Description
DIGIT is an open source service delivery platform on which several government and private sector organisations build solutions e.g. National Urban Digital Mission leverages DIGIT for National Urban Governance Platform (UPYOG) - 28+ States have signed up to roll out UPYOG to all their urban local bodies. This will help deliver services like Property Tax, Public Grievances, Water Connection, Birth/Death Certificate etc. to all citizens.
DIGIT platform has multiple core microservices, where each microservice provides a specific functionality like authentication, authorisation, encryption, workflow etc. Service delivery applications like property tax, trade license etc. are built on top of this DIGIT platform. They internally call these core microservices to utilise the functionality provided by them. DIGIT uses zuul as the API gateway. All the request coming to the backend server passes through this gateway. It provides a centralised way of authentication and authorisation of API calls. This removes the need for each microservice to implement their own authentication and authorisation mechanism. Currently DIGIT has a stateful authentication mechanism in which the access tokens are generated and stored in Redis database. Whenever authentication request is received by the service, it checks in the Redis DB if the token is available in the Redis database. For any authentication request, a call needs to be made to the authentication server. This will have an impact on the performance and scalability.
JWTs are stateless, meaning that the server doesn't need to store any information about the token itself. This can be an advantage in terms of scalability and performance, as there is no need for the server to maintain any session state for the client. It also provides a decentralized mechanism of authentication and authorization, allowing for the authentication and authorization of requests across different systems and services without requiring a centralized authentication and authorization service.
For further reference to current DIGIT authentication and authorisation service please refer the following documentation:
Authentication
Authorization
Features to be implemented:
- Integration of JWT-based authentication and authorisation mechanism with the existing DIGIT platform.
- Development of a scalable and performant JWT token generation and verification mechanism using public and private key encryption.
- Integration of the new JWT-based authentication and authorisation mechanism with the existing API gateway: Zuul.
- Development of a client utility which can do authentication and authorisation of the JWT tokens. The utility can be used
by third party applications to using DIGIT authentication and authorisation. - Implementation of multi-factor authentication (MFA) to provide an additional layer of security for user accounts.(Optional)
Learning Path:
- Understanding the basics of JWT-based authentication and authorisation mechanism and its advantages over stateful authentication mechanisms.
- Learning how to use open source JWT libraries and tools like JJWT, Nimbus JOSE + JWT, Auth0 JWT, etc. to generate and verify JWT tokens.
- Understanding the key concepts of public and private key encryption and how to use them to secure JWT tokens.
- Learning how to integrate JWT-based authentication and authorisation with existing microservices and API gateway using Zuul.
- Learning how to implement MFA for user accounts using open-source libraries like Google Authenticator. (Optional)
Product Set Up:
- Setting up a development environment with the required tools and libraries like Java, Spring Boot, Redis, JWT libraries, etc.
- Setting up the few core services of DIGIT like zuul and egov-user locally for testing and development purposes.
- Configuring the development environment with appropriate secrets, keys, and environment variables for secure JWT token generation and verification.
Acceptance Criteria:
- Successful integration of the JWT-based authentication and authorisation mechanism with the DIGIT platform
- Implementation of a scalable and performant JWT token generation and verification mechanism using public and private key encryption.
- Development of a client library for user authentication and authorisation
- Implementation of multi-factor authentication (MFA) for user accounts to provide an additional layer of security. (Not mandatory)