One-time token authentication

[oberstet]

Design and then describe "one-time token" based WAMP authentication in the "WAMP Advanced Profile" specification.

Connected issues:

• Implement authentication: one-time token crossbario/crossbar#13
• Implement authentication: one-time token crossbario/autobahn-js#88

[mbonneau]

I noticed that the ticket-based authentication has been removed from the AP.

I currently have projects that use this with JWT (which I think is a great fit for this). Is this something that will be coming back to the spec?

[oberstet]

Oh, this is a bug! Seems I accidentally dropped it during my recent refactorings .. thanks for notice!

[mbonneau]

Great! Thanks.

[oberstet]

@mbonneau ok, it's there again https://github.com/tavendo/WAMP/blob/master/spec/advanced.md#ticket-based-authentication

[mbonneau]

This looks like it requires authid be set by the client:

"The HELLO.Options.authid|string is the authentication ID (e.g. username) the client wishes to authenticate as. For Ticket-based authentication, this MUST be provided."

When we originally implemented this we were referencing the persona example which set authid on the welcome.

I do see you referencing this feature here:

crossbario/crossbar#232

Should I open an issue on the spec about this?

[oberstet]

Persona-based authentication used authmethod == persona, not authmethod == ticket.

This is all not yet completely sorted out, so you might of course file an issue and ideally work on proposals and how to get this all into a cohesive design.

Probably both scenarios are valid for ticket based auth: client providing auth ID plus ticket, or only ticket and auth ID being assigned.

Would be best to have a list of concrete use cases for this auth method first.

[oberstet]

@mbonneau actually, HELLO.Options.authid|string MUST be provided for both WAMP-CRA and WAMP-Ticket, but MAY be even an empty string, the WELCOME.Details.authid|string MAY be different from the former, and MUST be the effective authid in use.

So you could provide an empty string in HELLO.Options.authid, and send the actual authid in WELCOME.Details.authid.

In above issue crossbario/crossbar#232 @Paranaix was asking for being able to set effective authid from dynamic authenticators in Crossbar.io. This is now possible, and the wire level WAMP messages exchanged conform to the spec.

Not sure, does above make sense? Need more text in the spec?

[mbonneau]

Thanks for the reply. This makes sense.

[oberstet]

sufficiently described IMO (as part of WAMP-Ticket based authentication)