snapp-incubator / soteria Goto Github PK

We have test cases for authenticators but we don't have any for APIs. APIs are internally uses authenticators but it would be great if we can cover them at least using simple hmac-based JWT token.

In the new version of EMQX (v5), they support JSON request and response. We need to create new endpoints in which we can parse JSON
for getting username and password and then returning results as JSON. It is configurable in its user interface as follows:

In case of success, beside the status code,

HTTP/1.1 200 OK
Headers: Content-Type: application/json

you need to provide body as follows:

{
    "result": "allow", // options: "allow" | "deny" | "ignore"
    "is_superuser": true // options: true | fals, default value: false
}

https://www.emqx.io/docs/en/v5.2/access-control/authn/http.html#http-request-and-response

New release of EMQX (version 5) does not have a way for disabling authentication and authorization on a specific listener so we need to do the authentication and give the superuser access so we can actually reduce their future load on the system.

Because these are internal systems, we can use HMAC-based solutions for their JWT token and make the procedure easier than what we have for external services.