solid / solid/data-interoperability-panel

Authorization Server Registration (sub class of Agent Registration)

Open
#258 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Bikeshed
Stars
58
Forks
18
PR merge metrics
No merged PRs in 30d

Description

We've been discussing how the Authorization Server gets access to Data Grants which are relevant to the Resource Servers associated with it. I would like to consider introducing Authorization Server Registration.

I see this issue related to #187 since we are talking about granting access to specific data grants.

Authorization Server Registration just as any Agent Registration would have and Access Grant. This Access Grant in turn would link to any number of Grant Grant (TODO: rename) instead of Data Grant.

Grant Grant could reference each of the Data Grants with something like hasDataGrant (instead of hasDataInstance). If we see a need to use scopes we could define a new one or reuse SelectedFromRegistry.

I see at least one change that could align Grant Grant more closely with how Data Grant works.

Instead of storing Data Grant in an Agent Registration, they could be stored in a Grant Registry. This way each Access Grant would still be stored in Agent Registration of the grantee, but it would like to Data Grant (same for the Grant Grant) in the Grant Registry. I don't think this change is necessary but it would move us further from relying on a containment hierarchy.


I also see one challenge. Based on Data Grants (specifical value of hasDataRegistration) we can find the Resource Server to which the grant is applicable. Currently, the Authorization Server can be discovered from the as_uri parameter in the WWW-Authenticate header of 401 Unauthorized. I see it as unreliable for 2 reasons:

  1. Knowledge of IRI denoting a protected resource is needed to get 401 response
  2. There is no resource for which notifications subscription could be established. AS associated with RS could possibly change at any time.

I think RS (Solid Storage) should advertise its AS in server metadata resource and allow subscribing to it. This way an AA, which manages Authorization Server Registrations, could subscribe to metadata resources of all Resource Servers that it has Data Grants for and keep up-to-date GrantGrants for their corresponding Authorization Servers.

/cc @justinwb @laurensdeb @woutermont

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with issue #187 and the existing Agent Registration, Access Grant, Data Grant, Grant Registry, and server metadata concepts referenced here. Done requires an agreed Authorization Server Registration model and a resolved way for an AA to discover and track associated Authorization Servers; the issue does not identify implementation files or tests.

Written by the indexing model from the issue text.

Assessment

Domain
authorization
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
18/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.