hyperledger / fabric-x-committer / 40289479271

90%

main: 91%

Build Type

Pull #848

github

Committed by dean-amar

Commit Message

[auth] Add the Auth Service: nonce challenge, certificate-bound tokens, and authorization

#### Type of change

- New feature

#### Description

- New `auth` service (`committer start auth`) with three RPCs: `IssueNonce` hands out a single-use
  challenge, `Authenticate` exchanges an envelope signed over it for an opaque token bound to the
  client's TLS certificate, and `Authorize` checks a token against a resource's policy.
- Tokens (stored by hash) and nonces live in two new state-database tables, `auth_tokens` and
  `auth_nonces`, created by `init-db`, so any instance serves any request.
- Policy comes from the committed channel configuration's `ACLs` section, defaulting to
  `/Channel/Application/Readers`, and is re-read as the configuration changes.
- `statedb.ReadConfigTransaction` is the shared reader of the committed configuration (auth and query).
- Client helpers in `utils/acl`: `IssueToken`, `BuildAuthEnvelope`, `TLSCertHash`.
- Adds `grpcerror.WrapUnavailable`, `WrapUnauthenticated` and `WrapPermissionDenied`.

#### Additional details (Optional)

- Nothing enforces tokens yet; the Query Service and Sidecar are wired in #845.

#### Related issues

- resolves #844
- related to #592

Signed-off-by: Dean Amar <Dean.Amar@ibm.com>

Pull Request Pull Request #848: [ACL] Add the Auth Service: nonce challenge, certificate-bound tokens, and authorization [1/4]

Coverage Stats

335 of 438 new or added lines in 15 files covered. (76.48%)

6 existing lines in 4 files now uncovered.

10095 of 11193 relevant lines covered (90.19%)

9699.34 hits per line