. (12.47 KB, patch)
2015-09-15 10:49 UTC, Olli-Antti Kivilahti
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Julian Maurice 2015-03-26 18:37:23 UTC
Before adding too many routes to the new API, I want to propose an authentication system for this API.
Detailed description will follow in patches messages.
Comment 1 Julian Maurice 2015-03-26 18:40:30 UTC Comment hidden (obsolete)
Comment 2 Julian Maurice 2015-03-26 18:40:33 UTC Comment hidden (obsolete)
Comment 3 Julian Maurice 2015-03-26 18:40:36 UTC Comment hidden (obsolete)
Comment 4 Julian Maurice 2015-03-26 18:45:13 UTC
2nd test plan:
1/ Go to http://api.YOURLIBRARY/v1/doc
2/ Try route /borrowers/{borrowernumber} and see you have a 401 (Unauthorized) error
3/ Generate an API key (like described in 1st test plan) for a user that have the 'borrowers' permission
4/ Fill 'username' and 'api_key' inputs at the top of the Swagger UI page and retry /borrowers/{borrowernumber}. You should have a 200 status and the json representation of a borrower (if it exists)
Comment 5 Olli-Antti Kivilahti 2015-06-24 14:13:34 UTC Comment hidden (obsolete)
Comment 6 Olli-Antti Kivilahti 2015-06-24 15:13:30 UTC Comment hidden (obsolete)
Comment 7 Olli-Antti Kivilahti 2015-06-24 15:15:16 UTC Comment hidden (obsolete)
Comment 8 Olli-Antti Kivilahti 2015-06-24 15:16:08 UTC Comment hidden (obsolete)
Comment 9 Julian Maurice 2015-06-25 09:33:04 UTC Comment hidden (obsolete)
Comment 10 Julian Maurice 2015-06-25 09:33:20 UTC Comment hidden (obsolete)
Comment 11 Julian Maurice 2015-06-25 09:33:32 UTC Comment hidden (obsolete)
Comment 12 Julian Maurice 2015-06-25 09:40:59 UTC
Those patches were applied on top on bug 13895 and 13903 but do not depend on them and that was causing problems to apply this bug's patches
Also a strange thing happened because the updatedatabase code was placed between two already existing updates. This was causing problems too.

These issues are now fixed (I hope) and patches should apply cleanly.

Apply order: 13799 13995 14437 13920
Comment 13 Julian Maurice 2015-06-25 09:52:18 UTC
As SwaggerUI has its own bug now, the authentication code for SwaggerUI was also moved in another bug: bug 14461
Comment 14 Olli-Antti Kivilahti 2015-06-29 12:20:09 UTC
We agreed to move the SwaggerUI to another bug, because it is a API discovery tool and we shouldn't force people to use our API discovery tool (because there is a whole ecosystem of API discovery tools).
Swagger2-plugin extension is a critical feature to make the authentication system easy to use and be "behaviour from documentation". This is exactly the reason why we chose Swagger2 and are using the Mojolicious-framework. Moving the Swagger2-authentication extension to another bug makes no sense because it is an integral part of the REST API authentication system and should be pushed to master as part of the cure REST authentication mechanism.
If the Swagger2-extension is not pushed as a core authentication mechanism, then we end up with people doing auth the non-Swagger2-way and then people who do it the Swagger2-way.
So I don't see why that commit should be in it's own bug.
Comment 15 Julian Maurice 2015-06-30 07:10:32 UTC
I don't know what you mean by "Swagger2-authentication extension". It's the SwaggerUI authentication code that was moved to another bug and it makes perfect sense to me as SwaggerUI will not be integrated as part of the REST API
Comment 16 Olli-Antti Kivilahti 2015-07-03 08:30:00 UTC
With Swagger2-plugin extension I mean Koha::REST::V1::Plugins::KohaliciousSwagtenticator which extends Mojolicious::Plugin::Swagger2, making it possible to define the needed permissions in the swagger.json -file.
Comment 17 Olli-Antti Kivilahti 2015-07-03 08:31:49 UTC
(In reply to Julian Maurice from comment #13)
> As SwaggerUI has its own bug now, the authentication code for SwaggerUI was
> also moved in another bug: bug 14461

