blob: 5a0dcc94b75492bfb8ccd65c105204c449ead2b8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
Authentication
==============
.. contents::
:local:
Authentication with the Soledad server is made using `Twisted's Pluggable
Authentication system
<https://twisted.readthedocs.io/en/latest/core/howto/cred.html>`_. The
validation of credentials is performed by verifying a token provided by the
client.
There are currently two distinct authenticated entry points:
* A public TLS encrypted **Users API**, providing the *Synchronization* and
*Blobs* services, verified against the Leap Platform
``tokens`` database.
* A local plaintext **Services API**, providing the delivery part of the
*Incoming* service, authenticated against tokens defined in a file specified
on the server configuration file.
Authorization header
--------------------
The client has to provide a token encoded in an HTTP auth header, as in::
Authorization: Token <base64-encoded uuid:token>
If no token is provided, the request is considered an "anonymous" request.
Anonymous requests can only access `GET /`, which returns information about the
server (as the version of the server and runtime configuration options).
Special credentials for local services
--------------------------------------
Some special credentials can be added into a file
(``/etc/soledad/incoming.tokens``, by default) and then configured in the
Soledad Server configuration file. Currently, the only special credential
provided is for the `/incoming` API.
Implementation
--------------
Soledad Server package includes a systemd service file that spawns a ``twistd``
daemon that loads a `.tac file
<https://twistedmatrix.com/documents/12.2.0/core/howto/application.html#auto5>`_.
When the server is started, two services are spawned:
* A local entrypoint for services (serving on localhost only).
* A public entrypoint for users (serving on public IP).
* Localhost and public IP ports are configurable. Default is 2424 for public IP
and 2525 for localhost.
.. code-block:: none
.------------------------------------------------------.
| soledad-server |
| (twisted.application.service.Application) |
'------------------------------------------------------'
| |
.--------------. .----------------.
| 0.0.0.0:2424 | | 127.0.0.1:2525 |
| (TLS) | | (TCP) |
'--------------' '----------------'
| |
.----------------. .----------------------.
| Auth for users | | Auth for services |
| (UsersRealm) | | (LocalServicesRealm) |
'----------------' '----------------------'
| |
.------------------. .-------------------------.
| Users API | | Services API |
| (PublicResource) | | (LocalResource) |
'------------------' '-------------------------'
| .-------. .-----------------. |
'->| /sync | | /incoming |<-'
| '-------' | (delivery only) |
| .--------. '-----------------'
'->| /blobs |
'--------'
|
