CLARIN/OAuth2 use case

<sidebar>

• CLARIN web service security
  • CLARIN/Security_for_web_services|Analysis
  • CLARIN/OAuth2|OAuth2
  • CLARIN/OAuth2 use case|OAuth2 use-case
  • CLARIN/OAuth2_real_world_usage|OAuth2 elsewhere
• resources
  • https://mailman.nikhef.nl/mailman/listinfo/biggrid-clarin-security-discuss%7Cmailing list
  • http://agenda.nikhef.nl/conferenceDisplay.py?confId=993%7Cworkshop 2010
  • http://www.clarin.eu/%7CCLARIN
  • http://www.biggrid.nl/%7CBiG Grid

</sidebar> While in the end n-tier delegation is needed withing CLARIN, for the current use-case it is enough to do without real delegation. Plain OAuth2 is sufficient, just to get some experience with it. Delegation can be added later by using a delegation endpoint, or using certificate delegation.

So the goal now is to create a straightforward OAuth2 setup with client, authentication server, and resource server.

Resource server

The resource server needs to verify the access token supplied by the client, and perhaps needs to retrieve user information to base an authorization decision on (since one of the requirements is that resources can make the final decision). This is no more than a simple REST call to a check-token or user-information endpoint on the authentication server.

To make this easy for service developers, at least clear documentation is needed on how to do this. It would be useful to have code samples in a number of programming languages.

To complete it, a way to run the service directly on Apache, with just some extra configuration for doing the check and returning information in (environment) variables, would be great. This may include running a reverse proxy that does the authorization, and passing the request on to the real service upon success.