Authorisation framework for bot... about program-y HOT 6 CLOSED

Looks like a good approach, and further thinking I agree that an auth framework would be a good approach.

Previous Bots have relied on different approaches. The last one I built provided Web, SMS, XMPP and Twitter. it required you to register SMS, XMPP and Twitter info and we would then use the credentials embedded in the sent data to see if you should be allowed and for Web, you first had to log onto the website customer account section which left a cookie with your credentials that we could use.

All of these options allowed non authenticated comms for general questions, but if you asked account specific and failed auth you were told to either log into the web client or register your credentials

from program-y.

I've now started on the authentication framework, new branch authframework contains the code for now until we agree and merge

from program-y.

So I moved forward with this and now have authentication and authorisation frameworks in place

Authentication is as above following your pattern for using the pre-processor which once I'd implemented it seems the logical place. as authentication should be for every request

Authorisation, however, is likely to be on a per command or group of commands and as such I've implemented a User, Roles and Groups capability and introduced a new tag

Basically, Users have Roles, Groups have Roles, User can belong to Groups and Groups can contain Groups. This gives a flexible approach to applying authorization rules to different collections of people.

There is also a new tag which you wrap a template in which first checks if the user is authorised to execute the template using the above Users, Roles and Groups, e.g

<template>
    <authorise role="sysadmin">
            <srai>LIST ACTIVE USERS</srai>
    </authorise>
<template>

So when the parser gets to this template, it checks that the user defined by clientid, has the role of "sysadmin" either directly or through associated with a group. Only then does it execute the srai.
If user does not have authorisation, then it returns FAIL_AUTHORISATION token

Still work in progress on the authframework branch but its coming together nicely

k

from program-y.

Hi Sean/ #ideasean ,
Well this email thread has generated a big piece of work, specifically adding authorisation and authentication into the core code base.
I have moved authentication in the core brain loop rather than use a pre-processor. This makes it more solid as a solution
Authentication is now a tag as described above, and there is an implementation of Users, Groups and Roles with an associated way of loading them from a file for now
All code still on the authframework branch but looking good I think
K

from program-y.

Now merged and sync'd to master, keeping open until documentation written

from program-y.

Documentation now moving onto the wiki under security, closing this issue to allow individual issues to be raised if needed

from program-y.