Request for API to Verify Token in Stargate Coordinator

[aoleizhou]

We are the CMU capstone team working on developing the Key-Value caching API service(https://github.com/Stargate-KV/rest-key-value-store). After discussing the requirements with Kathir, we request to consider adding an API to verify the validity of a token received in Stargate, so that we can implement the necessary authentication and authorization mechanisms in our project effectively.

This API will be crucial for our project as it will allow us to ensure that clients accessing our key-value cache service use valid tokens registered in the Stargate coordinator node, even if the data is accessed directly from the cache service not routed through the coordinator node.

Thanks!

[kathirsvn]

I think, we should consider authorization as well while designing this API.
For example, we can accept token, resource, and operation as input and perform below.

• Verify if the token is valid and return with failure immediately if not.
• If the token is valid, check if the user has access to perform the given operation on the given resource by accessing the underlying Auth API implementation and return true or false based on the permission.

[ivansenic]

I am still not getting the use case here? Why is the extra API endpoint needed? Wouldn't you get 401 back if the token is not valid?

[kathirsvn]

@ivansenic The use case is that the API layer in this project, ll have some of the data in the cache and will try to serve from the cache itself instead of a querying data from the coordinator. So, the requirement is that there must be an API in the coordinator (bridge service), which can be used by this API to perform Authn/z before serving or updating the data in the cache.

[ivansenic]

@ivansenic The use case is that the API layer in this project, ll have some of the data in the cache and will try to serve from the cache itself instead of a querying data from the coordinator. So, the requirement is that there must be an API in the coordinator (bridge service), which can be used by this API to perform Authn/z before serving or updating the data in the cache.

Yea understood.. Thanks for clarification..