{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/loopback/issues/1338","labels_url":"https://api.github.com/repos/strongloop/loopback/issues/1338/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/loopback/issues/1338/comments","events_url":"https://api.github.com/repos/strongloop/loopback/issues/1338/events","html_url":"https://github.com/strongloop/loopback/issues/1338","id":71104166,"number":1338,"title":"Authentication, Authorization, Accounting/Audit (AAA)","user":{"login":"OwenBrotherwood","id":866122,"avatar_url":"https://avatars.githubusercontent.com/u/866122?v=3","gravatar_id":"","url":"https://api.github.com/users/OwenBrotherwood","html_url":"https://github.com/OwenBrotherwood","followers_url":"https://api.github.com/users/OwenBrotherwood/followers","following_url":"https://api.github.com/users/OwenBrotherwood/following{/other_user}","gists_url":"https://api.github.com/users/OwenBrotherwood/gists{/gist_id}","starred_url":"https://api.github.com/users/OwenBrotherwood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OwenBrotherwood/subscriptions","organizations_url":"https://api.github.com/users/OwenBrotherwood/orgs","repos_url":"https://api.github.com/users/OwenBrotherwood/repos","events_url":"https://api.github.com/users/OwenBrotherwood/events{/privacy}","received_events_url":"https://api.github.com/users/OwenBrotherwood/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-04-26T18:38:33Z","updated_at":"2015-04-28T04:23:03Z","closed_at":null,"body":"The use of Roles,  the concept of a user can be a member of a group, and the group can have a Role for which ACL's are defined.\r\n\r\nThe concept of AAA as a middleware that ensures the correct usage of API without the model being overloaded with ACL concerns and that the middleware controls the AAA of access to an API.\r\n\r\n# AAA\r\n\r\n## Authentication\r\n\r\n* Use of access_token in header contra url/cookie\r\n* Exposing the information of authentication for latter use of Authorization\r\n  * User details\r\n  * Authentication source: local, facebook, google, LDAP etc\r\n  * User IP: geographics\r\n  * User memberOfGroups: local, LDAP etc\r\n\r\n## Authorization\r\n\r\n* Usage of information from Authentication\r\n* Time limits for authorization before a new authentication should be requested\r\n* Roles with groups and users as member of group(s) \r\n\r\n## Accounting\r\n\r\n* rate limiting of API usage\r\n* \"simple Accounting\" payement\r\n\r\n## Audit\r\n* What is interesting for who did what when\r\n* a model over AAA such that the AAA can be auditet via an API and not just \"read the code\"\r\n\r\nPossible main bearer of future loopback work\r\n- https://github.com/strongloop/loopback/issues/1091 \r\n\r\nOther issues of relevance\r\n- https://github.com/strongloop/loopback/issues/1316\r\n- https://github.com/strongloop/loopback/pull/1323\r\n- https://github.com/strongloop/loopback/issues/397\r\n  - https://github.com/strongloop/loopback/issues/397#issuecomment-58048529\r\n\r\nOther \"stuff\"\r\n- The whole linked account scenarios/use cases: what effects AAA<->Linked Accounts"},"comment":{"url":"https://api.github.com/repos/strongloop/loopback/issues/comments/96905432","html_url":"https://github.com/strongloop/loopback/issues/1338#issuecomment-96905432","issue_url":"https://api.github.com/repos/strongloop/loopback/issues/1338","id":96905432,"user":{"login":"OwenBrotherwood","id":866122,"avatar_url":"https://avatars.githubusercontent.com/u/866122?v=3","gravatar_id":"","url":"https://api.github.com/users/OwenBrotherwood","html_url":"https://github.com/OwenBrotherwood","followers_url":"https://api.github.com/users/OwenBrotherwood/followers","following_url":"https://api.github.com/users/OwenBrotherwood/following{/other_user}","gists_url":"https://api.github.com/users/OwenBrotherwood/gists{/gist_id}","starred_url":"https://api.github.com/users/OwenBrotherwood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OwenBrotherwood/subscriptions","organizations_url":"https://api.github.com/users/OwenBrotherwood/orgs","repos_url":"https://api.github.com/users/OwenBrotherwood/repos","events_url":"https://api.github.com/users/OwenBrotherwood/events{/privacy}","received_events_url":"https://api.github.com/users/OwenBrotherwood/received_events","type":"User","site_admin":false},"created_at":"2015-04-28T04:23:03Z","updated_at":"2015-04-28T04:23:03Z","body":"# Use Case Authentication\r\n- Some external force requires 100% compliance to access_token is not a cookie or url.\r\n  - some pull request add's an option that defines the method by which an access_token is used\r\n    - in future version of looback, an audit shows the method by which access_token is used as this is documenmted by an api    "}}