Skip to content
Koop authentication plugin using file-based identity-store
JavaScript
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
docs
src
test
.gitignore
.travis.yml
CHANGELOG.md
LICENSE
README.md
RELEASE.md
package.json
user-store.json.example

README.md

Koop-Auth-Direct-File

A authentication module for implementing direct authentication from client to Koop server with a file-based user-store

npm
travis
Greenkeeper badge

Authentication pattern

The authentication module implemented here uses a direct authentication pattern; it receives user credentials (username/password) from a client and authenticates those credentials against an identity/user-store. Requests with valid credentials are issued an access-token (a string of encoded-data); The access token is encoded with the use of a secret known only to the Koop server. The access-token expires and becomes invalid after a certain period (default of 60 minutes).

get access token

The issued access-token should be attached to all subsequent service requests by the client. When the server receives a request, it will check for the presence of an access-token and reject any requests that are missing such token. If the token is present, the server attempts to decode it with its stored secret. Failure to decode results in a request rejection. Once decoded, the server checks the token's expiration-date and rejects any token with a date that is out of range. If the token is not expired, the request for the desired resource proceeds.

enter image description here

Example of Koop authentication implementation

The server.js file provides an example of securing a provider's resources. Start by requiring the authentication module. Pass it a secret and the file path of your user-store.

let auth = require('@koopjs/auth-direct-file')('pass-in-your-secret', `${__dirname}/user-store.json`)
koop.register(auth)

Then require and register your providers.

const provider = require('./')
koop.register(provider)

The authentication module will configure and add its authorize, authenticate, and authenticationSpecification functions to the provider's model prototype. Output services will leverage these functions to secure the service endpoints and properly route requests to authenticate.

Finally, create a JSON file store. This should be an array of objects with properties username and password. Set an environment variable USER_STORE with the path of the file relative to the root of the repository (e.g, USER_STORE=./user-store.json)

Authentication API

(secret, options) ⇒ Object

  • configure the authentication module with secret use for token encoding/decoding
Param Type Description
secret string secret for encoding/decoding tokens
userStoreFilePath string path to the JSON file containing the array of username/password objects
options object options object
options.tokenExpirationMinutes integer minutes until token expires (default 60)
options.useHttp boolean pass the useHttp boolean flag as part of the authenticationSpecification function result

Special considerations for use with koop-output-geoservices

koop-output-geoservices assumes that token-services occur over HTTPS. For development purposes you may wish to allow authentication to occur of HTTP. This can be done two different ways. You can add the useHttp option when configuring the module, which will be passed on in the result of authenticationSpecification() calls.

let auth = require('@koopjs/auth-direct-file')('pass-in-your-secret', `${__dirname}/user-store.json`, { useHttp: true })
koop.register(auth)

Alternatively, you can set an environment variable KOOP_AUTH_HTTP=true. Either of these approaches inform koop-output-geoservices to use http as the protocol of the tokenServicesUrl.

Notes on use with ArcGIS Online and ArcGIS Portal

This authorization plugin has been tested with ArcGIS Online and ArcGIS Portal. For versions of Portal earlier than 10.6, you may need to import the root of your certificate into Portal's trust store. We have observed the inability to store credentials for a secured Koop service on Portal instances that have not yet imported the root SSL certificate (of the Koop instance) into the trust-store.

You can’t perform that action at this time.