> I think we should go for a taken based approach (e.g. OAuth) to handle > these scenarios. Following are few ideas > > > 1. > > Using a token ( Ann attesting system user can do publish/ access to > this stream on her behalf), Ann let the “system user“ publish data into > Ann’s account > > If a device can store a token, Ann can generate a token with necessary scope (to access Ann's event store) and store the token in the device itself. In that case, device can send the token with each event, so that IoT platform can decide permissions based on the token.
> > 1. > > When we give user Smith access to a gadget, we generate a token, which > he will send when he is accessing the gadget, which the gadget will send to > the DAS backend to get access to correct tables > 2. > > Same token can be used for API access as well > 3. > > We need to manage the tokens issued to each user so this happen > transparently to the end user as much as possible. > > >
_______________________________________________ Architecture mailing list [email protected] https://mail.wso2.org/cgi-bin/mailman/listinfo/architecture
