Skip to content

Commit 04fbb9a

Browse files
committed
updates
1 parent cf1d680 commit 04fbb9a

File tree

7 files changed

+173
-78
lines changed

7 files changed

+173
-78
lines changed

.nojekyll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
This file makes sure that Github Pages doesn't process mdBook's output.

design/authentication-authorization.html

Lines changed: 56 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -153,109 +153,127 @@ <h1 class="menu-title">Light Portal Documentation</h1>
153153
<div id="content" class="content">
154154
<main>
155155
<h1 id="authentication--authorization"><a class="header" href="#authentication--authorization">Authentication &amp; Authorization</a></h1>
156-
<p>Light-Portal is an single page application and it uses both OAuth 2.0 Authorization Code and Client Credentials flows.</p>
157-
<p>The below pattern depicts the end-to-end flow recommended by the Light Platform when SPA calls downstream APIs.</p>
156+
<p>Light-Portal is a single-page application (SPA) that utilizes both the OAuth 2.0 Authorization Code and Client Credentials flows.</p>
157+
<p>The following pattern illustrates the end-to-end process recommended by the Light Platform for an SPA interacting with downstream APIs.</p>
158158
<h3 id="sequence-diagram"><a class="header" href="#sequence-diagram">Sequence Diagram</a></h3>
159+
<p>The following is the raw data that can be used to render the diagram in http://www.plantuml.com</p>
159160
<pre><code>@startuml
160161
participant "Portal View" as PortalView
161162
participant "Login View" as LoginView
162163
participant "Light Gateway" as Gateway
163164
participant "OAuth-Kafka" as OAuthKafka
164165
participant "Auth Service" as AuthService
166+
participant "Proxy Sidecar" as ProxySidecar
165167
participant "Backend API" as BackendAPI
166168

167169
PortalView -&gt; LoginView: 1. Signin redirect
168170
LoginView -&gt; OAuthKafka: 2. Authenticate user
169-
OAuthKafka -&gt; AuthService: 3. Authenticate User\n(Active Directory\nfor Employees)\n(CIF System\nfor Customers)
171+
OAuthKafka -&gt; AuthService: 3. Authenticate User\n (Active Directory\n for Employees)\n (CIF System\n for Customers)
170172
AuthService -&gt; OAuthKafka: 4. Authenticated
171173
OAuthKafka -&gt; OAuthKafka: 5. Generate auth code
172174
OAuthKafka -&gt; PortalView: 6. Redirect with code
173-
PortalView -&gt; Gateway: 7. Authorization URL \nwith code param
174-
Gateway -&gt; OAuthKafka: 8. Create JWT access \ntoken with code
175-
OAuthKafka -&gt; OAuthKafka: 9. Generate JWT \naccess token \nwith user claims
176-
OAuthKafka -&gt; Gateway: 10. Token returns \nto Gateway
177-
Gateway -&gt; PortalView: 11. Token returns \nto Portal View \nin Secure Cookie
175+
PortalView -&gt; Gateway: 7. Authorization URL \n with code param
176+
Gateway -&gt; OAuthKafka: 8. Create JWT access \n token with code
177+
OAuthKafka -&gt; OAuthKafka: 9. Generate JWT \n access token \n with user claims
178+
OAuthKafka -&gt; Gateway: 10. Token returns \n to Gateway
179+
Gateway -&gt; PortalView: 11. Token returns \n to Portal View \n in Secure Cookie
178180
PortalView -&gt; Gateway: 12. Call Backend API
179181
Gateway -&gt; Gateway: 13. Verify the token
180-
Gateway -&gt; OAuthKafka: 14. Create Client \nCredentials token
181-
OAuthKafka -&gt; OAuthKafka: 15. Generate Token \nwith Scopes
182-
OAuthKafka -&gt; Gateway: 16. Return the \scope token
183-
Gateway -&gt; Gateway: 17. Add scope \ntoken to \nX-Scope-Token \nHeader
184-
Gateway -&gt; BackendAPI: 18. Invoke API
185-
BackendAPI -&gt; BackendAPI: 19. Verify \nAuthorization \ntoken
186-
BackendAPI -&gt; BackendAPI: 20. Verify \nX-Scope-Token
187-
BackendAPI -&gt; Gateway: 21. Return response
188-
Gateway -&gt; PortalView: 22. Return response
182+
Gateway -&gt; OAuthKafka: 14. Create Client \n Credentials token
183+
OAuthKafka -&gt; OAuthKafka: 15. Generate Token \n with Scopes
184+
OAuthKafka -&gt; Gateway: 16. Return the \n scope token
185+
Gateway -&gt; Gateway: 17. Add scope \n token to \n X-Scope-Token \nHeader
186+
Gateway -&gt; ProxySidecar: 18. Invoke API
187+
ProxySidecar -&gt; ProxySidecar: 19. Verify \n Authorization \ntoken
188+
ProxySidecar -&gt; ProxySidecar: 20. Verify \n X-Scope-Token
189+
ProxySidecar -&gt; ProxySidecar: 21. Fine-Grained \n Authorization
190+
ProxySidecar -&gt; BackendAPI: 22. Invoke \n business API
191+
BackendAPI -&gt; ProxySidecar: 23. Business API \n response
192+
ProxySidecar -&gt; ProxySidecar: 24. Fine-Grained \n response filter
193+
ProxySidecar -&gt; Gateway: 25. Return response
194+
Gateway -&gt; PortalView: 26. Return response
189195

