[Proposal 005] Node Authorization

accepted/005-node-authentication.md

@@ -0,0 +1,71 @@
+# Design / Feature
+
+*TODO for the document:*
+* *analyse and select default policy engine.*
+* *analyse policy engines available in rust.*
+
+This feature will allow an administrative user to authenticate with the node.
+
+#### Scope
+This document only covers node authorization. Application authorization is out
+of scope for this proposal.
+
+#### Policy Engine
+[Proposal 002](/accepted/002.md) provides the aurae daemon with an SSH authenticated
+user based upon SSH Certificates. The selected authentication provides identity
+and communication channel encryption.
+
+Authorization consumes the identity provided by Proposal 002. When the user
+connects, the user identity is authenticated directly from the connection. Upon
+initial connection, the identity is sent to an authorization plugin.
+
+The authorization engine receives a message with the identity, action, and
+parameters. The authorization engine returns a decision. Aurae Daemon is
+responsible for enforcing the decision.
+
+A default policy engine will be installed when no other authorization engine
+has been installed.
+
+Authorization decisions default to deny.
+
+Not installing a policy engine causes all requests to be denied.
+
+### Policy Engine Selection
+
+**TODO**
+
+#### Workflow:
+
+```mermaid
+sequenceDiagram
+client-->>auraed: Connect via ssh
+auraed-->>policy engine: id, action, parameters
+policy engine-->>auraed: decision
+note over auraed: enforce
+auraed-->>client: status
+```
+
+### Outcomes
+
+The outcomes of adding support for policy engines are:
+
+* auraed will be capable of handling arbitrary scenarios based upon the connecting client.
+* policies may be written in languages designed to deal with policy.
+* changes to the policy do not require a recompilation of auraed.
+* policy can be centralized for multiple auraed.
+
+### Goals
+
+ - Aurae Daemon will integrate with an authentication policy engine.
+
+### Decisions
+
+ - The project will use a policy engine plugin to implement the policy.
+ - TODO: select the policy engine plugin.
+
+### Notes
+
+### Authors
+
+ - [@kris-nova](https://github.com/kris-nova)
+ - [@tani](https://github.com/taniwha3)