OAuth Redirect Authorization Code Flow in NERIS

[mayanksehgal-es]

The current OAuth2 workflow outlined in the this discussion puts the burden of accepting the user's credentials on the RMS' UI using the 'password' grant workflow. IMHO, This doesn't seem like the most secure workflow.

AFAIK, redirect-based auth code flows are the most secure method to authenticate a user and then perform an action on their behalf, like creating an integration. Are there plans to introduce an 'Authorization Code Flow' type mechanism that allows us (the RMS) to redirect the user to NERIS', allow them to enter their credentials securely and authenticate, and then redirect back to our software giving us the token and refresh token which then we can use to create an integration and sync their stations and units, etc.

P.S. I've only gone through the ReDoc documentation as well as the discussion forum so far. So if I have to look at some other documentation, please suggest.

[mayanksehgal-es]

@cweinschenk Please do help me with this.

[cweinschenk]

I would suggest this link too: https://neris.atlassian.net/servicedesk/customer/portal/3/article/268861475?source=search

If I am track what you asking -- the OAuth2 workflow is to connect your RMS software to the NERIS API -- a customers/users credentials are not directly involved in the workflow. An user with proper authorization for a particular entity can use their user/pass credentials to generate a client ID/secret either via the API or through the NERIS user interface. The client ID/secret are then exchanged via the API for access token/refresh token that allow you to maintain authentication. Enrollment of your client ID by an authn/authz user of that entity gives your integration permission to exchange data for that entity's NERIS ID.

[mayanksehgal-es]

@cweinschenk

To put it briefly, I would actually want the department to create an enrolment for my RMS client id through my RMS UI. Right now, they log-in to the NERIS platform and create an enrolment and then inform us and put their correct NERIS FDID in our system. To let them do this directly from the RMS UI, right now, I would have to show a popup and accept their credentials on my UI, then generate the token(s) and create the enrolment, which is doable, but couldn't be considered the best practice as ideally we, the RMS, shouldn't be collecting user's credentials as its unsafe.

A redirect workflow will ensure that we redirect them to the NERIS UI first to authenticate and then use a code to basically generate a short-lived token and refresh token that would help us to create an enrolment for the department for our RMS.

Obviously, for everything else, like posting an incident or creating stations and units we'll keep on using the clientid/secret combination to authenticate.

[cweinschenk]

You should NOT be collecting their NERIS credentials AT ALL.

• You [RMS] create an integration account with NERIS tied to your VN account. That integration uses a client ID/secret for authentication.
• You give the department admin the client ID (public side) of the integration.
• The department admin can then enroll your client ID in the NERIS UI (here they use their user/pass+MFA to authenticate).
• Upon enrollment of that client ID, your integration has authorization to operate on that NERIS ID.
• One integration can have multiple enrollments. You can view the enrollments (name/NERIs ID) for your integration in the NERIS UI or via an API call (list integrations by client ID point - you would need ).
• https://neris-prod-public.s3.us-east-2.amazonaws.com/docs/NERIS-Technical-Reference-Guide-DRAFT.pdf

[mayanksehgal-es]

@cweinschenk
Yes I know and understand this workflow pretty well and right now this is how enrolments are being done. I'm just suggesting in this post that having a redirect workflow (in the future) for OAuth, will eventually help us to authenticate and enrol right on the RMS (just like how google social authentication works) instead of asking the department to login to their NERIS account and then do the enrolment.

As I can understand with our conversation this workflow does not exist at the moment and the expected way is for the department to do the enrolment on their NERIS account only.

Thanks for taking time out for this Craig _/|_

[cweinschenk]

As I can understand with our conversation this workflow does not exist at the moment and the expected way is for the department to do the enrolment on their NERIS account only. <-- yes this is correct.