API Security

[murphysj]

WHO: Mark

Need to secure api with ssl certificate.

[asladeofgreen]

IPSL has obtained a server certificate but it's use would entail moving API to an IPSL server - not sure if we really want to do this at this time.

[asladeofgreen]

Need to secure at HTTPS level and also enforce authentication

[SebastienDenvil]

How to enforce authentication by the end of May? We need a strategy document about that. For py-esdoc client first, then we will extent. If the CIM questionnaire wrap the pyesdoc-client then we win twice.

[asladeofgreen]

This scenario is very different form the CIM Questionnaire. The focus here is securing the ES-DOC API publishing endpoints. I would suggest simple HTTPS digest authentication with an authenticator at the API which simply performs a whitelist check against a config file.

Thus when institute X wishes to leverage pyesdoc to publish documents the admin workflow is as follows:

1. Institute X contacts ES-DOC support to request authentication.
2. ES-DOC supports generate username / password which is added to authentication whitelist config file.
3. ES-DOC supports sends credentials to institute X in an offline manner (a telephone call will suffice).
4. Institute X updates local pyesdoc.json config file which is their responsibility to secure.

The above is very simple and will take a day or so to implement on the API side.

[SebastienDenvil]

Let's have a document describing this. Let's circulate this (es-doc-pi + wip). And then if we all agree and we know who will support that charge (es-doc support) then let's implement.

[murphysj]

Moving out of any milestone until this is better understood.