Auth GClasses

Authentication, authorization, and OAuth 2.

Source: kernel/c/root-linux/src/c_authz.c, c_auth_bff.c, c_idp_keycloak.c, c_task_authenticate.c

C_AUTHZ¶

Authorization manager — maintains a JSON Web Key Set (JWKS), verifies JWT tokens, and manages users and their access rules.

Commands¶

Every command from a peer asks a permission of the users treedb (treedb_authzs), whatever enable_command_authz says: read to list, create / update / delete to manage users (create-user with a role asks update too, as link-nodes does), update for the JWKs, set-max-sessions and check-user-pwd. Without it the answer is -403. Up to 7.25.21 they were SDF_AUTHZ_X only, which does nothing while the gate is off: any user the entry gate let in managed users and the trusted signing keys. tests/c/command_delete_user, case 12.

Every comment starts with the yuno that answers (new after 7.25.4; in 7.25.4 “User enabled: x”, “Set max_sessions: ...” and “User not found” did not): command-yuno id=<id> service=authz command=enable-user username=pepe@example.com answers 0: <role^name>: User enabled: pepe@example.com, and an unknown user -1: <role^name>: User not found: 'nobody@example.com'. A failure says its own cause and points at the log, e.g. <role^name>: cannot hash the password of user 'pepe@example.com' (see the log): create-user, update-user and set-user-pwd answered gobj_log_last_message(), the process-global buffer of the last ERROR of anybody. The test walks C_AUTHZ’s command table (tests/c/command_delete_user, case 11).

master is configuration, default false, never set by the service. With an empty tranger_path the path is built from authz_service (or the yuno role), the realm and authz_tenant; only a master creates the directory. A yuno that owns its users says so -- the agent, in its main.c:

'global': {
    'Authz.master': true,
    'Authz.authz_service': 'agent'
}

Without it, a store that does not exist gives “No authz db, authz only to local access” and no treedb, and a store another yuno owns is opened as a READ-ONLY replica.

with_link_events (SDF_RD, default 1, new in 7.26.0) is copied to the C_NODE of treedb_authzs: a link of a user to a role publishes EV_TREEDB_NODE_LINKED, not the role’s EV_TREEDB_NODE_UPDATED. A yuno whose v1 SPA edits treedb_authzs turns it off in its config:

{"name": "authz", "gclass": "C_AUTHZ", "kw": {"with_link_events": false}}

C_AUTH_BFF¶

Backend-For-Frontend OAuth 2 server — mediates between browser SPAs and Keycloak, storing tokens in httpOnly cookies.

Key attributes¶

Endpoints¶

C_IDP_KEYCLOAK¶

Manages the ACCOUNTS of a Keycloak identity provider through its admin REST API: create, list, read, change, delete, and email the user the link to set the password. It is not part of C_AUTHZ, which answers one question (does this user hold this permission); managing an external provider is another responsibility, with other credentials, another transport and other failure modes. Instantiated as the service idp, with neutral command names (list-idp-users, not list-kc-users): a second provider would be a sibling gclass serving the same commands, chosen in configuration.

The seam is an event. When it creates an account it publishes EV_IDP_USER_CREATED (username, first_name, last_name, role, idp_user_id), and each plane provisions itself -- C_AUTHZ writes the authorization node. delete-idp-user does NOT touch the local authz record.

One request at a time. Every command enters one queue and one volatile C_TASK drives it through the shared HTTP client; the admin token is job 0 and is skipped while the cached one is fresh. The queue holds 32: a caller beyond that is refused, never left waiting.

Attributes¶

The connection is configured at run time with set-kc-config, which saves it (persistent attributes): the values are per deployment and the secret never goes into code or committed configuration.

Commands¶

user_id also answers to id, which is unusable through command-yuno (the agent reads id as the yuno to address).

Example

The service in a yuno’s main.c, and its first configuration:

{                                                               \n\
    'name': 'idp',                                              \n\
    'gclass': 'C_IDP_KEYCLOAK',                                 \n\
    'autostart': true                                           \n\
},                                                              \n\

ycommand -c "command-yuno id=1620 service=idp command=set-kc-config \
    kc_base_url=https://auth.example.com kc_realm=example \
    kc_admin_client_id=yuneta-admin kc_admin_client_secret=<secret> \
    kc_redirect_uri=https://app.example.com/ kc_email_client_id=app"
ycommand -c "command-yuno id=1620 service=idp command=register-idp-user email=ana@example.com firstName=Ana"
ycommand -c "command-yuno id=1620 service=idp command=list-idp-users search=ana"

Details of the provisioning flow: YUNO_AUTH.md.

C_TASK_AUTHENTICATE¶

OAuth 2 authentication task — handles the Keycloak authentication flow and caches tokens.

Key attributes¶