Rafiki: Rafiki (RS) <> Auth Server (AS) Integration: Access control and signing requests

[matdehaast]

Summary

Rafiki's Open Payments APIs require GNAP grants and corresponding signature-bound access tokens for authentication and authorization.

Intended Outcomes

All requests are access controlled and signed. This includes the following requests

• client <> RS
• RS <> AS
• RS <> another RS

How will it work?

• Rafiki validates token + signature on client requests
• Rafiki self-provisions key(s)
• Rafiki (optionally) signs introspection requests with said key(s)
• Rafiki requests grants to access resources on other Rafiki instances (e.g. incoming payments)
• Rafiki signs requests to other Rafiki instances

Links

• Milestone
• Validate httpsig on RS requests rafiki#585
• Self-provisioned keys rafiki#606
• Add httpsig to RS token introspection requests rafiki#576
• Request grant at other Open Payments server(s) rafiki#583
• Generate httpsig for internal OP calls rafiki#587
• Add Guide for Signing interactions between the AS & RS open-payments#184