But I have a gut-feeling that I am misunderstanding what you mean with
"the authentication code for SwaggerUI"
Since the Swagtenticator-patch seems to still be in this bug :)
Comment 18 Julian Maurice 2015-07-03 08:59:45 UTC
(In reply to Olli-Antti Kivilahti from comment #17)
> But I have a gut-feeling that I am misunderstanding what you mean with
> "the authentication code for SwaggerUI"
> Since the Swagtenticator-patch seems to still be in this bug :)

SwaggerUI (the thing in api/v1/doc) was modified to work with the authentication system proposed in this bug. Only these modifications were moved in another bug. Swagtenticator is still here and it's not a mistake ;)
Comment 19 Olli-Antti Kivilahti 2015-07-24 14:07:21 UTC Comment hidden (obsolete)
Comment 20 Olli-Antti Kivilahti 2015-07-24 14:08:41 UTC Comment hidden (obsolete)
Comment 21 Olli-Antti Kivilahti 2015-07-27 12:26:49 UTC Comment hidden (obsolete)
Comment 22 Olli-Antti Kivilahti 2015-07-27 12:31:06 UTC Comment hidden (obsolete)
Comment 23 Olli-Antti Kivilahti 2015-07-31 10:35:52 UTC Comment hidden (obsolete)
Comment 24 Olli-Antti Kivilahti 2015-07-31 12:15:18 UTC Comment hidden (obsolete)
Comment 25 Olli-Antti Kivilahti 2015-07-31 15:28:04 UTC
Moving the authentication system under the main REST API Bug because this is no longer WIP or a draft but a real working authentication system.
(with some bugs on it)

*** This bug has been marked as a duplicate of bug 13799 ***
Comment 26 Julian Maurice 2015-08-27 17:22:25 UTC
Created attachment 42041 [details] [review]
Bug 13920: API Authentication, part 1: API keys management in interface

Depends on Bug 14539 and Bug 7174.

This introduces the concept of API keys for use in the new REST API.
A key is a string of 32 alphanumerical characters (32 is purely
arbitrary, it can be changed easily).
A user can have multiple keys (unlimited at the moment)
Keys can be generated automatically, and then we have the possibility to
delete or revoke each one individually.

ApiKeys can be easily accessed using the Koha::ApiKeys-package.

Includes unit tests and selenium integration tests for Intra and OPAC.

Test plan:
1/ Go to staff interface
2/ Go to a borrower page
3/ In toolbar, click on More -> Manage API keys
4/ Click on "Generate new key" multiple times, check that they are
   correctly displayed under the button, and they are active by default
5/ Revoke some keys, check that they are not active anymore
6/ Delete some keys, check that they disappear from table
7/ Go to opac interface, log in
8/ In your user account pages, you now have a new tab to the left "your
   API keys". Click on it.
9/ Repeat steps 4-6
Comment 27 Julian Maurice 2015-08-27 17:22:38 UTC
Created attachment 42042 [details] [review]
Bug 13920: API authentication system - Swagtenticator authentication

Reads the Swagger2 definitions and defines the API routes and controllers
for Mojolicious.

Authentiates the API consumer using Koha::Auth::Challenge::RESTV1
with all the necessary details inferred from Swagger2, like permissions.

Validates all input to match the Swagger2 definition.

Authentication is based on the permissions defined in the Swagger2
definition.
Add x-koha-permission to the Operation Object to define needed Koha
permissions to access the resource.

Eg.
  "/borrowers/{borrowernumber}": {
    "get": {
      "x-mojo-controller": "Koha::REST::V1::Borrowers",
      "x-koha-permission": {
        "borrowers": "*"
      },
      "operationId": "getBorrower",
      "tags": ["borrowers"],
Comment 28 Olli-Antti Kivilahti 2015-09-15 10:49:21 UTC
Created attachment 42555 [details] [review]
Bug 13920: 5.1. API authentication system - Swagtenticator authentication - Replace Swagtenticator with x-around-action -hook.
Comment 29 David Cook 2017-02-10 05:17:01 UTC
Where are we at with this?

I've been thinking about how API keys would be nice...
Comment 30 Olli-Antti Kivilahti 2017-03-01 10:41:59 UTC
tcohen and ashimema are cooking something as we speak.
Comment 31 Tomás Cohen Arazi 2017-06-23 13:34:43 UTC
This patchset cannot depend on bug 14539... that's too much for such a simple feature.
Comment 32 Julian Maurice 2018-06-08 08:04:29 UTC
Now that bug 20402 is in master, this can be closed.