Auth-Service

Abstract

The ocis Auth Service is used to authenticate service accounts. Compared to normal accounts, service accounts are ocis internal only and not available as ordinary users like via LDAP.

The auth Service Family
Service Accounts
Configuring Service Accounts
Example Yaml Config

The `auth` Service Family

ocis uses serveral authentication services for different use cases. All services that start with auth- are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:

auth-app handles authentication of external 3rd party apps
auth-basic handles basic authentication
auth-bearer handles oidc authentication
auth-machine handles interservice authentication when a user is impersonated
auth-service handles interservice authentication when using service accounts

Service Accounts

Service accounts are user accounts that are only used for inter service communication. The users have no personal space, do not show up in user lists and cannot login via the UI. Service accounts can be configured in the settings service. Only the admin service user is available for now. Additionally to the actions it can do via its role, all service users can stat all files on all spaces.

Configuring Service Accounts

By using the envvars OCIS_SERVICE_ACCOUNT_ID and OCIS_SERVICE_ACCOUNT_SECRET, one can configure the ID and the secret of the service user. The secret can be rotated regulary to increase security. For activating a new secret, all services where the envvars are used need to be restarted. The secret is always and only stored in memory and never written into any persistant store. Though you can use any string for the service account, it is recommmended to use a UUIDv4 string.

Example Yaml Config

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


# Autogenerated
# Filename: auth-service-config-example.yaml

tracing:
  enabled: false
  type: ""
  endpoint: ""
  collector: ""
log:
  level: ""
  pretty: false
  color: false
  file: ""
debug:
  addr: 127.0.0.1:9198
  token: ""
  pprof: false
  zpages: false
grpc:
  addr: 127.0.0.1:9199
  tls: null
  protocol: tcp
token_manager:
  jwt_secret: ""
reva:
  address: com.owncloud.api.gateway
  tls:
    mode: ""
    cacert: ""
service_account:
  service_account_id: ""
  service_account_secret: ""

Environment Variables

Name	Type	Default Value	Description
OCIS_TRACING_ENABLED AUTH_SERVICE_TRACING_ENABLED	bool	false	Activates tracing.
OCIS_TRACING_TYPE AUTH_SERVICE_TRACING_TYPE	string		The type of tracing. Defaults to ‘’, which is the same as ‘jaeger’. Allowed tracing types are ‘jaeger’ and ’’ as of now.
OCIS_TRACING_ENDPOINT AUTH_SERVICE_TRACING_ENDPOINT	string		The endpoint of the tracing agent.
OCIS_TRACING_COLLECTOR AUTH_SERVICE_TRACING_COLLECTOR	string		The HTTP endpoint for sending spans directly to a collector, i.e. http://jaeger-collector:14268/api/traces. Only used if the tracing endpoint is unset.
OCIS_LOG_LEVEL AUTH_SERVICE_LOG_LEVEL	string		The log level. Valid values are: ‘panic’, ‘fatal’, ’error’, ‘warn’, ‘info’, ‘debug’, ’trace’.
OCIS_LOG_PRETTY AUTH_SERVICE_LOG_PRETTY	bool	false	Activates pretty log output.
OCIS_LOG_COLOR AUTH_SERVICE_LOG_COLOR	bool	false	Activates colorized log output.
OCIS_LOG_FILE AUTH_SERVICE_LOG_FILE	string		The path to the log file. Activates logging to this file if set.
AUTH_SERVICE_DEBUG_ADDR	string	127.0.0.1:9198	Bind address of the debug server, where metrics, health, config and debug endpoints will be exposed.
AUTH_SERVICE_DEBUG_TOKEN	string		Token to secure the metrics endpoint.
AUTH_SERVICE_DEBUG_PPROF	bool	false	Enables pprof, which can be used for profiling.
AUTH_SERVICE_DEBUG_ZPAGES	bool	false	Enables zpages, which can be used for collecting and viewing in-memory traces.
AUTH_SERVICE_GRPC_ADDR	string	127.0.0.1:9199	The bind address of the GRPC service.
OCIS_GRPC_PROTOCOL AUTH_SERVICE_GRPC_PROTOCOL	string	tcp	The transport protocol of the GRPC service.
OCIS_JWT_SECRET AUTH_SERVICE_JWT_SECRET	string		The secret to mint and validate jwt tokens.
OCIS_REVA_GATEWAY	string	com.owncloud.api.gateway	The CS3 gateway endpoint.
OCIS_GRPC_CLIENT_TLS_MODE	string		TLS mode for grpc connection to the go-micro based grpc services. Possible values are ‘off’, ‘insecure’ and ‘on’. ‘off’: disables transport security for the clients. ‘insecure’ allows using transport security, but disables certificate verification (to be used with the autogenerated self-signed certificates). ‘on’ enables transport security, including server certificate verification.
OCIS_GRPC_CLIENT_TLS_CACERT	string		Path/File name for the root CA certificate (in PEM format) used to validate TLS server certificates of the go-micro based grpc services.
OCIS_SERVICE_ACCOUNT_ID AUTH_SERVICE_SERVICE_ACCOUNT_ID	string		The ID of the service account the service should use. See the ‘auth-service’ service description for more details.
OCIS_SERVICE_ACCOUNT_SECRET AUTH_SERVICE_SERVICE_ACCOUNT_SECRET	string		The service account secret.