Details
-
Feature
-
Must have
-
None
-
SRCnet
-
-
-
-
-
19.5
-
Stories Completed, Integrated, Solution Intent Updated, BDD Testing Passes (no errors), Outcomes Reviewed, NFRS met, Demonstrated, Satisfies Acceptance Criteria, Accepted by FO
-
-
SRC-AAI SRC-DM
Description
Document and demonstrate how to use IVOA auth layers from/with IAM
General
Authorization decisions in a Storage Inventory (SI) deployment are based on group memberships. These groups are assumed to be known by an implementation of the IVOA Group Membership Service (GMS). Thus, the main goal of this feature is to create an implementation of the GMS protocol based on the group membership information contained in an IAM system.
GMS defines a simple REST API that answers the questions:
- Is this user a member of this group? (returns: the group if yes, nothing if no)
- Is this user a member of this set of groups? (returns: the groups the user is a member of)
- What groups is this user a member of? (returns: list of groupURIs)
The GMS REST API can be found in section 3 of the recommendation:
https://ivoa.net/documents/GMS/20220222/REC-GMS-1.0.html#tth_sEc3
The 'user', the subject of the membership inquiry, is the user who is making the REST call to GMS. Thus, the user's identity must be determined from the call in order to determine who the user is. The method of collection of this identity is specific to the authentication method being used. For the purposes of this feature, tokens may be the best choice for authentication.
Further details
The process that callers of GMS use to location service involves a registry lookup on the group URI. For example, a group would have a URI like ivo://srcnet.skao.int/gms?TestRead. Callers, through a registry call, would discover that groups with the authority srcnet.skao.int have an associated GMS instance at URL (made up example) https://srcnet.skao.int/gms.
However, for the scope of this feature, tests to the GMS service can assume that the GMS URL is known.
The API is very lightweight and so implementation mostly involves querying the back-end group datasource, in this case IAM.
Next
Following the completion of this feature will be the need for a token based Credential Delegation Service (CDP). It is required for callers of GMS to obtain the credentials (token?) needed to call GMS on the original user's behalf.
