{"action":"created","issue":{"url":"https://api.github.com/repos/jembi/openhim-core-js/issues/299","labels_url":"https://api.github.com/repos/jembi/openhim-core-js/issues/299/labels{/name}","comments_url":"https://api.github.com/repos/jembi/openhim-core-js/issues/299/comments","events_url":"https://api.github.com/repos/jembi/openhim-core-js/issues/299/events","html_url":"https://github.com/jembi/openhim-core-js/issues/299","id":51665917,"number":299,"title":"Implement a 'keystore' were a user to can add certificates to authorise clients","user":{"login":"rcrichton","id":266576,"avatar_url":"https://avatars.githubusercontent.com/u/266576?v=3","gravatar_id":"","url":"https://api.github.com/users/rcrichton","html_url":"https://github.com/rcrichton","followers_url":"https://api.github.com/users/rcrichton/followers","following_url":"https://api.github.com/users/rcrichton/following{/other_user}","gists_url":"https://api.github.com/users/rcrichton/gists{/gist_id}","starred_url":"https://api.github.com/users/rcrichton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rcrichton/subscriptions","organizations_url":"https://api.github.com/users/rcrichton/orgs","repos_url":"https://api.github.com/users/rcrichton/repos","events_url":"https://api.github.com/users/rcrichton/events{/privacy}","received_events_url":"https://api.github.com/users/rcrichton/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/jembi/openhim-core-js/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/jembi/openhim-core-js/milestones/6","labels_url":"https://api.github.com/repos/jembi/openhim-core-js/milestones/6/labels","id":781679,"number":6,"title":"v1.1.x","description":"","creator":{"login":"rcrichton","id":266576,"avatar_url":"https://avatars.githubusercontent.com/u/266576?v=3","gravatar_id":"","url":"https://api.github.com/users/rcrichton","html_url":"https://github.com/rcrichton","followers_url":"https://api.github.com/users/rcrichton/followers","following_url":"https://api.github.com/users/rcrichton/following{/other_user}","gists_url":"https://api.github.com/users/rcrichton/gists{/gist_id}","starred_url":"https://api.github.com/users/rcrichton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rcrichton/subscriptions","organizations_url":"https://api.github.com/users/rcrichton/orgs","repos_url":"https://api.github.com/users/rcrichton/repos","events_url":"https://api.github.com/users/rcrichton/events{/privacy}","received_events_url":"https://api.github.com/users/rcrichton/received_events","type":"User","site_admin":false},"open_issues":23,"closed_issues":38,"state":"open","created_at":"2014-09-08T06:44:41Z","updated_at":"2015-02-03T07:22:31Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2014-12-11T09:46:03Z","updated_at":"2015-02-03T11:42:18Z","closed_at":null,"body":"We need to add a keystore to store certificates that are used to authorise clients. Here is a use case that I wrote (quickly, so mind the grammar...)\r\n\r\n> I'm really thinking about this in the case of the IHE connectathon. I that case they give each client a cert. Each those certs are signed by their own connectatnon Certificate Authority (CA). So as the OpenHIM, I need to be able to say I accept all client that are signed by the CA (I won't know about each client's cert). We can do this by telling node we accept all client's that have certificates that are signed by the CA, this is done by importing the CA cert. Then for us to determine who the client is, we look at the certificate that they present, and match them on the CN of the cert and the domain of the client in our datastore."},"comment":{"url":"https://api.github.com/repos/jembi/openhim-core-js/issues/comments/72636930","html_url":"https://github.com/jembi/openhim-core-js/issues/299#issuecomment-72636930","issue_url":"https://api.github.com/repos/jembi/openhim-core-js/issues/299","id":72636930,"user":{"login":"rcrichton","id":266576,"avatar_url":"https://avatars.githubusercontent.com/u/266576?v=3","gravatar_id":"","url":"https://api.github.com/users/rcrichton","html_url":"https://github.com/rcrichton","followers_url":"https://api.github.com/users/rcrichton/followers","following_url":"https://api.github.com/users/rcrichton/following{/other_user}","gists_url":"https://api.github.com/users/rcrichton/gists{/gist_id}","starred_url":"https://api.github.com/users/rcrichton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rcrichton/subscriptions","organizations_url":"https://api.github.com/users/rcrichton/orgs","repos_url":"https://api.github.com/users/rcrichton/repos","events_url":"https://api.github.com/users/rcrichton/events{/privacy}","received_events_url":"https://api.github.com/users/rcrichton/received_events","type":"User","site_admin":false},"created_at":"2015-02-03T11:42:18Z","updated_at":"2015-02-03T11:42:18Z","body":"So for this issue here is what I think the keystore should do:\r\n\r\n* Allow the admin user to upload a custom key and cert for the OpenHIM\r\n* Allow the admin user to upload individual trusted certs (for clients or hosts)\r\n* Allow the admin user to upload trusted certificate chains (for clients or hosts)\r\n* Allow the admin user to generate a self signed cert for a OpenHIM implementation rather than having to upload one\r\n* Allow the admin user to generate a key and certificate for a client signed by the HIM cert"}}