Hi Isuru, I have few comments and questions.
1. Are there 2 group backends to the User/Group core service (Database / Keycloak) or is Keycloak is the only group backend? How does the Airavata group based auth plugin with this? 2. How do you plan to bind permissions between agents and resources? For example, agent 1 should be able to access all files in comet server path /home/user1 but should not be allowed to access rest of the resources. 3. In below diagram, agent should have 2 tokens. User level token as illustrated in the diagram and agent level token with refresh which identifies the agent itself. Using that token we can whitelist/ blacklist agents talking to secure services. Thanks Dimuthu On Tue, Mar 17, 2020 at 10:45 AM Isuru Ranawaka <[email protected]> wrote: > Hi all, > > I have come up with an initial idea of implementing Groups in Custos [1]. > Based on Groups we can do API authorization, Distributed Agent > authentication (e.g MFT), probably HTRC Data Capsule authentication. > Please go through it if you find time and comment, add use cases as needed. > > > [1] > https://docs.google.com/document/d/1QtUKTfAnIrErvtYnKo3FizCRL2GUiWikEzvBnHPXfWw/edit#heading=h.pvwzdvihmpkk > > thanks > Isuru > > > > -- > Senior Engineer > WSO2 Lanka (pvt) Ltd > Blog:- http://isurur.blogspot.com/ > Phone:- +94714629880 >