190196
@enduml
191197
</code></pre>
192198
<p><img src="authentication-sequence.png" alt="Sequence Diagram" /></p>
193199
<ol>
194200
<li>
195-
<p>When a user hit the website to access the single page application, the Light Gateway will serve the single page application on users browser. By default, the user is not logged in and he/she can only access limited features on the site. If the user want to access more features, he/she can click the user button on the header and click sign in menu. This will allow the browser to redirect from the Portal View to Login View which is served by the same instance of Light Gateway.</p>
201+
<p>When a user visits the website to access the single-page application (SPA), the Light Gateway serves the SPA to the user's browser. By default, the user is not logged in and can only access limited site features. To unlock additional features, the user can click the <strong>User</strong> button in the header and select the <strong>Sign In</strong> menu. This action redirects the browser from the Portal View to the Login View, both served by the same Light Gateway instance.</p>
196202
</li>
197203
<li>
198-
<p>On the Login View site, he/she can input the username/password or choose Google/Facebook for authentication. Once the Signin form is submitted, the request goes to the Light Gateway with user credentials. The Light Gateway will route the request to the OAuth Kafka service.</p>
204+
<p>On the Login View page, the user can either input a username and password or choose Google/Facebook for authentication. When the login form is submitted, the request is sent to the Light Gateway with the user's credentials. The Gateway forwards this request to the OAuth Kafka service.</p>
199205
</li>
200206
<li>
201-
<p>OAuth Kafka has many Authenticator implementations that can be used to authenticate the user credential. For example, use the Light Portal user database to authenticate, use Active Directory to authenticate employees or use CIF service to authenticate customers.</p>
207+
<p>OAuth Kafka supports multiple authenticator implementations to verify user credentials. Examples include authenticating via the Light Portal user database, Active Directory for employees, or CIF service for customers.</p>
202208
</li>
203209
<li>
204-
<p>Once authentication is completed successfully, it will response to the OAuth Kafka with the authentication result.</p>
210+
<p>Once authentication is successfully completed, the OAuth Kafka responds with the authentication result.</p>
205211
</li>
206212
<li>
207-
<p>Upon successful authentication, OAuth Kafka will generate an authorization code which is a UUID associated to the user profile.</p>
213+
<p>Upon successful authentication, OAuth Kafka generates an authorization code (a UUID associated with the user's profile).</p>
208214
</li>
209215
<li>
210-
<p>OAuth Kafka redirect the authorization code to the Portal View browser through Gateway.</p>
216+
<p>OAuth Kafka redirects the authorization code back to the browser at the Portal View via the Gateway.</p>
211217
</li>
212218
<li>
213-
<p>The Portal View single page application doesn't have this redirct route, so that request will be sent to the Gateway with the code as a query parameter.</p>
219+
<p>Since the Portal View SPA lacks a dedicated redirect route for the authorization code, the browser sends the code as a query parameter in a request to the Gateway.</p>
214220
</li>
215221
<li>
216-
<p>The StatelessAuthHandler on the Gateway will handle the request and send a token request to the OAuth Kafka to get a JWT access token.</p>
222+
<p>The <code>StatelessAuthHandler</code> in the Gateway processes this request, initiating a token request to OAuth Kafka to obtain a JWT access token.</p>
217223
</li>
218224
<li>
219-
<p>OAuth Kafka will generate an access token with user claims in the JWT custom claims and drop the code as it is used only once.</p>
225+
<p>OAuth Kafka generates an access token containing user claims in its custom JWT claims. The authorization code is then invalidated, as it is single-use.</p>
