Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement EM-to-EM authentication #2

Open
tupini07 opened this issue Jul 28, 2020 · 0 comments
Open

Implement EM-to-EM authentication #2

tupini07 opened this issue Jul 28, 2020 · 0 comments
Labels
enhancement New feature or request

Comments

@tupini07
Copy link
Contributor

tupini07 commented Jul 28, 2020

An idea would be to use symmetric key cryptography to sign the outgoing event from the “source EM” and then use the same key to decript the event in the target EM.

The key is provided by the user in the appsettings and is manually shared with all the “target EMs”.

There should be a special item in the appsettings config to place the current EM’s key. And each subscriber can potentially be associated with a key (which is manually provided by each of them)

Note that this should also support messages coming from an external service which doesn't use EM. In this case, it might be easier to just use a pre-shared API key, which can be a general setting in the applicationsettings.json of the host. All EM in a network use the same API key when communicating with each other (sent via a header), and the rest of external services just user this API key manually.

The API key approach is not very secure, but it at least ensures that no entities outside of the network send requests to the EM event reception endpoint.

... Possibly instead of API Key we can call it EM Network Key

@tupini07 tupini07 added this to the Authentication Methos milestone Jul 28, 2020
@tupini07 tupini07 added the enhancement New feature or request label Sep 16, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant