Authentication

[buchi]

Provides a PAS plugin for JWT based authentication.
Provides endpoints /@login, /@logout and /@login-renew

[tisto]

@sneridagh you already reviewed that pull request, right? Do we have an Angular 2 client implementation from the sprint already?

[sneridagh]

@tisto The only thing I miss is the documentation, the rest is good for me. The frontend team were using a basic half backed mockup for it all the time.

@buchi could you provide it? Do we have a way to delete expired tokens?

[tisto]

@buchi do you have time to finish the docs in the next days? If not it would be great if you could provide us with a few basic examples so we can finish the docs (or maybe just point us to a few tests?).

[buchi]

Will add the documentation asap, although I'm quite busy the next week because we (4teamwork) are moving to a new office.

@sneridagh Currently there's no automatic cleanup of stored tokens. I think we don't need that very much, because I see mainly two use cases:

1. JS client authentication: In this case I would not store the token on the server at all, but let it expire after some time (e.g. 12h). That's the default configuration of the PAS plugin.
2. Long term authentication token for apps: In this case the token should never expire, thus we need the ability to invalidate it. For this we have to store the token on the server. You can change the configuration of the PAS plugin to behave like this. The token can be manually deleted by calling the @logout endpoint.

[sneridagh]

@buchi If you're busy next week I can write it down for you if you wish.

[buchi]

@sneridagh I've added minimal documentation now but thanks anyway.

Should be ready for merging now.

[lukasgraf]

Tested the described functionality according to the documentation, works like a charm 🎉 (tested login, renewal, invalidating stored tokens, error response when trying to invalidate non-stored token, error response when trying to invalidate tokens twice).

[lukasgraf]

indefinitly -> indefinitely, disalbe -> disable

[lukasgraf]

The renewal endpoint name in the pull request body should be updated from /@refresh-login to /@login-renew

[buchi]

Fixed typos in documentation