220226
</li>
221227
<li>
222-
<p>The authorization code token is returned to the Gateway.</p>
228+
<p>The access token is returned to the Gateway.</p>
223229
</li>
224230
<li>
225-
<p>The StatelessAuthHandler on the Gateway will put the token into a secure cookie and send to the Portal View.</p>
231+
<p>The <code>StatelessAuthHandler</code> in the Gateway stores the access token in a secure cookie and sends it back to the Portal View.</p>
226232
</li>
227233
<li>
228-
<p>When Portal View access one of the Backend APIs, it sends the API request to the Gateway with the cookies.</p>
234+
<p>When the Portal View SPA makes requests to backend APIs, it includes the secure cookie in the API request sent to the Gateway.</p>
229235
</li>
230236
<li>
231-
<p>The StatelessAuthHandler on the Gateway will verify the token in the secure cookie and put it into the Authorization header of the request.</p>
237+
<p>The <code>StatelessAuthHandler</code> in the Gateway validates the token in the secure cookie and places it in the <code>Authorization</code> header of the outgoing request.</p>
232238
</li>
233239
<li>
234-
<p>Once the token is verified successfully, the TokenHandler on the Gateway will issue a token request to get a client credentials token to the OAuth Kafka based on the path prefix of the API endpoint.</p>
240+
<p>If the token is successfully validated, the <code>TokenHandler</code> in the Gateway makes a request to OAuth Kafka for a client credentials token, using the path prefix of the API endpoint.</p>
235241
</li>
236242
<li>
237-
<p>OAuth Kafka generate a client credentials token with the scope that can access the downstream service.</p>
243+
<p>OAuth Kafka generates a client credentials token with the appropriate scope for accessing the downstream service.</p>
238244
</li>
239245
<li>
240246
<p>The client credentials token is returned to the Gateway.</p>
241247
</li>
242248
<li>
243-
<p>The TokenHandler on the Gateway will put this token into X-Scope-Token header of the original request.</p>
249+
<p>The <code>TokenHandler</code> in the Gateway inserts this token into the <code>X-Scope-Token</code> header of the original request.</p>
244250
</li>
245251
<li>
246-
<p>The Gateway router the original request to the downstream Backend API.</p>
252+
<p>The Gateway routes the original request, now containing both tokens, to the downstream <code>proxy sidecar</code>of the backend API.</p>
247253
</li>
248254
<li>
249-
<p>The Backend API will verify the Authorization token for the signature and expiration etc.</p>
255+
<p>The proxy sidecar validates the <code>Authorization</code> token, verifying its signature, expiration, and other attributes.</p>
250256
</li>
251257
<li>
252-
<p>The Backend API will verify the X-Scope-Token for signature, expiration and scope etc.</p>
258+
<p>The proxy sidecar also validates the <code>X-Scope-Token</code>, ensuring its signature, expiration, and scope are correct.</p>
253259
</li>
254260
<li>
255-
<p>The Backend API retuns the response once both tokens are verified.</p>
261+
<p>Once both tokens are successfully validated, the proxy sidecar enforces fine-grained authorization rules based on the user's custom security profile contained in the <code>Authorization</code> token.</p>
256262
</li>
257263
<li>
258-
<p>The response returns to the Portal View to render the page.</p>
264+
<p>If the fine-grained authorization checks are passed, the proxy sidecar forwards the request to the backend API.</p>
265+
</li>
266+
<li>
267+
<p>The backend API processes the request and sends the full response back to the <code>proxy sidecar</code>.</p>
268+
</li>
269+
<li>
270+
<p>The proxy sidecar applies fine-grained filters to the response, reducing the number of rows and/or columns based on the user's security profile or other policies.</p>
271+
</li>
272+
<li>
273+
<p>The proxy sidecar returns the filtered response to the Gateway.</p>
274+
</li>
275+
<li>
276+
<p>The Gateway forwards the response to the Portal View, allowing the SPA to render the page.</p>
259277
</li>
260278
</ol>
261279

