[AIRAVATA-1624] [GSoC] Securing Airavata API

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: WISHLIST
• Component/s: Airavata API
• Labels: gsoc gsoc2015 mentor
• Assignee: Supun Nakandala
• Reporter: Suresh Marru
• Created: 06/Mar/15 19:44
• Updated: 16/May/16 15:06
• Resolved: 16/May/16 15:06

Description

Apache Airavata uses Thrift based API's for external facing API's and for system internal CPI's. The API's need to be secured adding authentication and authorization capabilities.

The Authentication need to ensure only approved users/clients can communicate. Similarly clients should only interact with valid servers.

Authorization need to be enforced to ensure only users with specific roles can appropriately access specific API's. As an example, administrative roles should be able see all the users experiments where as end users can only see his/her data and not access other information (unless explicitly shared).

Earlier GSoC project focused on this topic has relavent discussion.
https://cwiki.apache.org/confluence/display/AIRAVATA/GSoC+2014+-+Add+Security+capabilities+to+Airavata+Thrift+services+and+clients

Issue Links

• supercedes: AIRAVATA-1420 Add Security capabilities to Airavata Thrift services and clients

Sub-Tasks

• Implementation of OAuth request_code grant flow in pga: Closed
• Enabling tls communication between PGA and Airavata: Closed
• Integration of API security components & test the implementation: Closed