design/authentication-sequence.png

16 KB
Loading

design/fine-grained-authorization.html

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,35 @@ <h1 class="menu-title">Light Portal Documentation</h1>
153153
<div id="content" class="content">
154154
<main>
155155
<h1 id="fine-grained-authorization"><a class="header" href="#fine-grained-authorization">Fine-Grained Authorization</a></h1>
156+
<h2 id="what-is-fine-grained-authorization"><a class="header" href="#what-is-fine-grained-authorization">What is Fine-Grained Authorization?</a></h2>
157+
<p>Fine-grained authorization (FGA) refers to a detailed and precise control mechanism that governs access to resources based on specific attributes, roles, or rules. It's also known as fine-grained access control (FGAC). Unlike coarse-grained authorization, which applies broader access policies (e.g., "Admins can access everything"), fine-grained authorization allows for more specific policies (e.g., "Admins can access user data only if they belong to the same department and the access request is during business hours").</p>
158+
<h3 id="key-features"><a class="header" href="#key-features">Key Features</a></h3>
159+
<ul>
160+
<li><strong>Granular Control</strong>: Policies are defined at a detailed level, considering attributes like user role, resource type, action, time, location, etc.</li>
161+
<li><strong>Context-Aware</strong>: Takes into account dynamic conditions such as the time of request, user’s location, or other contextual factors.</li>
162+
<li><strong>Flexible Policies</strong>: Allows the creation of complex, conditional rules tailored to the organization’s needs.</li>
163+
</ul>
164+
<h2 id="why-do-we-need-fine-grained-authorization"><a class="header" href="#why-do-we-need-fine-grained-authorization">Why Do We Need Fine-Grained Authorization?</a></h2>
165+
<h3 id="1-enhanced-security"><a class="header" href="#1-enhanced-security">1. <strong>Enhanced Security</strong></a></h3>
166+
<p>By limiting access based on detailed criteria, fine-grained authorization minimizes the risk of unauthorized access or data breaches.</p>
167+
<h3 id="2-regulatory-compliance"><a class="header" href="#2-regulatory-compliance">2. <strong>Regulatory Compliance</strong></a></h3>
168+
<p>It helps organizations comply with legal and industry-specific regulations (e.g., GDPR, HIPAA) by ensuring sensitive data is only accessible under strict conditions.</p>
169+
<h3 id="3-minimized-attack-surface"><a class="header" href="#3-minimized-attack-surface">3. <strong>Minimized Attack Surface</strong></a></h3>
170+
<p>By restricting access to only the required resources and operations, fine-grained authorization reduces the potential impact of insider threats or compromised accounts.</p>
171+
<h3 id="4-improved-user-experience"><a class="header" href="#4-improved-user-experience">4. <strong>Improved User Experience</strong></a></h3>
172+
<p>Enables personalized access based on roles and permissions, ensuring users see only what they need, which reduces confusion and improves productivity.</p>
173+
<h3 id="5-auditing-and-accountability"><a class="header" href="#5-auditing-and-accountability">5. <strong>Auditing and Accountability</strong></a></h3>
174+
<p>Detailed access logs and policy enforcement make it easier to track and audit who accessed what, when, and why, fostering better accountability.</p>
175+
<h2 id="examples-of-use-cases"><a class="header" href="#examples-of-use-cases">Examples of Use Cases</a></h2>
176+
<ul>
177+
<li><strong>Healthcare</strong>: A doctor can only view records of patients they are treating.</li>
178+
<li><strong>Government</strong>: A government employee can access to data and documents based on security clearance levels and job roles.</li>
179+
<li><strong>Finance</strong>: A teller can only access transactions related to their assigned branch.</li>
180+
<li><strong>Enterprise Software</strong>: Employees can edit documents only if they own them or have been granted editing permissions.</li>
181+
</ul>
182+
<h2 id="fine-grained-authorization-in-api-access-control"><a class="header" href="#fine-grained-authorization-in-api-access-control">Fine-Grained Authorization in API Access Control</a></h2>
183+
<p>In API access control, fine-grained authorization governs how users or systems interact with specific API endpoints, actions, and data. This approach ensures that access permissions are precisely tailored to attributes, roles, and contextual factors, enabling a secure and customized API experience. As the Light Portal is a platform centered on APIs, the remainder of the design will focus on the API access control context.</p>
184+
<h2 id="requirements"><a class="header" href="#requirements">Requirements</a></h2>
156185

157186
</main>
158187

0 commit comments

Comments
 (0)